Microsoft-Windows-User-Diagnostic

Event	Title	Channel	Sample	Rule
1	task_0	Operational	Y	N

Event ID 1: task_0

Channel: Operational
Also via: realtime ETW trace
Level: Warning

Fields #

Name	Description
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-User-Diagnostic",
    "guid": "{305FC87B-002A-5E26-D297-60223012CA9C}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000000",
    "time_created": "2026-06-02T05:32:14.412+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4820,
      "thread_id": 7912
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ErrorCode": 258
  },
  "message": ""
}

Provenance

ETW provider GUID {305FC87B-002A-5E26-D297-60223012CA9C}

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB