Microsoft-Windows-WABSyncProvider

Event	Title	Channel	Sample	Rule
3	InitializePropertyMapStart	Analytic	N	N
4	InitializePropertyMapStop	Analytic	N	N
5	GetIdParameterStart	Analytic	N	N
6	GetIdParameterStop	Analytic	N	N
7	BeginSessionStart	Analytic	N	N
8	BeginSessionStop	Analytic	N	N
9	EndSessionStart	Analytic	N	N
10	EndSessionStop	Analytic	N	N
11	GetMetadataStoreStart	Analytic	N	N
12	GetMetadataStoreStop	Analytic	N	N
13	GetMetadataSchemaStart	Analytic	N	N
14	GetMetadataSchemaStop	Analytic	N	N
15	EnumerateItemsStart	Analytic	N	N
16	EnumerateItemsStop	Analytic	N	N
17	LoadChangeDataStart	Analytic	N	N
18	LoadChangeDataStop	Analytic	N	N
19	InsertItemStart	Analytic	N	N
20	InsertItemStop	Analytic	N	N
21	UpdateItemStart	Analytic	N	N
22	UpdateItemStop	Analytic	N	N
23	DeleteItemStart	Analytic	N	N
24	DeleteItemStop	Analytic	N	N

Event ID 3: InitializePropertyMapStart

Channel: Analytic
Task: InitializePropertyMap
Opcode: Start

Event ID 4: InitializePropertyMapStop

Channel: Analytic
Task: InitializePropertyMap
Opcode: Stop

Event ID 5: GetIdParameterStart

Channel: Analytic
Task: GetIdParameter
Opcode: Start

Event ID 6: GetIdParameterStop

Channel: Analytic
Task: GetIdParameter
Opcode: Stop

Event ID 7: BeginSessionStart

Channel: Analytic
Task: BeginSession
Opcode: Start

Event ID 8: BeginSessionStop

Channel: Analytic
Task: BeginSession
Opcode: Stop

Event ID 9: EndSessionStart

Channel: Analytic
Task: EndSession
Opcode: Start

Event ID 10: EndSessionStop

Channel: Analytic
Task: EndSession
Opcode: Stop

Event ID 11: GetMetadataStoreStart

Channel: Analytic
Task: GetMetadataStore
Opcode: Start

Event ID 12: GetMetadataStoreStop

Channel: Analytic
Task: GetMetadataStore
Opcode: Stop

Event ID 13: GetMetadataSchemaStart

Channel: Analytic
Task: GetMetadataSchema
Opcode: Start

Event ID 14: GetMetadataSchemaStop

Channel: Analytic
Task: GetMetadataSchema
Opcode: Stop

Event ID 15: EnumerateItemsStart

Channel: Analytic
Task: EnumerateItems
Opcode: Start

Event ID 16: EnumerateItemsStop

Channel: Analytic
Task: EnumerateItems
Opcode: Stop

Event ID 17: LoadChangeDataStart

Channel: Analytic
Task: LoadChangeData
Opcode: Start

Event ID 18: LoadChangeDataStop

Channel: Analytic
Task: LoadChangeData
Opcode: Stop

Event ID 19: InsertItemStart

Channel: Analytic
Task: InsertItem
Opcode: Start

Event ID 20: InsertItemStop

Channel: Analytic
Task: InsertItem
Opcode: Stop

Event ID 21: UpdateItemStart

Channel: Analytic
Task: UpdateItem
Opcode: Start

Event ID 22: UpdateItemStop

Channel: Analytic
Task: UpdateItem
Opcode: Stop

Event ID 23: DeleteItemStart

Channel: Analytic
Task: DeleteItem
Opcode: Start

Event ID 24: DeleteItemStop

Channel: Analytic
Task: DeleteItem
Opcode: Stop

Provenance

ETW provider GUID 17f14a23-551d-40cc-a086-e4194d64ed4c

Defined in WABSyncProvider.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB