Microsoft-Windows-UserModePowerService
59 events across 2 channels
Event ID 3: RundownAcPowerSetting_V1
#Fields #
| Name | Description |
|---|---|
SubgroupGuid GUID | |
SettingGuid GUID | |
ValueIndex UInt32 | |
Type UInt32 | |
DataSize UInt32 | |
Data Binary | |
Altitude UInt32 |
Event ID 4: RundownDcPowerSetting_V1
#Fields #
| Name | Description |
|---|---|
SubgroupGuid GUID | |
SettingGuid GUID | |
ValueIndex UInt32 | |
Type UInt32 | |
DataSize UInt32 | |
Data Binary | |
Altitude UInt32 |
Event ID 8: RundownBatteryInformation
#Fields #
| Name | Description |
|---|---|
DeviceName UnicodeString | |
ManufacturerName UnicodeString | |
ManufactureDay UInt8 | |
ManufactureMonth UInt8 | |
ManufactureYear UInt16 | |
SerialNumber UnicodeString | |
Capabilities UInt32 | |
Technology UInt8 | |
Pad Binary | |
Chemistry AnsiString | |
DesignCapacity UInt32 | |
FullChargeCapacity UInt32 | |
DefaultAlert1 UInt32 | |
DefaultAlert2 UInt32 | |
CriticalBias UInt32 | |
CycleCount UInt32 | |
GranularityScaleCount UInt32 | |
GranularityScale SID | |
UniqueId UnicodeString |
Event ID 9: RundownBatteryStatus
#Fields #
| Name | Description |
|---|---|
State UInt32 | |
Capacity UInt32 | |
Voltage UInt32 | |
Rate Int32 | |
EstimatedRuntime UInt32 | |
UniqueId UnicodeString |
Event ID 12: Process ProcessPath (process ID:ProcessPid) reset policy scheme from OldSchemeGuid to NewSchemeGuid.
#Description
Process ProcessPath (process ID:ProcessPid) reset policy scheme from OldSchemeGuid to NewSchemeGuid.
Message #
Fields #
| Name | Description |
|---|---|
ProcessPath UnicodeString | |
ProcessPid UInt32 | |
OldSchemeGuid GUID | |
NewSchemeGuid GUID |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-UserModePowerService",
"guid": "CE8DEE0B-D539-4000-B0F8-77BED049C590",
"event_source_name": "",
"event_id": 12,
"version": 0,
"level": 4,
"task": 10,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2022-04-04T13:15:18.534497+00:00",
"event_record_id": 1678,
"correlation": {},
"execution": {
"process_id": 724,
"thread_id": 2708
},
"channel": "System",
"computer": "WIN-TKC15D7KHUR",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"ProcessPath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\\TiWorker.exe",
"ProcessPid": 1292,
"OldSchemeGuid": "381B4222-F694-41F0-9685-FF5BB260DF2E",
"NewSchemeGuid": "381B4222-F694-41F0-9685-FF5BB260DF2E"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 14: PowerMeterMetaData
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
SamplingPeriod UInt64 | |
MeterNameLength UInt32 | |
MeterName UnicodeString | |
MeteredHardwareCount UInt32 | |
MeteredHardwareName UnicodeString |
Event ID 15: RundownOverrideConfiguration
#Fields #
| Name | Description |
|---|---|
Flags UInt32 | |
ProcessorVendor UInt32 | |
ProcessorType UInt32 |
Event ID 16: RundownOverridePowerSetting_V1
#Fields #
| Name | Description |
|---|---|
SchemeGuid GUID | |
SubgroupGuid GUID | |
SettingGuid GUID | |
Flags UInt32 | |
DataType UInt32 | |
DataSize UInt32 | |
Data Binary | |
ProfileGuid GUID |
Event ID 17: RundownPowerProfileSetting_V1
#Fields #
| Name | Description |
|---|---|
ProfileGuid GUID | |
SubgroupGuid GUID | |
SettingGuid GUID | |
SchemePersonalityGuid GUID | |
Flags UInt32 | |
ValueIndex UInt32 | |
Type UInt32 | |
DataSize UInt32 | |
Data Binary | |
Altitude UInt32 |
Event ID 18: EnergyMeterData
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
AbsoluteEnergy UInt64 | |
AbsoluteTime UInt64 |
Event ID 19: EnergyMeterMetaData
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
SamplingPeriod UInt64 | |
ChannelNameLength UInt32 | |
ChannelName UnicodeString |
Event ID 22: Reapply power settings upon completion of the provisioning engine's turn Turn.
#Description
Reapply power settings upon completion of the provisioning engine's turn Turn.
Message #
Fields #
| Name | Description |
|---|---|
Turn UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-UserModePowerService",
"guid": "CE8DEE0B-D539-4000-B0F8-77BED049C590",
"event_source_name": "",
"event_id": 22,
"version": 0,
"level": 4,
"task": 18,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:32:24.462056+00:00",
"event_record_id": 160,
"correlation": {},
"execution": {
"process_id": 988,
"thread_id": 540
},
"channel": "System",
"computer": "USERUSE-98J6DVC",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Turn": 1
},
"message": ""
}
Event ID 25: RundownSessionUser
#Fields #
| Name | Description |
|---|---|
UserContextToken UInt64 | |
SessionId UInt32 | |
UserSid SID |
Event ID 26: SessionUserChange
#Fields #
| Name | Description |
|---|---|
Event UInt32 | |
UserContextToken UInt64 | |
SessionId UInt32 | |
UserSid SID |
Event ID 27: RundownSmartUserPresenceState
#Fields #
| Name | Description |
|---|---|
Supported Boolean | |
GlobalUserPresent Boolean | |
UserPredictionMode UInt32 | |
MinConfidence UInt8 | |
SuspendCount UInt32 | |
LastUserAwayEndSystemTime UInt64 |
Event ID 28: RundownSmartUserPresenceIntevals_V1
#Fields #
| Name | Description |
|---|---|
UserSid SID | |
IntervalCount UInt32 | |
AwayIntervals UInt8 | |
Flags UInt32 |
Event ID 29: SmartUserPresenceIntervalsSet_V1
#Fields #
| Name | Description |
|---|---|
UserSid SID | |
IntervalCount UInt32 | |
AwayIntervals UInt8 | |
Flags UInt32 |
Event ID 32: SmartUserPresenceSuspendResume
#Fields #
| Name | Description |
|---|---|
Suspend Boolean | |
SuspendCount UInt32 | |
GlobalUserPresent Boolean | |
UserPredictionMode UInt32 |
Event ID 38: SleepStudySleepSessionReloggingStop
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Id UInt32 | |
ErrorCode UInt32 |
Event ID 40: SleepStudySleepSessionReloggingPassStop
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Id UInt32 | |
ErrorCode UInt32 |
Event ID 41: SleepStudySleepSessionReloggingMissingStart
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Id UInt32 |
Event ID 42: SleepStudySleepSessionReloggingMissingStop
#Fields #
| Name | Description |
|---|---|
Type UInt32 | |
Id UInt32 | |
ErrorCode UInt32 |
Event ID 43: BrightnessAndTransitionTimes
#Fields #
| Name | Description |
|---|---|
EffectiveBrightnessPercentage UInt32 | |
EffectiveBrightnessMillinits UInt32 | |
NewBrightnessTransitionTime UInt32 | |
DimmingTransitionTime UInt32 | |
DimmedBrightnessPercentage UInt32 | |
DimmedBrightnessMillinits UInt32 | |
NewDimmedTransitionTime UInt32 | |
UnDimmingTransitionTime UInt32 |
Event ID 44: AdaptiveStandbyBatteryReserveAction_V3
#Fields #
| Name | Description |
|---|---|
TimeInStandby UInt32 | |
GracePeriod UInt32 | |
RemainingBatteryPercentage UInt32 | |
RemainingBatteryTime UInt32 | |
ReserveBatteryTime UInt32 | |
ExecuteAction Boolean | |
RejectReason UInt32 | |
DataSources UInt32 | |
CsSessionId UInt32 |
Event ID 45: AdaptiveStandbyStandbyBudgetAction_V3
#Fields #
| Name | Description |
|---|---|
TimeInStandby UInt32 | |
GracePeriod UInt32 | |
RemainingBatteryPercentage UInt32 | |
StandbyBatteryDrainPercentage UInt32 | |
BatteryDrainPercentageThreshold UInt32 | |
ExecuteAction Boolean | |
RejectReason UInt32 | |
DataSources UInt32 | |
CsSessionId UInt32 |
Event ID 46: AdaptiveStandbyStandbyBudgetReset
#Fields #
| Name | Description |
|---|---|
ActualTimeRange UInt32 | |
RemainingBatteryPercentage UInt32 |
Event ID 49: RundownOverlaySchemePowerSetting_V1
#Fields #
| Name | Description |
|---|---|
OverlaySchemeGuid GUID | |
SubgroupGuid GUID | |
SettingGuid GUID | |
Flags UInt32 | |
ValueIndex UInt32 | |
Type UInt32 | |
DataSize UInt32 | |
Data Binary | |
Altitude UInt32 |
Event ID 50: RundownActualOverlayPowerScheme_V1
#Fields #
| Name | Description |
|---|---|
SchemeGuid GUID | |
AcOverlay Boolean |
Event ID 51: Process ProcessPath (process ID:ProcessPid) reset overlay policy scheme from OldSchemeGuid to NewSchemeGuid.
#Event ID 55: OverrideDllSettingsUpdate
#Event ID 56: OverrideDllPowerSetting
#Fields #
| Name | Description |
|---|---|
SchemeGuid GUID | |
SubgroupGuid GUID | |
SettingGuid GUID | |
Flags UInt32 | |
DataType UInt32 | |
DataSize UInt32 | |
Data Binary | |
ProfileGuid GUID |
Event ID 59: PowerSettingUpdate
#Fields #
| Name | Description |
|---|---|
IsSystem UInt8 | |
IsAc UInt8 | |
ProcessPid UInt32 | |
ProcessName UnicodeString | |
DataSize UInt32 | |
Data Binary |
Event ID 60: AdaptiveStandbyAusterityBudgetAction
#Fields #
| Name | Description |
|---|---|
TimeInStandby UInt32 | |
GracePeriod UInt32 | |
RemainingBatteryPercentage UInt32 | |
StandbyBatteryDrainPercentage UInt32 | |
BatteryDrainPercentageThreshold UInt32 | |
ExecuteAction Boolean | |
RejectReason UInt32 | |
DataSources UInt32 | |
CsSessionId UInt32 |
Event ID 61: SmartSuspendPrediction
#Fields #
| Name | Description |
|---|---|
TargetState UInt32 | |
SearchIndex UInt32 | |
SearchStartTime FILETIME | |
SearchEndTime FILETIME | |
EntryTime FILETIME | |
ExitTime FILETIME | |
Error UInt32 | |
Flags UInt32 | |
ProbabilityThreshold UInt8 | |
ConfidenceThreshold UInt8 | |
ProbabilityActual UInt8 | |
ConfidenceActual UInt8 |
Event ID 62: SmartSuspendRundown
#Fields #
| Name | Description |
|---|---|
State UInt32 | |
DisableReason UInt32 | |
ThresholdCount UInt32 | |
Thresholds UInt8 |
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID ce8dee0b-d539-4000-b0f8-77bed049c590
Defined in umpo.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02