Microsoft-Windows-UserModePowerService

Event	Title	Channel	Sample	Rule
1	RundownPlatformRole	Diagnostic	N	N
2	RundownPowerScheme	Diagnostic	N	N
3	RundownAcPowerSetting_V1	Diagnostic	N	N
4	RundownDcPowerSetting_V1	Diagnostic	N	N
5	AdaptiveDimTimeout	Diagnostic	N	N
7	task_0	Diagnostic	N	N
8	RundownBatteryInformation	Diagnostic	N	N
9	RundownBatteryStatus	Diagnostic	N	N
10	RundownBrightnessCapability	Diagnostic	N	N
11	RundownPowerSource	Diagnostic	N	N
12	Process ProcessPath (process ID:ProcessPid) reset policy scheme from …	System	Y	N
13	PowerMeterData	Diagnostic	N	N
14	PowerMeterMetaData	Diagnostic	N	N
15	RundownOverrideConfiguration	Diagnostic	N	N
16	RundownOverridePowerSetting_V1	Diagnostic	N	N
17	RundownPowerProfileSetting_V1	Diagnostic	N	N
18	EnergyMeterData	Diagnostic	N	N
19	EnergyMeterMetaData	Diagnostic	N	N
22	Reapply power settings upon completion of the provisioning engine's turn Turn.	System	Y	N
23	RundownConsoleSession	Diagnostic	N	N
24	ConsoleSessionChange	Diagnostic	N	N
25	RundownSessionUser	Diagnostic	N	N
26	SessionUserChange	Diagnostic	N	N
27	RundownSmartUserPresenceState	Diagnostic	N	N
28	RundownSmartUserPresenceIntevals_V1	Diagnostic	N	N
29	SmartUserPresenceIntervalsSet_V1	Diagnostic	N	N
30	SmartUserPresenceIntevalsClear	Diagnostic	N	N
31	SmartUserPresencePrediction	Diagnostic	N	N
32	SmartUserPresenceSuspendResume	Diagnostic	N	N
33	SmartUserPresenceTimeUpdate	Diagnostic	N	N
34	SleepStudySleepSessionStart	Diagnostic	N	N
35	SleepStudySleepSessionStop	Diagnostic	N	N
36	SleepStudySleepSessionTooShort	Diagnostic	N	N
37	SleepStudySleepSessionReloggingStart	Diagnostic	N	N
38	SleepStudySleepSessionReloggingStop	Diagnostic	N	N
39	SleepStudySleepSessionReloggingPassStart	Diagnostic	N	N
40	SleepStudySleepSessionReloggingPassStop	Diagnostic	N	N
41	SleepStudySleepSessionReloggingMissingStart	Diagnostic	N	N
42	SleepStudySleepSessionReloggingMissingStop	Diagnostic	N	N
43	BrightnessAndTransitionTimes	Diagnostic	N	N
44	AdaptiveStandbyBatteryReserveAction_V3	Diagnostic	N	N
45	AdaptiveStandbyStandbyBudgetAction_V3	Diagnostic	N	N
46	AdaptiveStandbyStandbyBudgetReset	Diagnostic	N	N
47	AdaptiveStandbySrumFailure	Diagnostic	N	N
48	GpuAdapterCount_V1	Diagnostic	N	N
49	RundownOverlaySchemePowerSetting_V1	Diagnostic	N	N
50	RundownActualOverlayPowerScheme_V1	Diagnostic	N	N
51	Process ProcessPath (process ID:ProcessPid) reset overlay policy scheme from …	System	N	N
52	RundownEffectiveOverlayPowerScheme	Diagnostic	N	N
53	RundownOverlaySuspendReason	Diagnostic	N	N
54	OverlaySuspendResume	Diagnostic	N	N
55	OverrideDllSettingsUpdate	Diagnostic	N	N
56	OverrideDllPowerSetting	Diagnostic	N	N
57	AdaptiveStandbyStart	Diagnostic	N	N
58	AdaptiveStandbyStop	Diagnostic	N	N
59	PowerSettingUpdate	Diagnostic	N	N
60	AdaptiveStandbyAusterityBudgetAction	Diagnostic	N	N
61	SmartSuspendPrediction	Diagnostic	N	N
62	SmartSuspendRundown	Diagnostic	N	N

Event ID 1: RundownPlatformRole

Channel: Diagnostic
Task: RundownPlatformRole

Fields #

Name	Description
`PlatformRole` UInt32

Event ID 2: RundownPowerScheme

Channel: Diagnostic
Task: RundownPowerScheme

Fields #

Name	Description
`SchemeGuid` GUID

Event ID 3: RundownAcPowerSetting_V1

Channel: Diagnostic
Task: RundownAcPowerSetting

Fields #

Name	Description
`SubgroupGuid` GUID
`SettingGuid` GUID
`ValueIndex` UInt32
`Type` UInt32
`DataSize` UInt32
`Data` Binary
`Altitude` UInt32

Event ID 4: RundownDcPowerSetting_V1

Channel: Diagnostic
Task: RundownDcPowerSetting

Fields #

Name	Description
`SubgroupGuid` GUID
`SettingGuid` GUID
`ValueIndex` UInt32
`Type` UInt32
`DataSize` UInt32
`Data` Binary
`Altitude` UInt32

Event ID 5: AdaptiveDimTimeout

Channel: Diagnostic
Task: AdaptiveDimTimeout

Fields #

Name	Description
`Timeout` UInt32

Event ID 7: task_0

Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`Name` UnicodeString

Event ID 8: RundownBatteryInformation

Channel: Diagnostic
Task: RundownBatteryInformation

Fields #

Name	Description
`DeviceName` UnicodeString
`ManufacturerName` UnicodeString
`ManufactureDay` UInt8
`ManufactureMonth` UInt8
`ManufactureYear` UInt16
`SerialNumber` UnicodeString
`Capabilities` UInt32
`Technology` UInt8
`Pad` Binary
`Chemistry` AnsiString
`DesignCapacity` UInt32
`FullChargeCapacity` UInt32
`DefaultAlert1` UInt32
`DefaultAlert2` UInt32
`CriticalBias` UInt32
`CycleCount` UInt32
`GranularityScaleCount` UInt32
`GranularityScale` SID
`UniqueId` UnicodeString

Event ID 9: RundownBatteryStatus

Channel: Diagnostic
Task: RundownBatteryStatus

Fields #

Name	Description
`State` UInt32
`Capacity` UInt32
`Voltage` UInt32
`Rate` Int32
`EstimatedRuntime` UInt32
`UniqueId` UnicodeString

Event ID 10: RundownBrightnessCapability

Channel: Diagnostic
Task: RundownBrightnessCapability

Fields #

Name	Description
`BrightnessCapable` Boolean

Event ID 11: RundownPowerSource

Channel: Diagnostic
Task: RundownPowerSource

Fields #

Name	Description
`AcOnline` Boolean

Event ID 12: Process ProcessPath (process ID:ProcessPid) reset policy scheme from OldSchemeGuid to NewSchemeGuid.

Channel: System
Level: Informational
Task: PowerSchemeChanged

Message #

Process %1 (process ID:%2) reset policy scheme from %3 to %4

Fields #

Name	Description
`ProcessPath` UnicodeString
`ProcessPid` UInt32
`OldSchemeGuid` GUID
`NewSchemeGuid` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserModePowerService",
    "guid": "CE8DEE0B-D539-4000-B0F8-77BED049C590",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2022-04-04T13:15:18.534497+00:00",
    "event_record_id": 1678,
    "correlation": {},
    "execution": {
      "process_id": 724,
      "thread_id": 2708
    },
    "channel": "System",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ProcessPath": "C:\\Windows\\WinSxS\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.20348.557_none_f1edaeb8515fa10d\\TiWorker.exe",
    "ProcessPid": 1292,
    "OldSchemeGuid": "381B4222-F694-41F0-9685-FF5BB260DF2E",
    "NewSchemeGuid": "381B4222-F694-41F0-9685-FF5BB260DF2E"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 13: PowerMeterData

Channel: Diagnostic
Task: PowerMeterData

Fields #

Name	Description
`MeterId` Pointer
`value` UInt32

Event ID 14: PowerMeterMetaData

Channel: Diagnostic
Task: PowerMeterMetaData

Fields #

Name	Description
`MeterId` Pointer
`SamplingPeriod` UInt64
`MeterNameLength` UInt32
`MeterName` UnicodeString
`MeteredHardwareCount` UInt32
`MeteredHardwareName` UnicodeString

Event ID 15: RundownOverrideConfiguration

Channel: Diagnostic
Task: RundownOverrideConfiguration

Fields #

Name	Description
`Flags` UInt32
`ProcessorVendor` UInt32
`ProcessorType` UInt32

Event ID 16: RundownOverridePowerSetting_V1

Channel: Diagnostic
Task: RundownOverridePowerSetting

Fields #

Name	Description
`SchemeGuid` GUID
`SubgroupGuid` GUID
`SettingGuid` GUID
`Flags` UInt32
`DataType` UInt32
`DataSize` UInt32
`Data` Binary
`ProfileGuid` GUID

Event ID 17: RundownPowerProfileSetting_V1

Channel: Diagnostic
Task: RundownPowerProfileSetting

Fields #

Name	Description
`ProfileGuid` GUID
`SubgroupGuid` GUID
`SettingGuid` GUID
`SchemePersonalityGuid` GUID
`Flags` UInt32
`ValueIndex` UInt32
`Type` UInt32
`DataSize` UInt32
`Data` Binary
`Altitude` UInt32

Event ID 18: EnergyMeterData

Channel: Diagnostic
Task: EnergyMeterData

Fields #

Name	Description
`MeterId` Pointer
`AbsoluteEnergy` UInt64
`AbsoluteTime` UInt64

Event ID 19: EnergyMeterMetaData

Channel: Diagnostic
Task: EnergyMeterMetaData

Fields #

Name	Description
`MeterId` Pointer
`SamplingPeriod` UInt64
`ChannelNameLength` UInt32
`ChannelName` UnicodeString

Event ID 22: Reapply power settings upon completion of the provisioning engine's turn Turn.

Channel: System
Level: Informational
Task: ProvEngineTurnApply

Message #

Reapply power settings upon completion of the provisioning engine's turn %1

Fields #

Name	Description
`Turn` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserModePowerService",
    "guid": "CE8DEE0B-D539-4000-B0F8-77BED049C590",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 18,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2025-12-31T19:32:24.462056+00:00",
    "event_record_id": 160,
    "correlation": {},
    "execution": {
      "process_id": 988,
      "thread_id": 540
    },
    "channel": "System",
    "computer": "USERUSE-98J6DVC",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Turn": 1
  },
  "message": ""
}

Event ID 23: RundownConsoleSession

Channel: Diagnostic
Task: RundownConsoleSession

Fields #

Name	Description
`SessionId` UInt32

Event ID 24: ConsoleSessionChange

Channel: Diagnostic
Task: ConsoleSessionChange

Fields #

Name	Description
`Event` UInt32
`SessionId` UInt32

Event ID 25: RundownSessionUser

Channel: Diagnostic
Task: RundownSessionUser

Fields #

Name	Description
`UserContextToken` UInt64
`SessionId` UInt32
`UserSid` SID

Event ID 26: SessionUserChange

Channel: Diagnostic
Task: SessionUserChange

Fields #

Name	Description
`Event` UInt32
`UserContextToken` UInt64
`SessionId` UInt32
`UserSid` SID

Event ID 27: RundownSmartUserPresenceState

Channel: Diagnostic
Task: RundownSmartUserPresenceState

Fields #

Name	Description
`Supported` Boolean
`GlobalUserPresent` Boolean
`UserPredictionMode` UInt32
`MinConfidence` UInt8
`SuspendCount` UInt32
`LastUserAwayEndSystemTime` UInt64

Event ID 28: RundownSmartUserPresenceIntevals_V1

Channel: Diagnostic
Task: RundownSmartUserPresenceIntevals

Fields #

Name	Description
`UserSid` SID
`IntervalCount` UInt32
`AwayIntervals` UInt8
`Flags` UInt32

Event ID 29: SmartUserPresenceIntervalsSet_V1

Channel: Diagnostic
Task: SmartUserPresenceIntervalsSet

Fields #

Name	Description
`UserSid` SID
`IntervalCount` UInt32
`AwayIntervals` UInt8
`Flags` UInt32

Event ID 30: SmartUserPresenceIntevalsClear

Channel: Diagnostic
Task: SmartUserPresenceIntevalsClear

Fields #

Name	Description
`UserSid` SID

Event ID 31: SmartUserPresencePrediction

Channel: Diagnostic
Task: SmartUserPresencePrediction

Fields #

Name	Description
`UserAwayEndSystemTime` UInt64

Event ID 32: SmartUserPresenceSuspendResume

Channel: Diagnostic
Task: SmartUserPresenceSuspendResume

Fields #

Name	Description
`Suspend` Boolean
`SuspendCount` UInt32
`GlobalUserPresent` Boolean
`UserPredictionMode` UInt32

Event ID 33: SmartUserPresenceTimeUpdate

Channel: Diagnostic
Task: SmartUserPresenceTimeUpdate

Fields #

Name	Description
`SystemTimeShift` Int64

Event ID 34: SleepStudySleepSessionStart

Channel: Diagnostic
Task: SleepStudySleepSession
Opcode: Start

Fields #

Name	Description
`Type` UInt32
`Id` UInt32

Event ID 35: SleepStudySleepSessionStop

Channel: Diagnostic
Task: SleepStudySleepSession
Opcode: Stop

Fields #

Name	Description
`Type` UInt32
`Id` UInt32
`ErrorCode` UInt32

Event ID 36: SleepStudySleepSessionTooShort

Channel: Diagnostic
Task: SleepStudySleepSession
Opcode: TooShort

Fields #

Name	Description
`Type` UInt32
`Id` UInt32

Event ID 37: SleepStudySleepSessionReloggingStart

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: Start

Fields #

Name	Description
`Type` UInt32
`Id` UInt32

Event ID 38: SleepStudySleepSessionReloggingStop

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: Stop

Fields #

Name	Description
`Type` UInt32
`Id` UInt32
`ErrorCode` UInt32

Event ID 39: SleepStudySleepSessionReloggingPassStart

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: PassStart

Fields #

Name	Description
`Type` UInt32
`Id` UInt32

Event ID 40: SleepStudySleepSessionReloggingPassStop

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: PassStop

Fields #

Name	Description
`Type` UInt32
`Id` UInt32
`ErrorCode` UInt32

Event ID 41: SleepStudySleepSessionReloggingMissingStart

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: MissingStart

Fields #

Name	Description
`Type` UInt32
`Id` UInt32

Event ID 42: SleepStudySleepSessionReloggingMissingStop

Channel: Diagnostic
Task: SleepStudySleepSessionRelogging
Opcode: MissingStop

Fields #

Name	Description
`Type` UInt32
`Id` UInt32
`ErrorCode` UInt32

Event ID 43: BrightnessAndTransitionTimes

Channel: Diagnostic
Task: BrightnessAndTransitionTimes

Fields #

Name	Description
`EffectiveBrightnessPercentage` UInt32
`EffectiveBrightnessMillinits` UInt32
`NewBrightnessTransitionTime` UInt32
`DimmingTransitionTime` UInt32
`DimmedBrightnessPercentage` UInt32
`DimmedBrightnessMillinits` UInt32
`NewDimmedTransitionTime` UInt32
`UnDimmingTransitionTime` UInt32

Event ID 44: AdaptiveStandbyBatteryReserveAction_V3

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: BatteryReserveAction

Fields #

Name	Description
`TimeInStandby` UInt32
`GracePeriod` UInt32
`RemainingBatteryPercentage` UInt32
`RemainingBatteryTime` UInt32
`ReserveBatteryTime` UInt32
`ExecuteAction` Boolean
`RejectReason` UInt32
`DataSources` UInt32
`CsSessionId` UInt32

Event ID 45: AdaptiveStandbyStandbyBudgetAction_V3

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: StandbyBudgetAction

Fields #

Name	Description
`TimeInStandby` UInt32
`GracePeriod` UInt32
`RemainingBatteryPercentage` UInt32
`StandbyBatteryDrainPercentage` UInt32
`BatteryDrainPercentageThreshold` UInt32
`ExecuteAction` Boolean
`RejectReason` UInt32
`DataSources` UInt32
`CsSessionId` UInt32

Event ID 46: AdaptiveStandbyStandbyBudgetReset

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: StandbyBudgetReset

Fields #

Name	Description
`ActualTimeRange` UInt32
`RemainingBatteryPercentage` UInt32

Event ID 47: AdaptiveStandbySrumFailure

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: SrumFailure

Fields #

Name	Description
`Action` UInt32
`Error` UInt32

Event ID 48: GpuAdapterCount_V1

Channel: Diagnostic
Task: GpuAdapterCount

Fields #

Name	Description
`Id` UInt8
`GpuCount` UInt8
`IdV2` UInt64

Event ID 49: RundownOverlaySchemePowerSetting_V1

Channel: Diagnostic
Task: RundownOverlaySchemePowerSetting

Fields #

Name	Description
`OverlaySchemeGuid` GUID
`SubgroupGuid` GUID
`SettingGuid` GUID
`Flags` UInt32
`ValueIndex` UInt32
`Type` UInt32
`DataSize` UInt32
`Data` Binary
`Altitude` UInt32

Event ID 50: RundownActualOverlayPowerScheme_V1

Channel: Diagnostic
Task: RundownActualOverlayPowerScheme

Fields #

Name	Description
`SchemeGuid` GUID
`AcOverlay` Boolean

Event ID 51: Process ProcessPath (process ID:ProcessPid) reset overlay policy scheme from OldSchemeGuid to NewSchemeGuid.

Channel: System
Task: OverlayPowerSchemeChanged

Message #

Process %1 (process ID:%2) reset overlay policy scheme from %3 to %4

Fields #

Name	Description
`ProcessPath` UnicodeString
`ProcessPid` UInt32
`OldSchemeGuid` GUID
`NewSchemeGuid` GUID

Event ID 52: RundownEffectiveOverlayPowerScheme

Channel: Diagnostic
Task: RundownEffectiveOverlayPowerScheme

Fields #

Name	Description
`SchemeGuid` GUID

Event ID 53: RundownOverlaySuspendReason

Channel: Diagnostic
Task: RundownOverlaySuspendReason

Fields #

Name	Description
`Reason` UInt32

Event ID 54: OverlaySuspendResume

Channel: Diagnostic
Task: OverlaySuspendResume

Fields #

Name	Description
`Reason` UInt32
`Suspend` Boolean

Event ID 55: OverrideDllSettingsUpdate

Channel: Diagnostic
Task: OverrideDllSettingsUpdate

Event ID 56: OverrideDllPowerSetting

Channel: Diagnostic
Task: OverrideDllPowerSetting

Fields #

Name	Description
`SchemeGuid` GUID
`SubgroupGuid` GUID
`SettingGuid` GUID
`Flags` UInt32
`DataType` UInt32
`DataSize` UInt32
`Data` Binary
`ProfileGuid` GUID

Event ID 57: AdaptiveStandbyStart

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: Start

Fields #

Name	Description
`Reason` UInt32

Event ID 58: AdaptiveStandbyStop

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: Stop

Fields #

Name	Description
`Reason` UInt32

Event ID 59: PowerSettingUpdate

Channel: Diagnostic
Task: PowerSettingUpdate

Fields #

Name	Description
`IsSystem` UInt8
`IsAc` UInt8
`ProcessPid` UInt32
`ProcessName` UnicodeString
`DataSize` UInt32
`Data` Binary

Event ID 60: AdaptiveStandbyAusterityBudgetAction

Channel: Diagnostic
Task: AdaptiveStandby
Opcode: AusterityBudgetAction

Fields #

Name	Description
`TimeInStandby` UInt32
`GracePeriod` UInt32
`RemainingBatteryPercentage` UInt32
`StandbyBatteryDrainPercentage` UInt32
`BatteryDrainPercentageThreshold` UInt32
`ExecuteAction` Boolean
`RejectReason` UInt32
`DataSources` UInt32
`CsSessionId` UInt32

Event ID 61: SmartSuspendPrediction

Channel: Diagnostic
Task: SmartSuspendPrediction

Fields #

Name	Description
`TargetState` UInt32
`SearchIndex` UInt32
`SearchStartTime` FILETIME
`SearchEndTime` FILETIME
`EntryTime` FILETIME
`ExitTime` FILETIME
`Error` UInt32
`Flags` UInt32
`ProbabilityThreshold` UInt8
`ConfidenceThreshold` UInt8
`ProbabilityActual` UInt8
`ConfidenceActual` UInt8

Event ID 62: SmartSuspendRundown

Channel: Diagnostic
Task: SmartSuspendRundown

Fields #

Name	Description
`State` UInt32
`DisableReason` UInt32
`ThresholdCount` UInt32
`Thresholds` UInt8

Provenance

ETW provider GUID ce8dee0b-d539-4000-b0f8-77bed049c590

Defined in umpo.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB