Microsoft-Windows-Win32k

Event	Title	Channel	Sample	Rule
1	WindowUpdate	Tracing	Y	N
2	FocusChange	Tracing	Y	N
3	UIPIMsgError	UIPI	N	N
4	UIPIHookError	UIPI	N	N
5	UIPIEventHookError	UIPI	N	N
6	UIPIHandleValError	UIPI	N	N
7	UIPIInputError	UIPI	N	N
8	UIPIClipboardError	UIPI	N	N
9	UIPISystemError	UIPI	N	N
10	PowerDisplayChange	Power	N	N
11	IdleActionExpiration	Power	N	N
12	DisplayReqChange	Power	N	N
13	DisplayTimeoutReset	Power	N	N
14	LockAcquireExclusive	Concurrency	N	N
15	LockAcquireShared	Concurrency	N	N
16	LockAcquireSharedStarveExclusive	Concurrency	N	N
17	LockRelease	Concurrency	N	N
18	SwapChainBind	Tracing	N	N
19	SwapChainUnBind	Tracing	N	N
20	IdleStatusTracing	Power	Y	N
21	SwapChainSetStats	Tracing	N	N
22	ScreenSaverProcess	Power	N	N
23	WinlogonSleepStart	Power	N	N
24	WinlogonSleepEnd	Power	N	N
25	UserActive	Tracing	N	N
26	FocusedProcessChange	Tracing	Y	N
27	DwmSpriteCreate	Tracing	Y	N
28	DwmSpriteDestroy	Tracing	Y	N
29	LogicalSurfCreate	Tracing	Y	N
30	LogicalSurfDestroy	Tracing	Y	N
31	LogicalSurfPhysSurfBind	Tracing	Y	N
32	LogicalSurfPhysSurfUnbind	Tracing	Y	N
33	GdiSysMemToken	Tracing	N	N
35	WaitCursor	Tracing	N	N
36	ThreadInfoRundown	Tracing	N	N
37	InputProcessDelay	Tracing	N	N
38	MessageCheckDelay	Tracing	Y	N
39	RenderingNewRendering	Render	N	N
40	RenderingOldToNewRendering	Render	Y	N
41	Rendering	Render	Y	N
42	RenderingAppRenderingTightUpdate	Render	Y	N
43	RenderingValidateWindow	Render	N	N
44	RenderingInvalidateWindow	Render	N	N
45	ThreadExit	Tracing	Y	N
46	BindLogicalSurface	Tracing	N	N
47	UnBindLogicalSurface	Tracing	N	N
48	BindLogicalSurfaceRH	Tracing	N	N
49	DwmSpriteLogicalSurfBind	Tracing	Y	N
50	DwmSpriteLogicalSurfUnBind	Tracing	Y	N
51	LogicalSurfEnableDirtyNotification	Tracing	Y	N
52	PhysicalSurfCreate	Tracing	Y	N
53	ModifyRgn	Tracing	Y	N
54	SwapChainGetStats	Tracing	N	N
55	SwapChainBindingOpen	Tracing	N	N
56	SwapChainBindingRelease	Tracing	N	N
57	SwapChainBindingStatus	Tracing	N	N
58	DesktopResolutionFailure	Tracing	N	N
59	QueuePostMessage	Messages	Y	N
60	SendMessageStart	Messages	Y	N
61	RetrievePostMessage	Messages	Y	N
62	RetrieveSendMessageStart	Messages	Y	N
63	RetrieveInputMessage	Messages	Y	N
64	RetrievePseudoMessage	Messages	Y	N
65	WakePump	Messages	Y	N
66	InputQueueLocked	Messages	N	N
67	InputQueueLocked67	Messages	N	N
68	UserCallbackStart	Messages	N	N
69	UserCallbackStop	Messages	N	N
70	SendMessageStop	Messages	Y	N
71	SendMessageTimeOutToBlocking	Messages	N	N
72	InputDeviceReadStart	Messages	N	N
73	InputDeviceReadStop	Messages	N	N
74	MessageInjectionPostGestureInputMessage	Messages	N	N
75	MessageInjectionPostGestureMessage	Messages	N	N
76	AppMessagePump	Messages	Y	N
77	AppMessagePump	Messages	Y	N
78	WakeRIT	Messages	Y	N
79	PointerMotionStart	Messages	N	N
80	PointerMotionStop	Messages	N	N
81	InjectMouseStart	Messages	N	N
82	InjectMouseStop	Messages	N	N
83	RetrieveSendMessageStop	Messages	Y	N
84	GUIProcess	Messages	Y	N
85	GUIProcess	Messages	Y	N
86	GUIThread	Messages	Y	N
87	GUIThread	Messages	Y	N
88	QueueInputMessage	Messages	Y	N
89	TranslateMessageStart	Messages	N	N
91	TranslateMessageStop	Messages	N	N
92	DispatchMessage	Messages	Y	N
93	DispatchMessage	Messages	Y	N
94	TouchTargetingSpeedHitTestStart	Messages	N	N
95	TouchTargetingSpeedHitTestStop	Messages	N	N
96	TouchTargetingWindowHitTestStart	Messages	N	N
97	TouchTargetingWindowHitTestStop	Messages	N	N
98	TouchTargetingPointerTargetStart	Messages	N	N
99	TouchTargetingPointerTargetStop	Messages	N	N
100	MessageInjectionInjectTouchEvent	Messages	N	N
102	task_0	Tracing	N	N
103	task_0103	Tracing	N	N
104	ContactVisualizationStart	Tracing	N	N
105	ContactVisualizationStop	Tracing	N	N
106	TouchTargetingOffset	Messages	N	N
107	TouchTargetingPointerEvent	Messages	N	N
108	TouchTargetingPointerEvent108	Messages	N	N
109	PointerDeviceReadStart	Messages	N	N
110	PointerDeviceReadStop	Messages	N	N
111	PointerDeviceMessageStart	Messages	N	N
112	PointerDeviceMessageStop	Messages	N	N
113	PointerDeviceMessageStart113	Messages	N	N
114	PointerDeviceMessageStop114	Messages	N	N
115	PointerDeviceTransformationStart	Messages	N	N
116	PointerDeviceTransformationStop	Messages	N	N
117	RenderingTranslationUpdate	Render	N	N
118	TranslationUpdateOffset	Render	N	N
119	RenderingTranslationUpdateRectClip	Render	N	N
120	RenderingUpdateDxAccumFromGDI	Render	N	N
121	RenderingUpdateDxAccumFromDX	Render	N	N
122	RenderingGetDxAccum	Render	N	N
123	ModifyDxAccumRgn	Tracing	N	N
124	LogicalSurfRemovedTranslationFromDirty	Tracing	N	N
125	PointerDeviceDiscoveryStart	Messages	N	N
126	PointerDeviceDiscoveryStop	Messages	N	N
127	PointerDeviceMessageStart127	Messages	N	N
128	PointerDeviceMessageStop128	Messages	N	N
129	TouchInjectionEventStart	Messages	N	N
130	TouchInjectionEventStop	Messages	N	N
131	PointerFrameCreationStart	Messages	N	N
132	PointerFrameCreationStop	Messages	N	N
133	PointerFrameBuildPartialStart	Messages	N	N
134	PointerFrameBuildPartialStop	Messages	N	N
135	PointerFrameCommitStart	Messages	N	N
136	PointerFrameCommitStop	Messages	N	N
137	PointerFrameCoalesceStart	Messages	N	N
138	PointerFrameCoalesceStop	Messages	N	N
139	PointerFrameMessageGenerationStart	Messages	N	N
140	PointerFrameMessageGenerationStop	Messages	N	N
141	PointerMessageRetrieveStart	Messages	N	N
142	PointerMessageRetrieveStop	Messages	N	N
143	PointerUpdateMessageRetrieveStart	Messages	N	N
144	PointerUpdateMessageRetrieveStop	Messages	N	N
145	PointerSetTargetWindowsStart	Messages	N	N
146	PointerSetTargetWindowsStop	Messages	N	N
147	PointerUpdateSetTargetWindowsStart	Messages	N	N
148	PointerUpdateSetTargetWindowsStop	Messages	N	N
149	InputQueueNoRemoveLockerStop	Messages	N	N
150	InputQueueLockedPeekRecursionStop	Messages	N	N
151	DCompCommitBatch	Tracing	Y	N
152	DelegateInputUserCallbackStart	Messages	N	N
153	DelegateInputUserCallbackStop	Messages	N	N
154	DelegatedInputWorkerStart	Messages	N	N
155	DelegatedInputWorkerStop	Messages	N	N
156	PointerDeviceMessage	Messages	N	N
157	PointerMessageGenerationStart	Messages	N	N
158	PointerMessageGenerationStop	Messages	N	N
159	PointerFrameCoalesce	Messages	N	N
160	SmoothRotationStart	Tracing	N	N
161	SmoothRotationStop	Tracing	N	N
162	DCompGetBatch	Tracing	Y	N
163	ExclusiveUserCrit	Contention	N	N
164	ExclusiveUserCrit	Contention	Y	N
165	SharedUserCrit	Contention	N	N
166	SharedUserCrit	Contention	Y	N
167	ReleaseUserCrit	Contention	Y	N
168	SleepInputIdle	Messages	Y	N
169	WakeInputIdle	Messages	Y	N
170	EdgyDetectionStart	Tracing	N	N
171	EdgyDetectionStop	Tracing	N	N
172	ImmersiveInputProcessDelay	Tracing	N	N
173	ImmersiveMessageCheckDelay	Tracing	N	N
174	THQAEventStart	Messages	N	N
175	THQAEventStop	Messages	N	N
176	PointerPredictionStart	Messages	N	N
177	PointerPredictionStop	Messages	N	N
178	MoveRgn	Tracing	N	N
179	DirtyRgn	Tracing	N	N
180	LogicalSurfRemovedTranslationFromMove	Tracing	N	N
181	DirtyRectUpdate	Tracing	Y	N
182	TranslationUpdateOffsetDWM	Tracing	N	N
183	DwmGetRgn	Tracing	N	N
184	PointerFrameCoalesceStart184	Messages	N	N
185	PointerFrameCoalesceStop185	Messages	N	N
186	PointerFrameCoalesce186	Messages	N	N
187	InternalSetTimerCoalescing	Tracing	Y	N
188	InternalSetTimerNoCoalescing	Tracing	N	N
189	KillTimer	Tracing	Y	N
190	ProcTimerCoalescing	Tracing	Y	N
191	ProcTimerNoCoalescing	Tracing	N	N
192	DrvChangeDisplaySettingsStart	Tracing	N	N
193	DrvChangeDisplaySettingsStop	Tracing	N	N
194	ChangeDisplayModeStart	Tracing	N	N
195	ChangeDisplayModeStop	Tracing	N	N
196	PseudoDevCreationStart	Messages	N	N
197	PseudoDevCreationStop	Messages	N	N
198	TouchHWTimeStamp	Messages	N	N
199	PointerFrameCoalesce199	Messages	N	N
200	PointerFrameCoalesce200	Messages	N	N
201	TokenCompositionSurfaceObject_V1	Tracing	N	N
202	CompositionSurfaceObjectUpdate	Tracing	N	N
203	QueueEventMessage	Messages	Y	N
204	RetrieveQueueEventMessage	Messages	Y	N
205	ForegroundWindowFullScreenStart	Tracing	N	N
206	ForegroundWindowFullScreenStop	Tracing	N	N
207	ChangeDisplayModeBroadcast	Tracing	N	N
213	ContactVisualization	Tracing	N	N
214	ChangeDisplayModeDeferral	Tracing	N	N
215	ConvertibleState	Tracing	N	N
216	DockState	Tracing	N	N
217	TouchPadHWTimeStamp	Tracing	N	N
218	TransformAgeDecay	Tracing	N	N
219	WakeMIT	Messages	Y	N
220	ArmDitMouseFlush	Messages	N	N
221	ProcessQueuedMouseEvents	Messages	Y	N
222	ProcessQueuedMouseEvents	Messages	Y	N
223	DITSpeedHitTestFailedRevalidation	Messages	N	N
224	InputRedirection	Messages	N	N
225	OnInputXformUpdate	Messages	N	N
226	DitWaitForRitDisEngagement	Messages	N	N
227	RitDisEngaged	Messages	N	N
228	DitEngaged	Messages	N	N
229	RitReEngaged	Messages	N	N
230	DitDisEngaged	Messages	N	N
231	DitTerminated	Messages	N	N
232	DitShutdown	Messages	N	N
233	TouchPadAAP	Tracing	N	N
234	MouseInputApc	Messages	N	N
235	MouseInputCoalesced	Messages	Y	N
236	TouchPadTypeDiscovered	Tracing	N	N
237	TouchPadEnabledStatusChangeStart	Tracing	N	N
238	TouchPadEnabledStatusChangeStop	Tracing	N	N
239	PTPReadThresholdsStart	Tracing	N	N
240	PTPReadThresholdsStop	Tracing	N	N
241	TouchPadConfidenceCleared	Tracing	N	N
242	TouchPadConfidenceUpped	Tracing	N	N
243	PTPElasticDragModeStart	Tracing	N	N
244	PTPElasticDragModeStop	Tracing	N	N
245	LegacyTouchPadDetectionStart	Tracing	N	N
246	LegacyTouchPadDetectionStop	Tracing	N	N
247	LegacyTouchPadDetection	Tracing	N	N
248	LegacyTouchPadDetection248	Tracing	N	N
249	TouchPadCurtainState	Tracing	N	N
250	TouchPadCurtainSize	Tracing	N	N
251	TouchpadStopInertia	Tracing	N	N
252	TouchpadStopInertia252	Tracing	N	N
253	TouchpadStopInertia253	Tracing	N	N
254	TrappedAppContainerRender	Tracing	N	N
255	CursorSize	Tracing	N	N
256	DitMmcssWorkStart	Messages	N	N
257	DitMmcssWorkStop	Messages	N	N
258	FocusedProcessChangeGained	Tracing	N	N
259	FocusedProcessChangeLost	Tracing	N	N
260	SourceProcessName attempted loading a font that is restricted by font loading …	Operational	N	N
301	TokenStateChanged_V1	Tracing	N	N
400	DCompDeferBatch	Tracing	Y	N
401	TouchPadHIDProcessingStart	Messages	N	N
402	TouchPadHIDProcessingStop	Messages	N	N
403	TouchPadWMPointerProcessingStart	Messages	N	N
404	TouchPadWMPointerProcessingStop	Messages	N	N
405	TouchPadGesture	Messages	N	N
406	CopyPointerInputFrameStart	Tracing	N	N
407	CopyPointerInputFrameStop	Tracing	N	N
410	LatencyModeProcessingStart	Messages	N	N
411	LatencyModeProcessingStop	Messages	N	N
412	DCompBeginFrame	Tracing	Y	N
413	TokenIndependentFlipSkipComplete	Tracing	N	N
414	DwmManipulationFrameStart	Tracing	N	N
415	DwmManipulationFrameRouted	Tracing	N	N
416	ExclusiveUserCritTelemetry	Tracing	Y	N
417	SharedUserCritTelemetry	Tracing	Y	N
418	PowerOnGdi	Power	N	N
419	PowerOnGdi	Power	N	N
420	UserResetDisplayDevice	Power	N	N
421	UserResetDisplayDevice	Power	N	N
422	PowerOnMonitor	Power	N	N
423	PowerOnMonitor	Power	N	N
424	DwmSyncFlushForceRenderAndWaitForBatch	Power	N	N
425	DwmSyncFlushForceRenderAndWaitForBatch	Power	N	N
426	QueueNullPostMessage	Messages	Y	N
427	The following win32k syscall is blocked by Win32k Syscall Filter: SyscallName.	Operational	N	N
428	The following SystemParametersInfo action was blocked by Win32k Syscall Filter: …	Operational	N	N
429	PowerWatchdog	Power	N	N
430	PowerWatchdog	Power	N	N
431	VideoPortCalloutThread	Power	N	N
432	VideoPortCalloutThread	Power	N	N
433	PowerStateCalloutWorker	Power	N	N
434	PowerStateCalloutWorker	Power	N	N
435	PowerEventCalloutWorker	Power	N	N
436	PowerEventCalloutWorker	Power	N	N
437	Insert	Power	N	N
438	Remove	Power	N	N
439	Canceled	Power	N	N
440	Completed	Power	N	N
441	WaitForVideoPortCalloutReady	Power	N	N
442	WaitForVideoPortCalloutReady	Power	N	N
443	DCompResourceMapping	Tracing	Y	N
444	DCompResourcePropertyUpdate	Tracing	Y	N
445	DCompCommandType	Tracing	Y	N
446	DCompCommandsInBatch	Tracing	Y	N
450	DCompCreateImplicitInteraction	Tracing	N	N
451	DCompVisualSetInteraction	Tracing	N	N
452	UserHandleOperation	Tracing	Y	N
453	UserHandleOperation	Tracing	Y	N
454	UserHandleOperationUpdateHandleOwner	Tracing	Y	N
455	GdiHandleOperation	Tracing	Y	N
456	GdiHandleOperation	Tracing	Y	N
457	GdiHandleOperation	Tracing	Y	N
458	GdiHandleOperation	Tracing	Y	N
459	WriteClipboard	Tracing	N	N
460	WriteClipboard460	Tracing	Y	N
461	DwmVisRgnUpdate	Tracing	Y	N
462	DwmVisRgnDirty	Tracing	Y	N
463	ReadClipboard	Tracing	N	N
500	FlipManagerCompleteTokenStart	Tracing	N	N
501	FlipManagerCompleteTokenStop	Tracing	N	N
502	FlipManagerTokenReleaseToFrameStart	Tracing	N	N
503	FlipManagerTokenReleaseToFrameStop	Tracing	N	N
504	FlipManagerSignalPresentRetired	Tracing	N	N
505	FlipManagerPresentRetiredSignalOverride	Tracing	N	N
506	FlipManagerPresentPosted	Tracing	N	N
507	FlipManagerProducerSetContent	Tracing	N	N
508	FlipManagerBufferAvailable	Tracing	N	N
509	FlipManagerAddBuffer	Tracing	N	N
510	FlipManagerRemoveBuffer	Tracing	N	N
511	FlipManagerContentRebind	Tracing	N	N
512	FlipManagerPresentProcessed	Tracing	N	N
513	FlipManagerPresentDeferred	Tracing	N	N
514	FlipManagerPresentCanceled	Tracing	N	N
515	FlipManagerPresentIFlipSubmitted	Tracing	N	N
516	FlipManagerPresentIFlipCompleted	Tracing	N	N
517	FlipManagerPresentQueueDepth	Tracing	N	N
518	FlipManagerBindingStart	Tracing	N	N
519	FlipManagerBinding	Tracing	N	N
520	FlipManagerBindingStop	Tracing	N	N
521	FlipManagerAddContent	Tracing	N	N
522	FlipManagerContentFlip	Tracing	N	N
523	FlipManagerNoOpPresent	Tracing	N	N
524	FlipManagerCancelPosted	Tracing	N	N
525	FlipManagerContentUnbind	Tracing	N	N
526	FlipManagerCreate	Tracing	N	N
527	FlipManagerDestroy	Tracing	N	N
528	TokenManagerDisableScanoutToken	Tracing	N	N
529	FlipManagerLost	Tracing	N	N
530	FlipManagerCanceledPresentShown	Tracing	N	N
531	FlipManagerUpdateExpectedConsumerPresentId	Tracing	N	N
532	FlipManagerPresentSkipped	Tracing	N	N
533	FlipManagerRemoveContent	Tracing	N	N
534	FlipManagerPresentIFlipPurgePreviousPresents	Tracing	N	N
535	FlipManagerDiscardPresentAfterDestroy	Tracing	N	N
536	FlipManagerWaitForFrameRenderingComplete	Operational	N	N
537	FlipManagerWaitForFrameFlipAway	Operational	N	N
538	FlipManagerFlipAwayFenceCreate	Operational	N	N
539	FlipManagerFlipAwayFenceDestroy	Operational	N	N
1000	task_01000	Operational	Y	N
1001	RegisterRawInputDevices	Operational	Y	N
1002	SetWindowsHookEx	Operational	Y	N
1003	GetAsyncKeyState	Operational	Y	N
2000	task_02000	Operational	Y	N
10002	WindowLayoutChangeStop	Tracing	N	N

Event ID 1: WindowUpdate

Channel: Tracing
Level: Informational
Task: WindowUpdate

Fields #

Name	Description
`Hwnd` Pointer
`Type` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1020,
      "thread_id": 7500
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:09.433Z",
    "version": 0
  },
  "event_data": {
    "Hwnd": "0x66601BA",
    "Type": 1073741878
  },
  "message": ""
}

Event ID 2: FocusChange

Channel: Tracing
Level: Informational
Task: FocusChange

Fields #

Name	Description
`OldThreadId` UInt32
`NewThreadId` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.371Z",
    "version": 0
  },
  "event_data": {
    "NewThreadId": 3520,
    "OldThreadId": 8708
  },
  "message": ""
}

Event ID 3: UIPIMsgError

Channel: UIPI
Task: UIPIMsgError

Fields #

Name	Description
`UIPI_Trace_Header` UInt8
`Message` UInt32
`wParam` UInt64
`lParam` UInt64

Event ID 4: UIPIHookError

Channel: UIPI
Task: UIPIHookError

Fields #

Name	Description
`UIPI_Trace_Header` UInt16
`HookID` Int32
`Flags` Int8
`nCode` Int32
`wParam` UInt64
`lParam` UInt64

Event ID 5: UIPIEventHookError

Channel: UIPI
Task: UIPIEventHookError

Fields #

Name	Description
`UIPI_Trace_Header` UInt32
`WinEvent` UInt32
`WndHandle` UInt64
`ObjectID` UInt32
`ChildID` UInt32
`SenderTID` Int32
`Time` Int32
`Flags` UInt32

Event ID 6: UIPIHandleValError

Channel: UIPI
Task: UIPIHandleValError

Fields #

Name	Description
`UIPI_Trace_Header` UInt8
`Handle` UInt64
`HandleType` UInt32
`Reserved` UInt32

Event ID 7: UIPIInputError

Channel: UIPI
Task: UIPIInputError

Fields #

Name	Description
`UIPI_Trace_Header` UInt8
`InputType` UInt32
`QIL` UInt32
`QLBN` UInt32

Event ID 8: UIPIClipboardError

Channel: UIPI
Task: UIPIClipboardError

Fields #

Name	Description
`UIPI_Trace_Header` UInt8
`ClipFormat` UInt32
`ClipIL` UInt32
`ClipLBN` UInt32

Event ID 9: UIPISystemError

Channel: UIPI
Task: UIPISystemError

Fields #

Name	Description
`UIPI_Trace_Header` AnsiString
`SysErrorType` UInt32

Event ID 10: PowerDisplayChange

Channel: Power
Task: PowerDisplayChange

Fields #

Name	Description
`SessionId` UInt32
`PreviousStateTime` UInt32
`PreviousState` UInt16
`NewState` UInt16
`IsConsoleSession` UInt16

Event ID 11: IdleActionExpiration

Channel: Power
Task: IdleActionExpiration

Fields #

Name	Description
`SessionId` UInt32
`IdleAction` UInt32
`TimeoutValueMs` UInt32
`IdleStartTime` UInt32
`IsConsoleSession` UInt16

Event ID 12: DisplayReqChange

Channel: Power
Task: DisplayReqChange

Fields #

Name	Description
`SessionId` UInt32
`IsConsoleSession` UInt16
`NewCount` UInt32

Event ID 13: DisplayTimeoutReset

Channel: Power
Task: DisplayTimeoutReset

Fields #

Name	Description
`SessionId` UInt32
`IsConsoleSession` UInt16
`DisplayTimeoutValueMs` UInt32

Event ID 14: LockAcquireExclusive

Channel: Concurrency
Task: LockAcquireExclusive

Fields #

Name	Description
`LockId` Pointer
`LockLevel` UInt32
`LockName` UnicodeString

Event ID 15: LockAcquireShared

Channel: Concurrency
Task: LockAcquireShared

Fields #

Name	Description
`LockId` Pointer
`LockName` UnicodeString

Event ID 16: LockAcquireSharedStarveExclusive

Channel: Concurrency
Task: LockAcquireSharedStarveExclusive

Fields #

Name	Description
`LockId` Pointer
`LockName` UnicodeString

Event ID 17: LockRelease

Channel: Concurrency
Task: LockRelease

Fields #

Name	Description
`LockId` Pointer
`LockName` UnicodeString

Event ID 18: SwapChainBind

Channel: Tracing
Task: SwapChainBind

Fields #

Name	Description
`hWnd` UInt64
`hLogicalSurfSwapChainBind` UInt64

Event ID 19: SwapChainUnBind

Channel: Tracing
Task: SwapChainUnBind

Fields #

Name	Description
`hWnd` UInt64
`hLogicalSurfSwapChainBind` UInt64

Event ID 20: IdleStatusTracing

Channel: Power
Also via: realtime ETW trace
Level: Informational
Task: IdleStatusTracing
Opcode: win:Info

Fields #

Name	Description
`SessionId` UInt32
`AccruedIdleTime` UInt32
`DisplayTimeoutValueMs` UInt32
`ScreenSaverTimeoutValueMs` UInt32
`DimTimeoutValueMs` UInt32
`DimBrightnessValue` UInt32
`NormalBrightnessValue` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 20,
    "version": 0,
    "level": 4,
    "task": 21,
    "opcode": 0,
    "keywords": "0x2000000000008000",
    "time_created": "2026-06-02T05:32:25.246+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 1004,
      "thread_id": 1112
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AccruedIdleTime": 24078,
    "DimBrightnessValue": 0,
    "DimTimeoutValueMs": 585000,
    "DisplayTimeoutValueMs": 600000,
    "NormalBrightnessValue": 100,
    "ScreenSaverTimeoutValueMs": 900000,
    "SessionId": 1
  },
  "message": "IdleStatusTracing"
}

Event ID 21: SwapChainSetStats

Channel: Tracing
Task: SwapChainSetStats

Fields #

Name	Description
`hLogicalSurfSwapChainBind` UInt64
`ConfirmReason` UInt32
`LastPresentId` UInt32
`LastFrameCount` UInt32
`SyncFrameCount` UInt32
`LastFrameTime` UInt64

Event ID 22: ScreenSaverProcess

Channel: Power
Task: ScreenSaverProcess

Fields #

Name	Description
`Action` UInt32

Event ID 23: WinlogonSleepStart

Channel: Power
Task: WinlogonSleepStart

Fields #

Name	Description
`Action` UInt32

Event ID 24: WinlogonSleepEnd

Channel: Power
Task: WinlogonSleepEnd

Fields #

Name	Description
`Action` UInt32

Event ID 25: UserActive

Channel: Tracing
Task: UserActive

Fields #

Name	Description
`SessionId` UInt32
`ProcessIdOwningFocus` UInt32
`ProcessCreateTimeOwningFocus` FILETIME

Event ID 26: FocusedProcessChange

Channel: Tracing
Level: Informational
Task: FocusedProcessChange

Fields #

Name	Description
`SessionId` UInt32
`OldProcessId` UInt32
`NewProcessId` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 26,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.371Z",
    "version": 0
  },
  "event_data": {
    "NewProcessId": 6468,
    "OldProcessId": 8716,
    "SessionId": 1
  },
  "message": ""
}

Event ID 27: DwmSpriteCreate

Channel: Tracing
Level: Informational
Task: DwmSpriteCreate

Fields #

Name	Description
`hWnd` UInt64
`hSprite` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 27,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.230Z",
    "version": 0
  },
  "event_data": {
    "hSprite": 386861114,
    "hWnd": 104792896
  },
  "message": ""
}

Event ID 28: DwmSpriteDestroy

Channel: Tracing
Level: Informational
Task: DwmSpriteDestroy

Fields #

Name	Description
`hWnd` UInt64
`hSprite` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 28,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.152Z",
    "version": 0
  },
  "event_data": {
    "hSprite": 386861114,
    "hWnd": 0
  },
  "message": ""
}

Event ID 29: LogicalSurfCreate

Channel: Tracing
Level: Informational
Task: LogicalSurfCreate

Fields #

Name	Description
`hLogicalSurf` UInt64
`Flags` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 29,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.230Z",
    "version": 0
  },
  "event_data": {
    "Flags": 4,
    "hLogicalSurf": 18446744073173862441
  },
  "message": ""
}

Event ID 30: LogicalSurfDestroy

Channel: Tracing
Level: Informational
Task: LogicalSurfDestroy

Fields #

Name	Description
`hLogicalSurf` UInt64
`Flags` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 30,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.152Z",
    "version": 0
  },
  "event_data": {
    "Flags": 0,
    "hLogicalSurf": 18446744073173862441
  },
  "message": ""
}

Event ID 31: LogicalSurfPhysSurfBind

Channel: Tracing
Level: Informational
Task: LogicalSurfPhysSurfBind

Fields #

Name	Description
`hLogicalSurf` UInt64
`hPhysicalSurf` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 31,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12620,
      "thread_id": 6820
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:53.603Z",
    "version": 0
  },
  "event_data": {
    "hLogicalSurf": 1813120990,
    "hPhysicalSurf": 18446744072434812970
  },
  "message": ""
}

Event ID 32: LogicalSurfPhysSurfUnbind

Channel: Tracing
Level: Informational
Task: LogicalSurfPhysSurfUnbind

Fields #

Name	Description
`hLogicalSurf` UInt64
`hPhysicalSurf` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 32,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1768
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:53.969Z",
    "version": 0
  },
  "event_data": {
    "hLogicalSurf": 1813120990,
    "hPhysicalSurf": 18446744072434812970
  },
  "message": ""
}

Event ID 33: GdiSysMemToken

Channel: Tracing
Task: GdiSysMemToken

Fields #

Name	Description
`Pending` UInt32
`dwDirtyFlags` UInt32
`hLogicalSurf` UInt64
`uiCookie` UInt64

Event ID 35: WaitCursor

Channel: Tracing
Task: WaitCursor

Fields #

Name	Description
`CursorThreadId` UInt32
`CursorProcessId` UInt32
`SessionId` UInt32
`CursorType` UInt32
`DisplayTimeMs` UInt32

Event ID 36: ThreadInfoRundown

Channel: Tracing
Task: ThreadInfoRundown

Fields #

Name	Description
`ThreadId` UInt32
`Flags` UInt32
`TimeSinceInputCheckMs` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32

Event ID 37: InputProcessDelay

Channel: Tracing
Task: InputProcessDelay

Fields #

Name	Description
`Flags` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32
`ClassName` UnicodeString
`TopLevelClassName` UnicodeString
`ImagePath` UnicodeString
`MessageId` UInt32
`WParam` UInt64

Event ID 38: MessageCheckDelay

Channel: Tracing
Level: Informational
Task: MessageCheckDelay

Fields #

Name	Description
`Flags` UInt32
`DelayTimeMs` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32
`ClassName` UnicodeString
`TopLevelClassName` UnicodeString
`ImagePath` UnicodeString
`MessageId` UInt32
`WParam` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 38,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9672
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.342Z",
    "version": 0
  },
  "event_data": {
    "ClassName": "MSTaskSwWClass",
    "DelayTimeMs": 297,
    "Flags": 282,
    "ImagePath": "C:\\Windows\\Explorer.EXE",
    "MessageId": 49193,
    "TimeSinceInputRemoveMs": 45709204,
    "TimeSinceOldestInputMs": 188,
    "TopLevelClassName": "Shell_TrayWnd",
    "WParam": 2
  },
  "message": ""
}

Event ID 39: RenderingNewRendering

Channel: Render
Task: Rendering
Opcode: NewRendering

Fields #

Name	Description
`hwndDst` Pointer
`hwndDstSprite` Pointer
`hbmDst` Pointer
`DstLeft` UInt32
`DstTop` UInt32
`DstRight` UInt32
`DstBottom` UInt32
`hwndSrc` Pointer
`hwndSrcSprite` Pointer
`hbmSrc` Pointer
`SrcLeft` UInt32
`SrcTop` UInt32
`SrcRight` UInt32
`SrcBottom` UInt32

Event ID 40: RenderingOldToNewRendering

Channel: Render
Level: Informational
Task: Rendering
Opcode: OldToNewRendering

Fields #

Name	Description
`hwndDst` Pointer
`hwndDstSprite` Pointer
`hbmDst` Pointer
`DstLeft` UInt32
`DstTop` UInt32
`DstRight` UInt32
`DstBottom` UInt32
`hwndSrc` Pointer
`hwndSrcSprite` Pointer
`hbmSrc` Pointer
`SrcLeft` UInt32
`SrcTop` UInt32
`SrcRight` UInt32
`SrcBottom` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Render",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 40,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9672
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:54.013Z",
    "version": 0
  },
  "event_data": {
    "DstBottom": 48,
    "DstLeft": 373,
    "DstRight": 686,
    "DstTop": 0,
    "SrcBottom": 48,
    "SrcLeft": 395,
    "SrcRight": 708,
    "SrcTop": 0,
    "hbmDst": "0x50660",
    "hbmSrc": "0x50660",
    "hwndDst": "0x100A6",
    "hwndDstSprite": "0x100A6",
    "hwndSrc": "0x100A6",
    "hwndSrcSprite": "0x100A6"
  },
  "message": ""
}

Event ID 41: Rendering

Channel: Render
Also via: realtime ETW trace
Level: Informational
Task: Rendering
Opcode: AppRenderingUpdate

Fields #

Name	Description
`hwnd` Pointer
`bitmapCX` UInt32
`bitmapCY` UInt32
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 41,
    "version": 0,
    "level": 4,
    "task": 39,
    "opcode": 12,
    "keywords": "0x0800000000100000",
    "time_created": "2026-06-02T04:02:00.030+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3088
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DirtyBottom": 40,
    "DirtyLeft": 907,
    "DirtyRight": 971,
    "DirtyTop": 0,
    "bitmapCX": 1024,
    "bitmapCY": 40,
    "hwnd": "0x20032"
  },
  "message": "Rendering"
}

Event ID 42: RenderingAppRenderingTightUpdate

Channel: Render
Level: Informational
Task: Rendering
Opcode: AppRenderingTightUpdate

Fields #

Name	Description
`hwnd` Pointer
`bitmapCX` UInt32
`bitmapCY` UInt32
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Render",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 42,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8716,
      "thread_id": 8708
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.118Z",
    "version": 0
  },
  "event_data": {
    "DirtyBottom": 300,
    "DirtyLeft": 0,
    "DirtyRight": 620,
    "DirtyTop": 0,
    "bitmapCX": 620,
    "bitmapCY": 300,
    "hwnd": "0x2008C"
  },
  "message": ""
}

Event ID 43: RenderingValidateWindow

Channel: Render
Task: Rendering
Opcode: ValidateWindow

Fields #

Name	Description
`hwnd` Pointer
`FULL` UInt32
`Left` UInt32
`Top` UInt32
`Right` UInt32
`Bottom` UInt32

Event ID 44: RenderingInvalidateWindow

Channel: Render
Task: Rendering
Opcode: InvalidateWindow

Fields #

Name	Description
`hwnd` Pointer
`FULL` UInt32
`Left` UInt32
`Top` UInt32
`Right` UInt32
`Bottom` UInt32

Event ID 45: ThreadExit

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: ThreadExit
Opcode: win:Info

Fields #

Name	Description
`ThreadId` UInt32
`Flags` UInt32
`TimeSinceInputCheckMs` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 45,
    "version": 0,
    "level": 4,
    "task": 45,
    "opcode": 0,
    "keywords": "0x0000000000200000",
    "time_created": "2026-06-02T04:02:00.577+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4872,
      "thread_id": 10316
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": 64,
    "ThreadId": 10316,
    "TimeSinceInputCheckMs": 0,
    "TimeSinceInputRemoveMs": 72438,
    "TimeSinceOldestInputMs": 0
  },
  "message": "ThreadExit"
}

Event ID 46: BindLogicalSurface

Channel: Tracing
Task: BindLogicalSurface

Fields #

Name	Description
`hWnd` UInt64
`hLogicalSurf` UInt64

Event ID 47: UnBindLogicalSurface

Channel: Tracing
Task: UnBindLogicalSurface

Fields #

Name	Description
`hWnd` UInt64
`hLogicalSurf` UInt64

Event ID 48: BindLogicalSurfaceRH

Channel: Tracing
Task: BindLogicalSurfaceRH

Fields #

Name	Description
`hLogicalSurf` UInt64
`bCreated` UInt64

Event ID 49: DwmSpriteLogicalSurfBind

Channel: Tracing
Level: Informational
Task: DwmSpriteLogicalSurfBind

Fields #

Name	Description
`hDwmSprite` UInt64
`hLogicalSurf` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 49,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.230Z",
    "version": 0
  },
  "event_data": {
    "hDwmSprite": 386861114,
    "hLogicalSurf": 18446744073173862441
  },
  "message": ""
}

Event ID 50: DwmSpriteLogicalSurfUnBind

Channel: Tracing
Level: Informational
Task: DwmSpriteLogicalSurfUnBind

Fields #

Name	Description
`hDwmSprite` UInt64
`hLogicalSurf` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 50,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.152Z",
    "version": 0
  },
  "event_data": {
    "hDwmSprite": 386861114,
    "hLogicalSurf": 18446744073173862441
  },
  "message": ""
}

Event ID 51: LogicalSurfEnableDirtyNotification

Channel: Tracing
Level: Informational
Task: LogicalSurfEnableDirtyNotification

Fields #

Name	Description
`hLogicalSurf` UInt64
`hPhysSurf` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 51,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1768
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:53.626Z",
    "version": 0
  },
  "event_data": {
    "hLogicalSurf": 1813120990,
    "hPhysSurf": 1073743810
  },
  "message": ""
}

Event ID 52: PhysicalSurfCreate

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: PhysicalSurfCreate
Opcode: win:Info

Fields #

Name	Description
`hPhysicalSurf` UInt64
`Type` UInt32
`hDxSharedSurface` UInt64
`Flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 52,
    "version": 0,
    "level": 4,
    "task": 52,
    "opcode": 0,
    "keywords": "0x0000000000001000",
    "time_created": "2026-06-02T05:32:25.758+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": 0,
    "Type": 0,
    "hDxSharedSurface": 0,
    "hPhysicalSurf": 18446744071763722935
  },
  "message": "PhysicalSurfCreate"
}

Event ID 53: ModifyRgn

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: ModifyRgn
Opcode: win:Info

Fields #

Name	Description
`hLogicalSurface` UInt64
`RgnType` UInt32
`rcBounds` Int16
`NumRects` UInt32
`rcData` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 4,
    "task": 53,
    "opcode": 0,
    "keywords": "0x0000000000001000",
    "time_created": "2026-06-02T04:02:00.030+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3088
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NumRects": 1,
    "RgnType": 1,
    "hLogicalSurface": 68290098,
    "rcBounds": "00000000000000000004000028000000",
    "rcData": "00000000000000000004000028000000"
  },
  "message": "ModifyRgn"
}

Event ID 54: SwapChainGetStats

Channel: Tracing
Task: SwapChainGetStats

Fields #

Name	Description
`hLogicalSurfSwapChainBind` UInt64
`ConfirmReason` UInt32
`LastPresentId` UInt32
`LastFrameCount` UInt32
`SyncFrameCount` UInt32
`LastFrameTime` UInt64

Event ID 55: SwapChainBindingOpen

Channel: Tracing
Task: SwapChainBindingOpen

Fields #

Name	Description
`hLogicalSurfSwapChainBinding` UInt64
`luidAdapter` UInt64
`nWidth` UInt32
`nHeight` UInt32
`DxgiColorFormat` UInt32
`hmonAssociation` UInt64
`uiPresentLimitSemaphoreId` UInt64
`cBuffers` UInt32
`BindingInfoHandle` Int64

Event ID 56: SwapChainBindingRelease

Channel: Tracing
Task: SwapChainBindingRelease

Fields #

Name	Description
`hLogicalSurfSwapChainBinding` UInt64
`DesktopCompositorProcess` UInt8
`DesktopCompositorError` UInt8
`DesktopCompositorRef` UInt8
`DesktopCompositorStatus` UInt8
`pEventConfirmed` UInt64

Event ID 57: SwapChainBindingStatus

Channel: Tracing
Task: SwapChainBindingStatus

Fields #

Name	Description
`hLogicalSurfSwapChainBinding` UInt64
`DesktopCompositorStatus` UInt8

Event ID 58: DesktopResolutionFailure

Channel: Tracing
Task: DesktopResolutionFailure

Fields #

Name	Description
`ProcessId` UInt32
`FailureStatus` UInt32

Event ID 59: QueuePostMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: QueuePostMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 59,
    "version": 0,
    "level": 4,
    "task": 59,
    "opcode": 0,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 3488
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "hwnd": "0x30048",
    "inputReadyTimeMs": 35788625,
    "message": 0,
    "pqmsg": "0xFFFFC5238079C710"
  },
  "message": "QueuePostMessage"
}

Event ID 60: SendMessageStart

Channel: Messages
Level: Informational
Task: SendMessage
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`flags` UInt32
`pidReceiver` UInt32
`tidReceiver` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 60,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.371Z",
    "version": 0
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "flags": 0,
    "hwnd": "0x10170",
    "inputReadyTimeMs": 45742031,
    "message": 0,
    "pidReceiver": 8992,
    "pqmsg": "0xFFFFDC84DD76D580",
    "tidReceiver": 9788
  },
  "message": ""
}

Event ID 61: RetrievePostMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: RetrievePostMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 61,
    "version": 0,
    "level": 4,
    "task": 65,
    "opcode": 0,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "flags": 1,
    "hwnd": "0x30048",
    "inputReadyTimeMs": 35788625,
    "message": 0,
    "pqmsg": "0xFFFFC5238079C710"
  },
  "message": "RetrievePostMessage"
}

Event ID 62: RetrieveSendMessageStart

Channel: Messages
Level: Informational
Task: RetrieveSendMessage
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 62,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9788
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.373Z",
    "version": 0
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "hwnd": "0x10170",
    "inputReadyTimeMs": 45742031,
    "message": 0,
    "pqmsg": "0xFFFFDC84DD76D580"
  },
  "message": ""
}

Event ID 63: RetrieveInputMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: RetrieveInputMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 63,
    "version": 0,
    "level": 4,
    "task": 67,
    "opcode": 0,
    "keywords": "0x0400000040400000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1052
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "flags": 1,
    "hwnd": "0x10004",
    "inputReadyTimeMs": 0,
    "message": 0
  },
  "message": "RetrieveInputMessage"
}

Event ID 64: RetrievePseudoMessage

Channel: Messages
Also via: realtime ETW trace
Task: RetrievePseudoMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`flags` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 64,
    "version": 0,
    "level": 0,
    "task": 68,
    "opcode": 0,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:25.771+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "flags": 1,
    "hwnd": "0x4F006C",
    "inputReadyTimeMs": 35789937,
    "message": 0,
    "pqmsg": "0x0"
  },
  "message": "RetrievePseudoMessage"
}

Event ID 65: WakePump

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: WakePump
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 65,
    "version": 0,
    "level": 4,
    "task": 61,
    "opcode": 0,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:25.758+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "LParam": "0x0",
    "WParam": "0x0",
    "hwnd": "0x4F006C",
    "inputReadyTimeMs": 0,
    "message": 15,
    "pqmsg": "0xFFFFC52384489010"
  },
  "message": "WakePump"
}

Event ID 66: InputQueueLocked

Channel: Messages
Task: InputQueueLocked

Fields #

Name	Description
`CallbackCount` Int8
`pQueue` Pointer
`ownerThread` UInt32

Event ID 67: InputQueueLocked67

Channel: Messages
Task: InputQueueLocked

Fields #

Name	Description
`CallbackCount` Int8
`pQueue` Pointer
`ownerThread` UInt32

Event ID 68: UserCallbackStart

Channel: Messages
Task: UserCallback
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`api` Int32

Event ID 69: UserCallbackStop

Channel: Messages
Task: UserCallback
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`api` Int32

Event ID 70: SendMessageStop

Channel: Messages
Level: Informational
Task: SendMessage
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 70,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.371Z",
    "version": 0
  },
  "event_data": {
    "CallbackCount": 0,
    "pqmsg": "0xFFFFDC84DD76D580"
  },
  "message": ""
}

Event ID 71: SendMessageTimeOutToBlocking

Channel: Messages
Task: SendMessageTimeOutToBlocking

Fields #

Name	Description
`CallbackCount` Int8

Event ID 72: InputDeviceReadStart

Channel: Messages
Task: InputDeviceRead
Opcode: Start

Fields #

Name	Description
`DeviceType` Int32
`dwFlags` UInt32

Event ID 73: InputDeviceReadStop

Channel: Messages
Task: InputDeviceRead
Opcode: Stop

Fields #

Name	Description
`DeviceType` Int32
`dwFlags` UInt32

Event ID 74: MessageInjectionPostGestureInputMessage

Channel: Messages
Task: MessageInjection
Opcode: PostGestureInputMessage

Fields #

Name	Description
`CallbackCount` Int8
`hwnd` Pointer
`hGestureInfo` Pointer

Event ID 75: MessageInjectionPostGestureMessage

Channel: Messages
Task: MessageInjection
Opcode: PostGestureMessage

Fields #

Name	Description
`CallbackCount` Int8
`hwnd` Pointer
`hGestureInfo` Pointer

Event ID 76: AppMessagePump

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: AppMessagePump
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`fGetMessage` Int32
`dwFlags` UInt32
`Message` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 76,
    "version": 0,
    "level": 4,
    "task": 69,
    "opcode": 1,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "Message": 1024,
    "dwFlags": 1,
    "fGetMessage": 1
  },
  "message": "AppMessagePump"
}

Event ID 77: AppMessagePump

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: AppMessagePump
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`fGetMessage` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 77,
    "version": 0,
    "level": 4,
    "task": 69,
    "opcode": 2,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "fGetMessage": 1
  },
  "message": "AppMessagePump"
}

Event ID 78: WakeRIT

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: WakeRIT
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`WakeReason` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 78,
    "version": 0,
    "level": 4,
    "task": 72,
    "opcode": 0,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "WakeReason": 1
  },
  "message": "WakeRIT"
}

Event ID 79: PointerMotionStart

Channel: Messages
Task: PointerMotion
Opcode: Start

Fields #

Name	Description
`Time` Int32
`X` Int32
`Y` Int32

Event ID 80: PointerMotionStop

Channel: Messages
Task: PointerMotion
Opcode: Stop

Fields #

Name	Description
`Time` Int32
`X` Int32
`Y` Int32

Event ID 81: InjectMouseStart

Channel: Messages
Task: InjectMouse
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`Time` Int32
`X` Int32
`Y` Int32

Event ID 82: InjectMouseStop

Channel: Messages
Task: InjectMouse
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`Time` Int32
`X` Int32
`Y` Int32

Event ID 83: RetrieveSendMessageStop

Channel: Messages
Level: Informational
Task: RetrieveSendMessage
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 83,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 9788
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:34.375Z",
    "version": 0
  },
  "event_data": {
    "CallbackCount": 0,
    "pqmsg": "0xFFFFDC84DD76D580"
  },
  "message": ""
}

Event ID 84: GUIProcess

Channel: Messages
Level: Informational
Task: GUIProcess
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 84,
    "version": 0,
    "level": 4,
    "task": 76,
    "opcode": 1,
    "keywords": "0x0400000000200000",
    "time_created": "2026-06-02T05:32:25.745+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 12892
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "GUIProcess"
}

Event ID 85: GUIProcess

Channel: Messages
Level: Informational
Task: GUIProcess
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 85,
    "version": 0,
    "level": 4,
    "task": 76,
    "opcode": 2,
    "keywords": "0x0400000000200000",
    "time_created": "2026-06-02T06:07:54.630+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 11204,
      "thread_id": 4120
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "GUIProcess"
}

Event ID 86: GUIThread

Channel: Messages
Level: Informational
Task: GUIThread
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 86,
    "version": 0,
    "level": 4,
    "task": 77,
    "opcode": 1,
    "keywords": "0x0400000000200000",
    "time_created": "2026-06-02T05:32:24.730+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 21572,
      "thread_id": 12732
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "GUIThread"
}

Event ID 87: GUIThread

Channel: Messages
Level: Informational
Task: GUIThread
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 87,
    "version": 0,
    "level": 4,
    "task": 77,
    "opcode": 2,
    "keywords": "0x0400000000200000",
    "time_created": "2026-06-02T04:02:00.577+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4872,
      "thread_id": 10316
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "GUIThread"
}

Event ID 88: QueueInputMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: QueueInputMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`WindowDelegated` Boolean
`WasWindowDelegated` Boolean
`Delegated` Boolean
`WasDelegated` Boolean
`Processed` Boolean
`fDelayedFree` Boolean
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 88,
    "version": 0,
    "level": 4,
    "task": 79,
    "opcode": 0,
    "keywords": "0x0400000040400000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1052
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "Delegated": false,
    "LParam": "0x0",
    "Processed": false,
    "WParam": "0x0",
    "WasDelegated": false,
    "WasWindowDelegated": false,
    "WindowDelegated": false,
    "fDelayedFree": false,
    "hwnd": "0x0",
    "inputReadyTimeMs": 35789921,
    "message": 0,
    "pqmsg": "0xFFFFC5238079C710"
  },
  "message": "QueueInputMessage"
}

Event ID 89: TranslateMessageStart

Channel: Messages
Task: TranslateMessage
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`message` UInt32

Event ID 91: TranslateMessageStop

Channel: Messages
Task: TranslateMessage
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`message` UInt32

Event ID 92: DispatchMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`message` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 92,
    "version": 0,
    "level": 4,
    "task": 81,
    "opcode": 1,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1052
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "message": 512
  },
  "message": "DispatchMessage"
}

Event ID 93: DispatchMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: DispatchMessage
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`message` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 93,
    "version": 0,
    "level": 4,
    "task": 81,
    "opcode": 2,
    "keywords": "0x0400000000400000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1052
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "message": 512
  },
  "message": "DispatchMessage"
}

Event ID 94: TouchTargetingSpeedHitTestStart

Channel: Messages
Task: TouchTargetingSpeedHitTest
Opcode: Start

Event ID 95: TouchTargetingSpeedHitTestStop

Channel: Messages
Task: TouchTargetingSpeedHitTest
Opcode: Stop

Event ID 96: TouchTargetingWindowHitTestStart

Channel: Messages
Task: TouchTargetingWindowHitTest
Opcode: Start

Event ID 97: TouchTargetingWindowHitTestStop

Channel: Messages
Task: TouchTargetingWindowHitTest
Opcode: Stop

Event ID 98: TouchTargetingPointerTargetStart

Channel: Messages
Task: TouchTargetingPointerTarget
Opcode: Start

Event ID 99: TouchTargetingPointerTargetStop

Channel: Messages
Task: TouchTargetingPointerTarget
Opcode: Stop

Event ID 100: MessageInjectionInjectTouchEvent

Channel: Messages
Task: MessageInjection
Opcode: InjectTouchEvent

Fields #

Name	Description
`CallbackCount` Int8

Event ID 102: task_0

Channel: Tracing
Opcode: Info

Fields #

Name	Description
`SessionId` UInt32
`cLineWidth` UInt32
`cElements` UInt32

Event ID 103: task_0103

Channel: Tracing
Opcode: Info

Fields #

Name	Description
`ProcName` AnsiString
`ClassName` UnicodeString
`WindowName` UnicodeString
`uId` UInt32
`uElapse` UInt32
`uType` UInt32

Event ID 104: ContactVisualizationStart

Channel: Tracing
Task: ContactVisualization
Opcode: Start

Event ID 105: ContactVisualizationStop

Channel: Tracing
Task: ContactVisualization
Opcode: Stop

Event ID 106: TouchTargetingOffset

Channel: Messages
Task: TouchTargetingOffset

Fields #

Name	Description
`ptOffsetX` Int32
`ptOffsetY` Int32
`pointerId` Int32
`cursorId` Int32

Event ID 107: TouchTargetingPointerEvent

Channel: Messages
Task: TouchTargetingPointerEvent

Fields #

Name	Description
`pointerId` Int32
`cursorId` Int32
`pointerType` Int32
`pointerFlags` Int32
`touchMask` Int32
`ptLocationX` Int32
`ptLocationY` Int32
`rcContactLeft` Int32
`rcContactRight` Int32
`rcContactTop` Int32
`rcContactBottom` Int32
`orientation` Int32

Event ID 108: TouchTargetingPointerEvent108

Channel: Messages
Task: TouchTargetingPointerEvent

Fields #

Name	Description
`pointerId` Int32
`cursorId` Int32
`pointerType` Int32
`pointerFlags` Int32
`touchMask` Int32
`ptLocationX` Int32
`ptLocationY` Int32
`rcContactLeft` Int32
`rcContactRight` Int32
`rcContactTop` Int32
`rcContactBottom` Int32
`orientation` Int32

Event ID 109: PointerDeviceReadStart

Channel: Messages
Task: PointerDeviceRead
Opcode: Start

Event ID 110: PointerDeviceReadStop

Channel: Messages
Task: PointerDeviceRead
Opcode: Stop

Event ID 111: PointerDeviceMessageStart

Channel: Messages
Task: PointerDeviceMessage
Opcode: Start

Event ID 112: PointerDeviceMessageStop

Channel: Messages
Task: PointerDeviceMessage
Opcode: Stop

Event ID 113: PointerDeviceMessageStart113

Channel: Messages
Task: PointerDeviceMessage
Opcode: Start

Event ID 114: PointerDeviceMessageStop114

Channel: Messages
Task: PointerDeviceMessage
Opcode: Stop

Event ID 115: PointerDeviceTransformationStart

Channel: Messages
Task: PointerDeviceTransformation
Opcode: Start

Fields #

Name	Description
`ulContactId` UInt32

Event ID 116: PointerDeviceTransformationStop

Channel: Messages
Task: PointerDeviceTransformation
Opcode: Stop

Fields #

Name	Description
`ulContactId` UInt32

Event ID 117: RenderingTranslationUpdate

Channel: Render
Task: Rendering
Opcode: TranslationUpdate

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 118: TranslationUpdateOffset

Channel: Render
Task: TranslationUpdateOffset

Fields #

Name	Description
`hwnd` Pointer
`Offsetx` Int32
`Offsety` Int32

Event ID 119: RenderingTranslationUpdateRectClip

Channel: Render
Task: Rendering
Opcode: TranslationUpdateRectClip

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 120: RenderingUpdateDxAccumFromGDI

Channel: Render
Task: Rendering
Opcode: UpdateDxAccumFromGDI

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 121: RenderingUpdateDxAccumFromDX

Channel: Render
Task: Rendering
Opcode: UpdateDxAccumFromDX

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 122: RenderingGetDxAccum

Channel: Render
Task: Rendering
Opcode: GetDxAccum

Fields #

Name	Description
`hSprite` UInt64
`hWnd` Pointer

Event ID 123: ModifyDxAccumRgn

Channel: Tracing
Task: ModifyDxAccumRgn

Fields #

Name	Description
`hLogicalSurface` UInt64
`RgnType` UInt32
`rcBounds` Int16
`NumRects` UInt32
`rcData` Int64

Event ID 124: LogicalSurfRemovedTranslationFromDirty

Channel: Tracing
Task: LogicalSurfRemovedTranslationFromDirty

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 125: PointerDeviceDiscoveryStart

Channel: Messages
Task: PointerDeviceDiscovery
Opcode: Start

Event ID 126: PointerDeviceDiscoveryStop

Channel: Messages
Task: PointerDeviceDiscovery
Opcode: Stop

Event ID 127: PointerDeviceMessageStart127

Channel: Messages
Task: PointerDeviceMessage
Opcode: Start

Event ID 128: PointerDeviceMessageStop128

Channel: Messages
Task: PointerDeviceMessage
Opcode: Stop

Event ID 129: TouchInjectionEventStart

Channel: Messages
Task: TouchInjectionEvent
Opcode: Start

Event ID 130: TouchInjectionEventStop

Channel: Messages
Task: TouchInjectionEvent
Opcode: Stop

Event ID 131: PointerFrameCreationStart

Channel: Messages
Task: PointerFrameCreation
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 132: PointerFrameCreationStop

Channel: Messages
Task: PointerFrameCreation
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 133: PointerFrameBuildPartialStart

Channel: Messages
Task: PointerFrameBuildPartial
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 134: PointerFrameBuildPartialStop

Channel: Messages
Task: PointerFrameBuildPartial
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 135: PointerFrameCommitStart

Channel: Messages
Task: PointerFrameCommit
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 136: PointerFrameCommitStop

Channel: Messages
Task: PointerFrameCommit
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 137: PointerFrameCoalesceStart

Channel: Messages
Task: PointerFrameCoalesce
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 138: PointerFrameCoalesceStop

Channel: Messages
Task: PointerFrameCoalesce
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 139: PointerFrameMessageGenerationStart

Channel: Messages
Task: PointerFrameMessageGeneration
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 140: PointerFrameMessageGenerationStop

Channel: Messages
Task: PointerFrameMessageGeneration
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 141: PointerMessageRetrieveStart

Channel: Messages
Task: PointerMessageRetrieve
Opcode: Start

Fields #

Name	Description
`pqmsg` Pointer
`PointerId` UInt32
`Message` UInt32

Event ID 142: PointerMessageRetrieveStop

Channel: Messages
Task: PointerMessageRetrieve
Opcode: Stop

Fields #

Name	Description
`pqmsg` Pointer
`PointerId` UInt32
`Message` UInt32

Event ID 143: PointerUpdateMessageRetrieveStart

Channel: Messages
Task: PointerUpdateMessageRetrieve
Opcode: Start

Fields #

Name	Description
`pqmsg` Pointer
`PointerId` UInt32
`Message` UInt32

Event ID 144: PointerUpdateMessageRetrieveStop

Channel: Messages
Task: PointerUpdateMessageRetrieve
Opcode: Stop

Fields #

Name	Description
`pqmsg` Pointer
`PointerId` UInt32
`Message` UInt32

Event ID 145: PointerSetTargetWindowsStart

Channel: Messages
Task: PointerSetTargetWindows
Opcode: Start

Event ID 146: PointerSetTargetWindowsStop

Channel: Messages
Task: PointerSetTargetWindows
Opcode: Stop

Event ID 147: PointerUpdateSetTargetWindowsStart

Channel: Messages
Task: PointerUpdateSetTargetWindows
Opcode: Start

Event ID 148: PointerUpdateSetTargetWindowsStop

Channel: Messages
Task: PointerUpdateSetTargetWindows
Opcode: Stop

Event ID 149: InputQueueNoRemoveLockerStop

Channel: Messages
Task: InputQueueNoRemoveLocker
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pQueue` Pointer
`ownerThread` UInt32

Event ID 150: InputQueueLockedPeekRecursionStop

Channel: Messages
Task: InputQueueLockedPeekRecursion
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pQueue` Pointer
`ownerThread` UInt32

Event ID 151: DCompCommitBatch

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompCommitBatch
Opcode: win:Info

Fields #

Name	Description
`channelHandle` UInt32
`pBatch` Pointer
`batchID` UInt32
`isNinja` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 151,
    "version": 0,
    "level": 4,
    "task": 107,
    "opcode": 0,
    "keywords": "0x0000000400001000",
    "time_created": "2026-06-02T06:08:00.231+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 5396,
      "thread_id": 3744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "batchID": 24923,
    "channelHandle": 15,
    "isNinja": false,
    "pBatch": "0xFFFF990EE77329B0"
  },
  "message": "DCompCommitBatch"
}

Event ID 152: DelegateInputUserCallbackStart

Channel: Messages
Task: DelegateInputUserCallback
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`WindowDelegated` Boolean
`WasWindowDelegated` Boolean
`Delegated` Boolean
`WasDelegated` Boolean
`Processed` Boolean
`fDelayedFree` Boolean
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Event ID 153: DelegateInputUserCallbackStop

Channel: Messages
Task: DelegateInputUserCallback
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`WindowDelegated` Boolean
`WasWindowDelegated` Boolean
`Delegated` Boolean
`WasDelegated` Boolean
`Processed` Boolean
`fDelayedFree` Boolean
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32

Event ID 154: DelegatedInputWorkerStart

Channel: Messages
Task: DelegatedInputWorker
Opcode: Start

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`WindowDelegated` Boolean
`WasWindowDelegated` Boolean
`Delegated` Boolean
`WasDelegated` Boolean
`Processed` Boolean
`fDelayedFree` Boolean
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`hdfResponse` UInt32

Event ID 155: DelegatedInputWorkerStop

Channel: Messages
Task: DelegatedInputWorker
Opcode: Stop

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`WindowDelegated` Boolean
`WasWindowDelegated` Boolean
`Delegated` Boolean
`WasDelegated` Boolean
`Processed` Boolean
`fDelayedFree` Boolean
`hwnd` Pointer
`WParam` Pointer
`LParam` Pointer
`message` UInt32
`inputReadyTimeMs` UInt32
`hdfResponse` UInt32

Event ID 156: PointerDeviceMessage

Channel: Messages
Task: PointerDeviceMessage

Fields #

Name	Description
`bNew` UInt32
`ulContactId` UInt32
`dwCursorId` UInt32
`X` Int32
`Y` Int32

Event ID 157: PointerMessageGenerationStart

Channel: Messages
Task: PointerMessageGeneration
Opcode: Start

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16

Event ID 158: PointerMessageGenerationStop

Channel: Messages
Task: PointerMessageGeneration
Opcode: Stop

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16

Event ID 159: PointerFrameCoalesce

Channel: Messages
Task: PointerFrameCoalesce

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16
`dwReason` UInt32

Event ID 160: SmoothRotationStart

Channel: Tracing
Task: SmoothRotation
Opcode: Start

Fields #

Name	Description
`Orientation` UInt32
`SensorOriginated` Boolean
`ActiveProcessId` UInt32

Event ID 161: SmoothRotationStop

Channel: Tracing
Task: SmoothRotation
Opcode: Stop

Fields #

Name	Description
`Orientation` UInt32
`SensorOriginated` Boolean

Event ID 162: DCompGetBatch

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompGetBatch
Opcode: win:Info

Fields #

Name	Description
`pBatch` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 162,
    "version": 0,
    "level": 4,
    "task": 111,
    "opcode": 0,
    "keywords": "0x0000000400001000",
    "time_created": "2026-06-02T06:08:00.242+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pBatch": "0xFFFF990EE77329B0"
  },
  "message": "DCompGetBatch"
}

Event ID 163: ExclusiveUserCrit

Channel: Contention
Task: ExclusiveUserCrit

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeUs` UInt32
`Token` UInt64

Event ID 164: ExclusiveUserCrit

Channel: Contention
Also via: realtime ETW trace
Level: Informational
Task: ExclusiveUserCrit
Opcode: win:Info

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeUs` UInt32
`Token` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 164,
    "version": 0,
    "level": 4,
    "task": 113,
    "opcode": 0,
    "keywords": "0x0200000010000000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 3488
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AcquireQpcCounts": 5,
    "AcquireTimeUs": 0,
    "Token": 267
  },
  "message": "ExclusiveUserCrit"
}

Event ID 165: SharedUserCrit

Channel: Contention
Task: SharedUserCrit

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeUs` UInt32
`Token` UInt64

Event ID 166: SharedUserCrit

Channel: Contention
Also via: realtime ETW trace
Level: Informational
Task: SharedUserCrit
Opcode: win:Info

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeUs` UInt32
`Token` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 166,
    "version": 0,
    "level": 4,
    "task": 114,
    "opcode": 0,
    "keywords": "0x0200000010000000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AcquireQpcCounts": 4,
    "AcquireTimeUs": 0,
    "Token": 270
  },
  "message": "SharedUserCrit"
}

Event ID 167: ReleaseUserCrit

Channel: Contention
Also via: realtime ETW trace
Level: Informational
Task: ReleaseUserCrit
Opcode: win:Info

Fields #

Name	Description
`HoldQpcCounts` UInt64
`HoldTimeMs` UInt32
`Token` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 167,
    "version": 0,
    "level": 4,
    "task": 115,
    "opcode": 0,
    "keywords": "0x0200000010000000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6296,
      "thread_id": 3488
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HoldQpcCounts": 1895,
    "HoldTimeMs": 0,
    "Token": 268
  },
  "message": "ReleaseUserCrit"
}

Event ID 168: SleepInputIdle

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: SleepInputIdle
Opcode: win:Info

Fields #

Name	Description
`pti` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 168,
    "version": 0,
    "level": 4,
    "task": 116,
    "opcode": 0,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pti": "0xFFFFC5238447A010"
  },
  "message": "SleepInputIdle"
}

Event ID 169: WakeInputIdle

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: WakeInputIdle
Opcode: win:Info

Fields #

Name	Description
`pti` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 117,
    "opcode": 0,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T05:32:24.458+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 6296,
      "thread_id": 6300
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "pti": "0xFFFFC5238447A010"
  },
  "message": "WakeInputIdle"
}

Event ID 170: EdgyDetectionStart

Channel: Tracing
Task: EdgyDetection
Opcode: Start

Event ID 171: EdgyDetectionStop

Channel: Tracing
Task: EdgyDetection
Opcode: Stop

Fields #

Name	Description
`Info` UInt32

Event ID 172: ImmersiveInputProcessDelay

Channel: Tracing
Task: ImmersiveInputProcessDelay

Fields #

Name	Description
`Flags` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32
`ClassName` UnicodeString
`TopLevelClassName` UnicodeString
`PackageMoniker` UnicodeString
`AppUserModelId` UnicodeString
`MessageId` UInt32
`WParam` UInt64

Event ID 173: ImmersiveMessageCheckDelay

Channel: Tracing
Task: ImmersiveMessageCheckDelay

Fields #

Name	Description
`Flags` UInt32
`DelayTimeMs` UInt32
`TimeSinceInputRemoveMs` UInt32
`TimeSinceOldestInputMs` UInt32
`ClassName` UnicodeString
`TopLevelClassName` UnicodeString
`PackageMoniker` UnicodeString
`AppUserModelId` UnicodeString
`MessageId` UInt32
`WParam` UInt64

Event ID 174: THQAEventStart

Channel: Messages
Task: THQAEvent
Opcode: Start

Event ID 175: THQAEventStop

Channel: Messages
Task: THQAEvent
Opcode: Stop

Event ID 176: PointerPredictionStart

Channel: Messages
Task: PointerPrediction
Opcode: Start

Fields #

Name	Description
`ulContactId` UInt32

Event ID 177: PointerPredictionStop

Channel: Messages
Task: PointerPrediction
Opcode: Stop

Fields #

Name	Description
`ulContactId` UInt32

Event ID 178: MoveRgn

Channel: Tracing
Task: MoveRgn

Fields #

Name	Description
`hLogicalSurface` UInt64
`RgnType` UInt32
`rcBounds` Int16
`NumRects` UInt32
`rcData` Int64

Event ID 179: DirtyRgn

Channel: Tracing
Task: DirtyRgn

Fields #

Name	Description
`hLogicalSurface` UInt64
`RgnType` UInt32
`rcBounds` Int16
`NumRects` UInt32
`rcData` Int64

Event ID 180: LogicalSurfRemovedTranslationFromMove

Channel: Tracing
Task: LogicalSurfRemovedTranslationFromMove

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Event ID 181: DirtyRectUpdate

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DirtyRectUpdate
Opcode: win:Info

Fields #

Name	Description
`hwnd` Pointer
`DirtyLeft` UInt32
`DirtyTop` UInt32
`DirtyRight` UInt32
`DirtyBottom` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 181,
    "version": 0,
    "level": 4,
    "task": 127,
    "opcode": 0,
    "keywords": "0x0000000000001000",
    "time_created": "2026-06-02T04:02:00.030+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3088
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DirtyBottom": 40,
    "DirtyLeft": 907,
    "DirtyRight": 971,
    "DirtyTop": 0,
    "hwnd": "0x4120632"
  },
  "message": "DirtyRectUpdate"
}

Event ID 182: TranslationUpdateOffsetDWM

Channel: Tracing
Task: TranslationUpdateOffsetDWM

Fields #

Name	Description
`hwnd` Pointer
`Offsetx` Int32
`Offsety` Int32

Event ID 183: DwmGetRgn

Channel: Tracing
Task: DwmGetRgn

Fields #

Name	Description
`hLogicalSurface` UInt64
`RgnType` UInt32
`rcBounds` Int16
`NumRects` UInt32
`rcData` Int64

Event ID 184: PointerFrameCoalesceStart184

Channel: Messages
Task: PointerFrameCoalesce
Opcode: Start

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 185: PointerFrameCoalesceStop185

Channel: Messages
Task: PointerFrameCoalesce
Opcode: Stop

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32
`PendingPointerCount` UInt32

Event ID 186: PointerFrameCoalesce186

Channel: Messages
Task: PointerFrameCoalesce

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16
`dwReason` UInt32

Event ID 187: InternalSetTimerCoalescing

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: InternalSetTimerCoalescing
Opcode: win:Info

Fields #

Name	Description
`Hwnd` Pointer
`uId` UInt32
`uElapse` UInt32
`uCoalescingTolerance` UInt32
`uType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 187,
    "version": 0,
    "level": 4,
    "task": 130,
    "opcode": 0,
    "keywords": "0x0000000020000000",
    "time_created": "2026-06-02T05:32:25.745+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 12892
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Hwnd": "0x0",
    "uCoalescingTolerance": 0,
    "uElapse": 35000,
    "uId": 32766,
    "uType": 540
  },
  "message": "InternalSetTimerCoalescing"
}

Event ID 188: InternalSetTimerNoCoalescing

Channel: Tracing
Task: InternalSetTimerNoCoalescing

Fields #

Name	Description
`Hwnd` Pointer
`uId` UInt32
`uElapse` UInt32
`uType` UInt32

Event ID 189: KillTimer

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: KillTimer
Opcode: win:Info

Fields #

Name	Description
`Hwnd` Pointer
`uId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 189,
    "version": 0,
    "level": 4,
    "task": 132,
    "opcode": 0,
    "keywords": "0x0000000020000000",
    "time_created": "2026-06-02T04:02:01.046+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3088
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Hwnd": "0x0",
    "uId": 23933
  },
  "message": "KillTimer"
}

Event ID 190: ProcTimerCoalescing

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: ProcTimerCoalescing
Opcode: win:Info

Fields #

Name	Description
`Hwnd` Pointer
`uId` UInt32
`uElapse` UInt32
`uCoalescingTolerance` UInt32
`uType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 190,
    "version": 0,
    "level": 4,
    "task": 133,
    "opcode": 0,
    "keywords": "0x0000000020000000",
    "time_created": "2026-06-02T05:32:25.246+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 1004,
      "thread_id": 1112
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Hwnd": "0x0",
    "uCoalescingTolerance": 0,
    "uElapse": 1000,
    "uId": 32766,
    "uType": 516
  },
  "message": "ProcTimerCoalescing"
}

Event ID 191: ProcTimerNoCoalescing

Channel: Tracing
Task: ProcTimerNoCoalescing

Fields #

Name	Description
`Hwnd` Pointer
`uId` UInt32
`uElapse` UInt32
`uType` UInt32

Event ID 192: DrvChangeDisplaySettingsStart

Channel: Tracing
Task: DrvChangeDisplaySettings
Opcode: Start

Event ID 193: DrvChangeDisplaySettingsStop

Channel: Tracing
Task: DrvChangeDisplaySettings
Opcode: Stop

Event ID 194: ChangeDisplayModeStart

Channel: Tracing
Task: ChangeDisplayMode
Opcode: Start

Event ID 195: ChangeDisplayModeStop

Channel: Tracing
Task: ChangeDisplayMode
Opcode: Stop

Event ID 196: PseudoDevCreationStart

Channel: Messages
Task: PseudoDevCreation
Opcode: Start

Event ID 197: PseudoDevCreationStop

Channel: Messages
Task: PseudoDevCreation
Opcode: Stop

Event ID 198: TouchHWTimeStamp

Channel: Messages
Task: TouchHWTimeStamp

Fields #

Name	Description
`ScanTime` Int32
`dwTime` Int32
`QPC` UInt64
`XRawPosition` Int32
`YRawPosition` Int32
`XPredictedPosition` Int32
`YPredictedPosition` Int32

Event ID 199: PointerFrameCoalesce199

Channel: Messages
Task: PointerFrameCoalesce

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16
`dwReason` UInt32

Event ID 200: PointerFrameCoalesce200

Channel: Messages
Task: PointerFrameCoalesce

Fields #

Name	Description
`wCursorId` UInt16
`wPointerId` UInt16
`dwReason` UInt32

Event ID 201: TokenCompositionSurfaceObject_V1

Channel: Tracing
Task: TokenCompositionSurfaceObject

Fields #

Name	Description
`pToken` Pointer
`pCompositionSurfaceObject` Pointer
`SwapChainIndex` UInt32
`PresentCount` UInt64
`CompositionSurfaceLuid` UInt64
`BindId` UInt64
`FlipInterval` UInt32
`DestWidth` UInt32
`DestHeight` UInt32

Event ID 202: CompositionSurfaceObjectUpdate

Channel: Tracing
Task: CompositionSurfaceObjectUpdate

Fields #

Name	Description
`pCompositionSurfaceObject` Pointer
`SwapChainIndex` UInt32

Event ID 203: QueueEventMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: QueueEventMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`pti` Pointer
`dwQEvent` UInt32
`hwnd` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 203,
    "version": 0,
    "level": 4,
    "task": 140,
    "opcode": 0,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T06:08:00.227+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 5396,
      "thread_id": 3744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 1,
    "dwQEvent": 9,
    "hwnd": "0x200D2",
    "pqmsg": "0xFFFF990F043BDD00",
    "pti": "0x0"
  },
  "message": "QueueEventMessage"
}

Event ID 204: RetrieveQueueEventMessage

Channel: Messages
Also via: realtime ETW trace
Level: Informational
Task: RetrieveQueueEventMessage
Opcode: win:Info

Fields #

Name	Description
`CallbackCount` Int8
`pqmsg` Pointer
`pti` Pointer
`dwQEvent` UInt32
`hwnd` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 204,
    "version": 0,
    "level": 4,
    "task": 141,
    "opcode": 0,
    "keywords": "0x0400000000800000",
    "time_created": "2026-06-02T06:08:00.228+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 5396,
      "thread_id": 3744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CallbackCount": 0,
    "dwQEvent": 9,
    "hwnd": "0x200D2",
    "pqmsg": "0xFFFF990F043BDD00",
    "pti": "0xFFFF990EFF42E720"
  },
  "message": "RetrieveQueueEventMessage"
}

Event ID 205: ForegroundWindowFullScreenStart

Channel: Tracing
Task: ForegroundWindowFullScreen
Opcode: Start

Event ID 206: ForegroundWindowFullScreenStop

Channel: Tracing
Task: ForegroundWindowFullScreen
Opcode: Stop

Event ID 207: ChangeDisplayModeBroadcast

Channel: Tracing
Task: ChangeDisplayModeBroadcast

Event ID 213: ContactVisualization

Channel: Tracing
Task: ContactVisualization

Fields #

Name	Description
`data` UInt32

Event ID 214: ChangeDisplayModeDeferral

Channel: Tracing
Task: ChangeDisplayModeDeferral

Event ID 215: ConvertibleState

Channel: Tracing
Task: ConvertibleState

Fields #

Name	Description
`ConvertibleState` UInt32

Event ID 216: DockState

Channel: Tracing
Task: DockState

Fields #

Name	Description
`DockState` UInt32

Event ID 217: TouchPadHWTimeStamp

Channel: Tracing
Task: TouchPadHWTimeStamp

Fields #

Name	Description
`ScanTime` UInt32
`dwTime` UInt32
`QPCTime` UInt64
`XLogicalT` UInt32
`YLogicalT` UInt32
`XLogicalC` UInt32
`YLogicalC` UInt32
`XHimetricT` UInt32
`YHimetricT` UInt32
`Button` Boolean
`Count` UInt32
`Identifier` UInt32
`Width` UInt32
`Height` UInt32
`Confidence` Boolean
`Pressure` UInt32
`DeviceType` UInt32

Event ID 218: TransformAgeDecay

Channel: Tracing
Task: TransformAgeDecay

Fields #

Name	Description
`InputTransformList` Pointer
`PerformanceCount` UInt64

Event ID 219: WakeMIT

Channel: Messages
Level: Informational
Task: WakeMIT

Fields #

Name	Description
`CallbackCount` Int8
`WakeReason` Int32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 219,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1644
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.103Z",
    "version": 0
  },
  "event_data": {
    "CallbackCount": 0,
    "WakeReason": 1
  },
  "message": ""
}

Event ID 220: ArmDitMouseFlush

Channel: Messages
Task: ArmDitMouseFlush

Event ID 221: ProcessQueuedMouseEvents

Channel: Messages
Level: Informational
Task: ProcessQueuedMouseEvents
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 221,
    "version": 0,
    "level": 4,
    "task": 216,
    "opcode": 1,
    "keywords": "0x0400000040800000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1048
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ProcessQueuedMouseEvents"
}

Event ID 222: ProcessQueuedMouseEvents

Channel: Messages
Level: Informational
Task: ProcessQueuedMouseEvents
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 222,
    "version": 0,
    "level": 4,
    "task": 216,
    "opcode": 2,
    "keywords": "0x0400000040800000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 952,
      "thread_id": 1048
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "ProcessQueuedMouseEvents"
}

Event ID 223: DITSpeedHitTestFailedRevalidation

Channel: Messages
Task: DITSpeedHitTestFailedRevalidation

Fields #

Name	Description
`Hwnd` Pointer

Event ID 224: InputRedirection

Channel: Messages
Task: InputRedirection

Fields #

Name	Description
`hDCompInputHandle` Pointer
`Hwnd` Pointer
`XformQPCTime` UInt64
`XformStored` UInt32

Event ID 225: OnInputXformUpdate

Channel: Messages
Task: OnInputXformUpdate

Fields #

Name	Description
`Hwnd` Pointer
`XformQPCTime` UInt64
`XformUpdated` UInt32

Event ID 226: DitWaitForRitDisEngagement

Channel: Messages
Task: DitWaitForRitDisEngagement

Event ID 227: RitDisEngaged

Channel: Messages
Task: RitDisEngaged

Event ID 228: DitEngaged

Channel: Messages
Task: DitEngaged

Event ID 229: RitReEngaged

Channel: Messages
Task: RitReEngaged

Event ID 230: DitDisEngaged

Channel: Messages
Task: DitDisEngaged

Event ID 231: DitTerminated

Channel: Messages
Task: DitTerminated

Event ID 232: DitShutdown

Channel: Messages
Task: DitShutdown

Event ID 233: TouchPadAAP

Channel: Tracing
Task: TouchPadAAP

Fields #

Name	Description
`LastKeyDownTime` UInt32
`LastKeyUpTime` UInt32
`TapTime` UInt32
`Blocked` Boolean
`Feature` UInt32

Event ID 234: MouseInputApc

Channel: Messages
Task: MouseInputApc

Event ID 235: MouseInputCoalesced

Channel: Messages
Level: Informational
Task: MouseInputCoalesced

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8c416c79-d49b-4f01-a467-e56d3aa8234c}",
    "event_source_name": "",
    "event_id": 235,
    "version": 0,
    "level": 4,
    "task": 232,
    "opcode": 0,
    "keywords": "0x400000040800000",
    "time_created": "2026-07-19T04:21:16.937209600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "8C416C79-D49B-4F01-A467-E56D3AA8234C"
    },
    "execution": {
      "process_id": 12628,
      "thread_id": 13124
    },
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 236: TouchPadTypeDiscovered

Channel: Tracing
Task: TouchPadTypeDiscovered

Fields #

Name	Description
`deviceType` UInt32

Event ID 237: TouchPadEnabledStatusChangeStart

Channel: Tracing
Task: TouchPadEnabledStatusChange
Opcode: Start

Event ID 238: TouchPadEnabledStatusChangeStop

Channel: Tracing
Task: TouchPadEnabledStatusChange
Opcode: Stop

Event ID 239: PTPReadThresholdsStart

Channel: Tracing
Task: PTPReadThresholds
Opcode: Start

Event ID 240: PTPReadThresholdsStop

Channel: Tracing
Task: PTPReadThresholds
Opcode: Stop

Event ID 241: TouchPadConfidenceCleared

Channel: Tracing
Task: TouchPadConfidenceCleared

Fields #

Name	Description
`ContactId` UInt32
`OnUp` Boolean
`NeedsUp` Boolean

Event ID 242: TouchPadConfidenceUpped

Channel: Tracing
Task: TouchPadConfidenceUpped

Fields #

Name	Description
`ContactId` UInt32

Event ID 243: PTPElasticDragModeStart

Channel: Tracing
Task: PTPElasticDragMode
Opcode: Start

Event ID 244: PTPElasticDragModeStop

Channel: Tracing
Task: PTPElasticDragMode
Opcode: Stop

Event ID 245: LegacyTouchPadDetectionStart

Channel: Tracing
Task: LegacyTouchPadDetection
Opcode: Start

Event ID 246: LegacyTouchPadDetectionStop

Channel: Tracing
Task: LegacyTouchPadDetection
Opcode: Stop

Event ID 247: LegacyTouchPadDetection

Channel: Tracing
Task: LegacyTouchPadDetection

Event ID 248: LegacyTouchPadDetection248

Channel: Tracing
Task: LegacyTouchPadDetection

Event ID 249: TouchPadCurtainState

Channel: Tracing
Task: TouchPadCurtainState

Fields #

Name	Description
`CurtainsOn` Boolean

Event ID 250: TouchPadCurtainSize

Channel: Tracing
Task: TouchPadCurtainSize

Fields #

Name	Description
`Top` UInt32
`Left` UInt32
`Right` UInt32
`Enabled` Boolean

Event ID 251: TouchpadStopInertia

Channel: Tracing
Task: TouchpadStopInertia

Event ID 252: TouchpadStopInertia252

Channel: Tracing
Task: TouchpadStopInertia

Event ID 253: TouchpadStopInertia253

Channel: Tracing
Task: TouchpadStopInertia

Event ID 254: TrappedAppContainerRender

Channel: Tracing
Task: TrappedAppContainerRender

Fields #

Name	Description
`RenderSourceProcessName` AnsiString
`RenderSourcePackageName` UnicodeString
`RenderTargetProcessName` AnsiString
`RenderTargetPackageName` UnicodeString

Event ID 255: CursorSize

Channel: Tracing
Task: CursorSize

Fields #

Name	Description
`iCursorDim` UInt32
`cx` UInt32
`cy` UInt32

Event ID 256: DitMmcssWorkStart

Channel: Messages
Task: DitMmcssWork
Opcode: Start

Event ID 257: DitMmcssWorkStop

Channel: Messages
Task: DitMmcssWork
Opcode: Stop

Event ID 258: FocusedProcessChangeGained

Channel: Tracing
Task: FocusedProcessChangeGained

Fields #

Name	Description
`SessionId` UInt32
`NewProcessId` UInt32
`NewProcessCreateTime` FILETIME

Event ID 259: FocusedProcessChangeLost

Channel: Tracing
Task: FocusedProcessChangeLost

Fields #

Name	Description
`SessionId` UInt32
`OldProcessId` UInt32
`OldProcessCreateTime` FILETIME

Event ID 260: SourceProcessName attempted loading a font that is restricted by font loading policy.

Channel: Operational
Collection Priority: Recommended (JSCU-NL)
Task: FontLoadAttempt

Message #

%1 attempted loading a font that is restricted by font loading policy.
FontType: %2
FontPath: %3
Blocked: %4

Fields #

Name	Description
`SourceProcessName` UnicodeString
`SourceType` UInt32
`FontSourcePath` UnicodeString
`Blocked` Boolean

Event ID 301: TokenStateChanged_V1

Channel: Tracing
Task: TokenStateChanged

Fields #

Name	Description
`pCompositionSurfaceObject` Pointer
`SwapChainIndex` UInt32
`PresentCount` UInt32
`FenceValue` UInt64
`NewState` UInt32
`IndependentFlip` Boolean
`SkipIndependentFlip` Boolean
`CompositionSurfaceLuid` UInt64
`BindId` UInt64
`EarlyComposition` Boolean

Event ID 400: DCompDeferBatch

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompDeferBatch
Opcode: win:Info

Fields #

Name	Description
`channelHandle` UInt32
`pBatch` Pointer
`batchID` UInt32
`submissionTime` UInt64
`submissionDeadline` UInt64
`deferReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 400,
    "opcode": 0,
    "keywords": "0x0000000000001000",
    "time_created": "2026-06-02T06:08:00.231+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "batchID": 24923,
    "channelHandle": 15,
    "deferReason": 3,
    "pBatch": "0xFFFF990EE77329B0",
    "submissionDeadline": 1236898750000,
    "submissionTime": 1236898856077
  },
  "message": "DCompDeferBatch"
}

Event ID 401: TouchPadHIDProcessingStart

Channel: Messages
Task: TouchPadHIDProcessing
Opcode: Start

Event ID 402: TouchPadHIDProcessingStop

Channel: Messages
Task: TouchPadHIDProcessing
Opcode: Stop

Event ID 403: TouchPadWMPointerProcessingStart

Channel: Messages
Task: TouchPadWMPointerProcessing
Opcode: Start

Event ID 404: TouchPadWMPointerProcessingStop

Channel: Messages
Task: TouchPadWMPointerProcessing
Opcode: Stop

Event ID 405: TouchPadGesture

Channel: Messages
Task: TouchPadGesture

Event ID 406: CopyPointerInputFrameStart

Channel: Tracing
Task: CopyPointerInputFrame
Opcode: Start

Event ID 407: CopyPointerInputFrameStop

Channel: Tracing
Task: CopyPointerInputFrame
Opcode: Stop

Event ID 410: LatencyModeProcessingStart

Channel: Messages
Task: LatencyModeProcessing
Opcode: Start

Event ID 411: LatencyModeProcessingStop

Channel: Messages
Task: LatencyModeProcessing
Opcode: Stop

Event ID 412: DCompBeginFrame

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompBeginFrame
Opcode: win:Info

Fields #

Name	Description
`hConnection` UInt64
`targetTime` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 412,
    "version": 0,
    "level": 4,
    "task": 412,
    "opcode": 0,
    "keywords": "0x0000000000001000",
    "time_created": "2026-06-02T04:02:00.060+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 1648,
      "thread_id": 1712
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SyncRefreshCount": 1943314,
    "hConnection": 4
  },
  "message": "DCompBeginFrame"
}

Example keys not documented in the fields table: SyncRefreshCount

Event ID 413: TokenIndependentFlipSkipComplete

Channel: Tracing
Task: TokenIndependentFlipSkipComplete

Fields #

Name	Description
`SyncRefreshCount` UInt32
`PresentCount` UInt32
`CompositionSurfaceLuid` UInt64
`BindId` UInt64

Event ID 414: DwmManipulationFrameStart

Channel: Tracing
Task: DwmManipulationFrameStart

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32

Event ID 415: DwmManipulationFrameRouted

Channel: Tracing
Task: DwmManipulationFrameRouted

Fields #

Name	Description
`FrameId` UInt32
`PointerCount` UInt32

Event ID 416: ExclusiveUserCritTelemetry

Channel: Tracing
Level: Informational
Task: ExclusiveUserCritTelemetry

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeMs` UInt32
`Token` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8c416c79-d49b-4f01-a467-e56d3aa8234c}",
    "event_source_name": "",
    "event_id": 416,
    "version": 1,
    "level": 4,
    "task": 416,
    "opcode": 0,
    "keywords": "0x8000002010000000",
    "time_created": "2026-07-19T04:21:13.791381100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "8C416C79-D49B-4F01-A467-E56D3AA8234C"
    },
    "execution": {
      "process_id": 11736,
      "thread_id": 12200
    },
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AcquireQpcCounts": "13131",
    "AcquireTimeMs": "1",
    "Token": "8"
  },
  "message": ""
}

Event ID 417: SharedUserCritTelemetry

Channel: Tracing
Level: Informational
Task: SharedUserCritTelemetry

Fields #

Name	Description
`AcquireQpcCounts` UInt64
`AcquireTimeMs` UInt32
`Token` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 417,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 13296,
      "thread_id": 12196
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:47.471Z",
    "version": 0
  },
  "event_data": {
    "AcquireQpcCounts": 18461,
    "AcquireTimeMs": 1,
    "Token": 11425
  },
  "message": ""
}

Event ID 418: PowerOnGdi

Channel: Power
Task: PowerDisplayChange
Opcode: Start

Fields #

Name	Description
`Location` Int32

Event ID 419: PowerOnGdi

Channel: Power
Task: PowerDisplayChange
Opcode: Stop

Fields #

Name	Description
`Location` Int32

Event ID 420: UserResetDisplayDevice

Channel: Power
Task: PowerDisplayChange
Opcode: Start

Fields #

Name	Description
`Location` Int32

Event ID 421: UserResetDisplayDevice

Channel: Power
Task: PowerDisplayChange
Opcode: Stop

Fields #

Name	Description
`Location` Int32

Event ID 422: PowerOnMonitor

Channel: Power
Task: PowerDisplayChange
Opcode: Start

Fields #

Name	Description
`Location` Int32

Event ID 423: PowerOnMonitor

Channel: Power
Task: PowerDisplayChange
Opcode: Stop

Fields #

Name	Description
`Location` Int32

Event ID 424: DwmSyncFlushForceRenderAndWaitForBatch

Channel: Power
Task: PowerDisplayChange
Opcode: Start

Fields #

Name	Description
`Location` Int32

Event ID 425: DwmSyncFlushForceRenderAndWaitForBatch

Channel: Power
Task: PowerDisplayChange
Opcode: Stop

Fields #

Name	Description
`Location` Int32

Event ID 426: QueueNullPostMessage

Channel: Messages
Level: Informational
Task: QueueNullPostMessage

Fields #

Name	Description
`SourceProcessId` UInt32
`SourceThreadId` UInt32
`SourceProcessName` AnsiString
`DestinationHwnd` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Messages",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 426,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 288
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.603Z",
    "version": 0
  },
  "event_data": {
    "DestinationHwnd": "0x0",
    "SourceProcessId": 8992,
    "SourceProcessName": "explorer.exe",
    "SourceThreadId": 288
  },
  "message": ""
}

Event ID 427: The following win32k syscall is blocked by Win32k Syscall Filter: SyscallName.

Channel: Operational
Task: SyscallFilterMessage

Message #

The following win32k syscall is blocked by Win32k Syscall Filter: %1
Process Command Line: %3

Fields #

Name	Description
`SyscallName` AnsiString
`AppContainerSid` UnicodeString
`ProcessCommandLine` UnicodeString
`FilterSetId` UInt32

Event ID 428: The following SystemParametersInfo action was blocked by Win32k Syscall Filter: SPIAction.

Channel: Operational
Task: SPIBlockedByFiltering

Message #

The following SystemParametersInfo action was blocked by Win32k Syscall Filter: %1

Fields #

Name	Description
`SPIAction` UInt32

Event ID 429: PowerWatchdog

Channel: Power
Task: PowerWatchdog
Opcode: Start

Fields #

Name	Description
`Instance` UInt64
`WatchdogType` UInt32

Event ID 430: PowerWatchdog

Channel: Power
Task: PowerWatchdog
Opcode: Stop

Fields #

Name	Description
`Instance` UInt64

Event ID 431: VideoPortCalloutThread

Channel: Power
Task: PowerRequest
Opcode: Start

Fields #

Name	Description
`CalloutType` Int32
`Status` UInt32	NTSTATUS reference

Event ID 432: VideoPortCalloutThread

Channel: Power
Task: PowerRequest
Opcode: Stop

Fields #

Name	Description
`CalloutType` Int32
`Status` UInt32	NTSTATUS reference

Event ID 433: PowerStateCalloutWorker

Channel: Power
Task: PowerRequest
Opcode: Start

Fields #

Name	Description
`PowerTaskState` Int32
`Status` UInt32	NTSTATUS reference

Event ID 434: PowerStateCalloutWorker

Channel: Power
Task: PowerRequest
Opcode: Stop

Fields #

Name	Description
`PowerTaskState` Int32
`Status` UInt32	NTSTATUS reference

Event ID 435: PowerEventCalloutWorker

Channel: Power
Task: PowerRequest
Opcode: Start

Fields #

Name	Description
`EventNumber` Int32
`Code` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 436: PowerEventCalloutWorker

Channel: Power
Task: PowerRequest
Opcode: Stop

Fields #

Name	Description
`EventNumber` Int32
`Code` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 437: Insert

Channel: Power
Task: PowerRequest
Opcode: Start

Fields #

Name	Description
`Address` UInt64
`EventNumber` Int32
`Code` UInt64

Event ID 438: Remove

Channel: Power
Task: PowerRequest

Fields #

Name	Description
`Address` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 439: Canceled

Channel: Power
Task: PowerRequest

Fields #

Name	Description
`Address` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 440: Completed

Channel: Power
Task: PowerRequest
Opcode: Stop

Fields #

Name	Description
`Address` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 441: WaitForVideoPortCalloutReady

Channel: Power
Task: PowerRequest
Opcode: Start

Fields #

Name	Description
`NeedWaitForRit` Boolean
`NeedPowerOnGdi` Boolean

Event ID 442: WaitForVideoPortCalloutReady

Channel: Power
Task: PowerRequest
Opcode: Stop

Event ID 443: DCompResourceMapping

Channel: Tracing
Level: Informational
Task: DCompResourceMapping

Fields #

Name	Description
`Channel` UInt32
`InternalHandle` UInt32
`ExternalHandle` UInt32
`InternalHandleAndChannel` UInt64
`ExternalHandleAndChannel` UInt64
`ResourceType` UInt32
`CreateShared` Boolean
`OpenShared` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 443,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1584,
      "thread_id": 1760
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:53.817Z",
    "version": 0
  },
  "event_data": {
    "Channel": 3,
    "CreateShared": false,
    "ExternalHandle": 225,
    "ExternalHandleAndChannel": 9223372049739677921,
    "InternalHandle": 226,
    "InternalHandleAndChannel": 12884902114,
    "OpenShared": true,
    "ResourceType": 196
  },
  "message": ""
}

Event ID 444: DCompResourcePropertyUpdate

Channel: Tracing
Level: Informational
Task: DCompResourcePropertyUpdate

Fields #

Name	Description
`Channel` UInt32
`InternalHandle` UInt32
`ExternalHandle` UInt32
`ResourceType` UInt32
`PropertyId` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 444,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10004,
      "thread_id": 7236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:35.314Z",
    "version": 0
  },
  "event_data": {
    "Channel": 58,
    "ExternalHandle": 39,
    "InternalHandle": 43,
    "PropertyId": 2,
    "ResourceType": 129
  },
  "message": ""
}

Event ID 445: DCompCommandType

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompCommandType
Opcode: win:Info

Fields #

Name	Description
`CommandType` UInt32
`status` UInt64	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 445,
    "version": 0,
    "level": 4,
    "task": 433,
    "opcode": 0,
    "keywords": "0x0000000400001000",
    "time_created": "2026-06-02T06:08:00.231+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 5396,
      "thread_id": 3744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CommandType": 11,
    "status": 0
  },
  "message": "DCompCommandType"
}

Event ID 446: DCompCommandsInBatch

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: DCompCommandsInBatch
Opcode: win:Info

Fields #

Name	Description
`CommandsCount` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 446,
    "version": 0,
    "level": 4,
    "task": 434,
    "opcode": 0,
    "keywords": "0x0000000400001000",
    "time_created": "2026-06-02T06:08:00.231+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 5396,
      "thread_id": 3744
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CommandsCount": 18
  },
  "message": "DCompCommandsInBatch"
}

Event ID 450: DCompCreateImplicitInteraction

Channel: Tracing
Task: DCompCreateImplicitInteraction

Fields #

Name	Description
`Channel` UInt32
`VisualInternalHandle` UInt32
`InteractionInternalHandle` UInt32
`VisualInternalHandleAndChannel` UInt64
`InteractionInternalHandleAndChannel` UInt64
`ResourceType` UInt32
`DefaultInteraction` Boolean
`Reason` UnicodeString

Event ID 451: DCompVisualSetInteraction

Channel: Tracing
Task: DCompVisualSetInteraction

Fields #

Name	Description
`Channel` UInt32
`VisualInternalHandle` UInt32
`InteractionInternalHandle` UInt32
`VisualInternalHandleAndChannel` UInt64
`InteractionInternalHandleAndChannel` UInt64

Event ID 452: UserHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: UserHandleOperation
Opcode: CreateHandle

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 452,
    "version": 0,
    "level": 4,
    "task": 443,
    "opcode": 28,
    "keywords": "0x0000020000000000",
    "time_created": "2026-06-02T05:32:25.757+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 1,
    "HandleValue": "0x4F006C",
    "OwnerProcessId": 14592,
    "SessionId": 0
  },
  "message": "UserHandleOperation"
}

Event ID 453: UserHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: UserHandleOperation
Opcode: DestroyHandle

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 453,
    "version": 0,
    "level": 4,
    "task": 443,
    "opcode": 29,
    "keywords": "0x0000020000000000",
    "time_created": "2026-06-02T05:32:25.759+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 3,
    "HandleValue": "0x8902DD",
    "OwnerProcessId": 14592,
    "SessionId": 0
  },
  "message": "UserHandleOperation"
}

Event ID 454: UserHandleOperationUpdateHandleOwner

Channel: Tracing
Level: Informational
Task: UserHandleOperation
Opcode: UpdateHandleOwner

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 454,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12544,
      "thread_id": 14108
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 30,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:31:34.659Z",
    "version": 0
  },
  "event_data": {
    "HandleType": 1,
    "HandleValue": "0x4AB0156",
    "OwnerProcessId": 1224,
    "SessionId": 0
  },
  "message": ""
}

Event ID 455: GdiHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: GdiHandleOperation
Opcode: CreateHandle

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 455,
    "version": 0,
    "level": 4,
    "task": 442,
    "opcode": 28,
    "keywords": "0x0000010000000000",
    "time_created": "2026-06-02T05:32:25.757+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 1,
    "HandleValue": "0xFFFFFFFF8B0102B7",
    "OwnerProcessId": 14592,
    "SessionId": 0
  },
  "message": "GdiHandleOperation"
}

Event ID 456: GdiHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: GdiHandleOperation
Opcode: DestroyHandle

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 456,
    "version": 0,
    "level": 4,
    "task": 442,
    "opcode": 29,
    "keywords": "0x0000010000000000",
    "time_created": "2026-06-02T05:32:25.757+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 1,
    "HandleValue": "0xFFFFFFFF92010287",
    "OwnerProcessId": 14592,
    "SessionId": 0
  },
  "message": "GdiHandleOperation"
}

Event ID 457: GdiHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: GdiHandleOperation
Opcode: UpdateHandleOwner

Fields #

Name	Description
`HandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 457,
    "version": 0,
    "level": 4,
    "task": 442,
    "opcode": 30,
    "keywords": "0x0000010000000000",
    "time_created": "2026-06-02T05:32:25.757+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 4,
    "HandleValue": "0xFFFFFFFF93040287",
    "OwnerProcessId": 0,
    "SessionId": 0
  },
  "message": "GdiHandleOperation"
}

Event ID 458: GdiHandleOperation

Channel: Tracing
Also via: realtime ETW trace
Level: Informational
Task: GdiHandleOperation
Opcode: TransformHandle

Fields #

Name	Description
`PreviousHandleValue` Pointer
`NewHandleValue` Pointer
`HandleType` UInt32
`SessionId` UInt32
`OwnerProcessId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 458,
    "version": 0,
    "level": 4,
    "task": 442,
    "opcode": 31,
    "keywords": "0x0000010000000000",
    "time_created": "2026-06-02T04:02:00.029+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3088
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "HandleType": 4,
    "NewHandleValue": "0xD8041846",
    "OwnerProcessId": 4304,
    "PreviousHandleValue": "0xD7041846",
    "SessionId": 1
  },
  "message": "GdiHandleOperation"
}

Event ID 459: WriteClipboard

Channel: Tracing
Task: WriteClipboard

Fields #

Name	Description
`Pid` UInt32
`ProcessCreateTime` FILETIME

Event ID 460: WriteClipboard460

Channel: Tracing
Level: Informational
Task: WriteClipboard

Fields #

Name	Description
`Pid` UInt32
`ProcessCreateTime` FILETIME

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 460,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4588,
      "thread_id": 12984
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:16.325Z",
    "version": 0
  },
  "event_data": {
    "Pid": 4588,
    "ProcessCreateTime": "2026-07-21 22:13:15.953Z"
  },
  "message": ""
}

Event ID 461: DwmVisRgnUpdate

Channel: Tracing
Level: Informational
Task: DwmVisRgnUpdate

Fields #

Name	Description
`hwnd` Pointer
`hwndParent` Pointer
`visRgnType` UInt32
`changed` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 461,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6468,
      "thread_id": 3520
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:33.230Z",
    "version": 0
  },
  "event_data": {
    "changed": false,
    "hwnd": "0x63F0340",
    "hwndParent": "0x10010",
    "visRgnType": 2
  },
  "message": ""
}

Event ID 462: DwmVisRgnDirty

Channel: Tracing
Level: Informational
Task: DwmVisRgnDirty

Fields #

Name	Description
`hwnd` Pointer
`hwndParent` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 462,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 9356,
      "thread_id": 10176
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:32.846Z",
    "version": 0
  },
  "event_data": {
    "hwnd": "0x201AE",
    "hwndParent": "0x10010"
  },
  "message": ""
}

Event ID 463: ReadClipboard

Channel: Tracing
Task: ReadClipboard

Fields #

Name	Description
`CallerPid` UInt32
`CallerProcessCreateTime` FILETIME
`OwnerPid` UInt32
`OwnerProcessCreateTime` FILETIME
`ClipboardSequenceNumber` UInt32

Event ID 500: FlipManagerCompleteTokenStart

Channel: Tracing
Task: FlipManagerCompleteToken
Opcode: Start

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`IFlip` Boolean
`IFlipCompleted` Boolean
`ConvertedToNonIflip` Boolean
`RequestDwmConfirm` Boolean
`RequestDwmExit` Boolean
`IndependentFlipCandidate` Boolean

Event ID 501: FlipManagerCompleteTokenStop

Channel: Tracing
Task: FlipManagerCompleteToken
Opcode: Stop

Fields #

Name	Description
`PresentId` UInt64

Event ID 502: FlipManagerTokenReleaseToFrameStart

Channel: Tracing
Task: FlipManagerTokenReleaseToFrame
Opcode: Start

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 503: FlipManagerTokenReleaseToFrameStop

Channel: Tracing
Task: FlipManagerTokenReleaseToFrame
Opcode: Stop

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 504: FlipManagerSignalPresentRetired

Channel: Tracing
Task: FlipManagerPresentConfirmed

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 505: FlipManagerPresentRetiredSignalOverride

Channel: Tracing
Task: FlipManagerPresentSignaled

Fields #

Name	Description
`FlipManagerId` UInt32
`SignalValue` UInt64
`Skipped` Boolean
`Status` UInt32	NTSTATUS reference

Event ID 506: FlipManagerPresentPosted

Channel: Tracing
Task: FlipManagerPresentPosted

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`PresentAtTimeHns` UInt64
`CurrentTimeHns` UInt64
`PresentAtTimeMinusCurrentTimeHns` Int64

Event ID 507: FlipManagerProducerSetContent

Channel: Tracing
Task: FlipManagerProducerSetContent

Fields #

Name	Description
`FlipManagerId` UInt32
`ContentResource` Pointer
`BufferResource` Pointer
`BufferIndex` UInt32

Event ID 508: FlipManagerBufferAvailable

Channel: Tracing
Task: FlipManagerBufferAvailable

Fields #

Name	Description
`FlipManagerId` UInt32
`BufferResource` Pointer
`available` Boolean

Event ID 509: FlipManagerAddBuffer

Channel: Tracing
Task: FlipManagerAddBuffer

Fields #

Name	Description
`FlipManagerId` UInt32
`BufferResource` Pointer
`hVidMmGlobalAlloc` Pointer

Event ID 510: FlipManagerRemoveBuffer

Channel: Tracing
Task: FlipManagerRemoveBuffer

Fields #

Name	Description
`FlipManagerId` UInt32
`BufferResource` Pointer

Event ID 511: FlipManagerContentRebind

Channel: Tracing
Task: FlipManagerContentRebind

Fields #

Name	Description
`Content` Pointer
`LUID` UInt64
`BindId` UInt64
`Displayable` Boolean
`BufferCount` UInt32

Event ID 512: FlipManagerPresentProcessed

Channel: Tracing
Task: FlipManagerPresentProcessed

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`FrameId` UInt64
`PresentAtTimeHns` UInt64
`FrameTimeHns` UInt64
`MaxAcceptableTargetTimeHns` UInt64
`PresentTimeMinusFrameTimeHns` Int64

Event ID 513: FlipManagerPresentDeferred

Channel: Tracing
Task: FlipManagerPresentDeferred

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`FrameId` UInt64
`PresentAtTimeHns` UInt64
`FrameTimeHns` UInt64
`MaxAcceptableTargetTimeHns` UInt64
`PresentTimeMinusFrameTimeHns` Int64

Event ID 514: FlipManagerPresentCanceled

Channel: Tracing
Task: FlipManagerPresentCanceled

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`FrameId` UInt64
`PresentAtTimeHns` UInt64
`FrameTimeHns` UInt64
`MaxAcceptableTargetTimeHns` UInt64
`PresentTimeMinusFrameTimeHns` Int64

Event ID 515: FlipManagerPresentIFlipSubmitted

Channel: Tracing
Task: FlipManagerPresentIFlipSubmitted

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`WasCanceled` Boolean

Event ID 516: FlipManagerPresentIFlipCompleted

Channel: Tracing
Task: FlipManagerPresentIFlipCompleted

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`Notify` Boolean
`WasCanceled` Boolean
`CompletedQpc` UInt64
`DurationQpc` UInt64

Event ID 517: FlipManagerPresentQueueDepth

Channel: Tracing
Task: FlipManagerPresentQueueDepth

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentQueueDepth` UInt64

Event ID 518: FlipManagerBindingStart

Channel: Tracing
Task: FlipManagerBinding
Opcode: Start

Fields #

Name	Description
`ContentResource` Pointer

Event ID 519: FlipManagerBinding

Channel: Tracing
Task: FlipManagerBinding

Fields #

Name	Description
`BufferResource` Pointer
`Index` UInt32

Event ID 520: FlipManagerBindingStop

Channel: Tracing
Task: FlipManagerBinding
Opcode: Stop

Event ID 521: FlipManagerAddContent

Channel: Tracing
Task: FlipManagerAddContent

Fields #

Name	Description
`FlipManagerId` UInt32
`ContentResource` Pointer

Event ID 522: FlipManagerContentFlip

Channel: Tracing
Task: FlipManagerContentFlip

Fields #

Name	Description
`ContentResource` Pointer
`LUID` UInt64
`BindId` UInt64
`FlipIndex` UInt32

Event ID 523: FlipManagerNoOpPresent

Channel: Tracing
Task: FlipManagerNoOpPresent

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 524: FlipManagerCancelPosted

Channel: Tracing
Task: FlipManagerCancelPosted

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 525: FlipManagerContentUnbind

Channel: Tracing
Task: FlipManagerContentUnbind

Fields #

Name	Description
`Content` Pointer
`LUID` UInt64

Event ID 526: FlipManagerCreate

Channel: Tracing
Task: FlipManagerCreate

Fields #

Name	Description
`FlipManagerId` UInt32

Event ID 527: FlipManagerDestroy

Channel: Tracing
Task: FlipManagerDestroy

Fields #

Name	Description
`FlipManagerId` UInt32

Event ID 528: TokenManagerDisableScanoutToken

Channel: Tracing
Task: TokenManagerDisableScanoutToken

Fields #

Name	Description
`LUID` UInt64
`BindId` UInt64

Event ID 529: FlipManagerLost

Channel: Tracing
Task: FlipManagerLost

Fields #

Name	Description
`FlipManagerId` UInt32

Event ID 530: FlipManagerCanceledPresentShown

Channel: Tracing
Task: FlipManagerCanceledPresentShown

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`Reason` UInt32

Event ID 531: FlipManagerUpdateExpectedConsumerPresentId

Channel: Tracing
Task: FlipManagerUpdateExpectedConsumerPresentId

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`Reason` UInt32

Event ID 532: FlipManagerPresentSkipped

Channel: Tracing
Task: FlipManagerPresentSkipped

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`FrameId` UInt64
`PresentAtTimeHns` UInt64
`FrameTimeHns` UInt64
`MaxAcceptableTargetTimeHns` UInt64
`PresentTimeMinusFrameTimeHns` Int64

Event ID 533: FlipManagerRemoveContent

Channel: Tracing
Task: FlipManagerRemoveContent

Fields #

Name	Description
`FlipManagerId` UInt32
`ContentResource` Pointer

Event ID 534: FlipManagerPresentIFlipPurgePreviousPresents

Channel: Tracing
Task: FlipManagerPresentIFlipPurgePreviousPresents

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 535: FlipManagerDiscardPresentAfterDestroy

Channel: Tracing
Task: FlipManagerDiscardPresentAfterDestroy

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64

Event ID 536: FlipManagerWaitForFrameRenderingComplete

Channel: Operational
Task: FlipManagerWaitForFrameRenderingComplete

Fields #

Name	Description
`FlipManagerId` UInt32
`PresentId` UInt64
`FrameId` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 537: FlipManagerWaitForFrameFlipAway

Channel: Operational
Task: FlipManagerWaitForFrameFlipAway

Fields #

Name	Description
`FlipManagerId` UInt32
`adapterLuid` UInt64
`fenceValue` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 538: FlipManagerFlipAwayFenceCreate

Channel: Operational
Task: FlipManagerFlipAwayFenceCreate

Fields #

Name	Description
`fenceId` UInt64
`displayAdapterLuid` UInt64

Event ID 539: FlipManagerFlipAwayFenceDestroy

Channel: Operational
Task: FlipManagerFlipAwayFenceDestroy

Fields #

Name	Description
`fenceId` UInt64
`displayAdapterLuid` UInt64

Event ID 1000: task_01000

Channel: Operational
Level: Informational
Opcode: Info

Fields #

Name	Description
`eventMin` UInt32
`eventMax` UInt32
`idEventProcess` UInt32
`idEventThread` UInt32
`Flags` UInt32
`HookInstance` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Win32k/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 6848,
      "thread_id": 12608
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Win32k",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:13:31.325Z",
    "version": 0
  },
  "event_data": {
    "Flags": 0,
    "HookInstance": "0x3430141",
    "eventMax": 2147483410,
    "eventMin": 2147483408,
    "idEventProcess": 0,
    "idEventThread": 0
  },
  "message": ""
}

Event ID 1001: RegisterRawInputDevices

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Fires when RegisterRawInputDevices is called. The Flags field indicates registration mode; RIDEV_INPUTSINK (0x100) enables background capture. Captured via the AuditApiCalls ETW keyword (0x400) on the Microsoft-Windows-Win32k provider.

Fields #

Name	Description
`ReturnValue` UInt32	Return value of RegisterRawInputDevices (1=success)
`UsagePage` UInt16	HID usage page (1 = Generic Desktop)
`Usage` UInt16	HID usage (2=Mouse, 6=Keyboard)
`Flags` UInt32	Registration flags; RIDEV_INPUTSINK=0x100 indicates background input capture
`hwndTarget` Pointer	Target window handle (required when RIDEV_INPUTSINK is set)
`ThreadStartAddress` Pointer
`ThreadCreateTime` FILETIME
`ThreadId` UInt32
`cWindows` UInt32
`cVisWindows` UInt32
`ThreadInfoFlags` UInt64
`ProcessId` UInt32
`ProcessCreateTime` FILETIME
`ProcessStartKey` UInt64
`ThreadStartAddressMappedModuleName` UnicodeString	Mapped module at the calling thread's start address
`ThreadStartAddressQueryResult` UInt32
`ThreadStartAddressVadAllocationBase` Pointer
`ThreadStartAddressVadAllocationProtect` UInt32
`ThreadStartAddressVadRegionType` UInt32
`ThreadStartAddressVadRegionSize` Pointer
`ThreadStartAddressVadProtect` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 1001,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000400",
    "time_created": "2026-06-08T20:01:29.588+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6504,
      "thread_id": 556
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ReturnValue": 1,
    "UsagePage": 1,
    "Usage": 6,
    "Flags": 0,
    "hwndTarget": "0x0",
    "ThreadStartAddress": "0x7FF97E3DDCB0",
    "ThreadId": 556,
    "cWindows": 0,
    "cVisWindows": 0,
    "ThreadInfoFlags": 0,
    "ProcessId": 6504,
    "ThreadStartAddressMappedModuleName": "\\Device\\HarddiskVolume4\\Windows\\System32\\ntdll.dll",
    "ThreadStartAddressQueryResult": 0,
    "ThreadStartAddressVadAllocationBase": "0x7FF97E360000",
    "ThreadStartAddressVadAllocationProtect": 128,
    "ThreadStartAddressVadRegionType": 16777216,
    "ThreadStartAddressVadRegionSize": "0xF8000",
    "ThreadStartAddressVadProtect": 32
  },
  "message": ""
}

Event ID 1002: SetWindowsHookEx

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Fires when SetWindowsHookEx is called. FilterType carries the hook identifier; WH_KEYBOARD_LL (0xD) is the low-level keyboard hook used by keyloggers. pfnFilterProc is the callback address — unbacked or shellcode-range values indicate injection. Captured via the AuditApiCalls ETW keyword (0x400) on the Microsoft-Windows-Win32k provider.

Fields #

Name	Description
`FilterType` UInt32	Windows hook type (WH_KEYBOARD_LL=0xD, WH_MOUSE_LL=0xE, WH_KEYBOARD=0x2). 0xFFFFFFFF seen for internal system hooks.
`pstrLib` UnicodeString	DLL path when hook is loaded from a remote DLL; NULL for in-process hooks
`hmod` Pointer	Module handle of the hook DLL (0x0 for in-process hooks)
`pfnFilterProc` Pointer	Address of the hook callback procedure; unbacked addresses indicate reflectively-loaded code
`ReturnValue` UInt32	Hook handle returned by SetWindowsHookEx (HHOOK)

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 1002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000400",
    "time_created": "2026-06-08T20:01:29.617+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 6504,
      "thread_id": 556
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FilterType": 13,
    "pstrLib": "NULL",
    "hmod": "0x0",
    "pfnFilterProc": "0x1EC341D6C0C",
    "ReturnValue": 3408085
  },
  "message": ""
}

Event ID 1003: GetAsyncKeyState

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Fires when a background process calls GetAsyncKeyState while another process holds the foreground. BackgroundCallCount accumulates calls since the last key event; MsSinceLastKeyEvent is the interval since the previous key press. Captured via the AuditApiCalls ETW keyword (0x400) on the Microsoft-Windows-Win32k provider. Requires an interactive desktop session with active keyboard input.

Fields #

Name	Description
`PID` UInt32	Process ID of the background caller polling keyboard state
`MsSinceLastKeyEvent` UInt32	Milliseconds elapsed since the last key press event in the session
`BackgroundCallCount` UInt32	Number of GetAsyncKeyState calls made by this background process since the last key event

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 1003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000400",
    "time_created": "2026-06-08T21:12:41.337+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 808,
      "thread_id": 928
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PID": 11716,
    "MsSinceLastKeyEvent": 0,
    "BackgroundCallCount": 2
  },
  "message": ""
}

Event ID 2000: task_02000

Channel: Operational
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Fields #

Name	Description
`Flags` UInt32
`ProcessId` UInt32
`ProcessCreateTime` FILETIME
`ProcessStartKey` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Win32k",
    "guid": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}",
    "event_source_name": "",
    "event_id": 2000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000004000000000",
    "time_created": "2026-06-02T05:32:25.771+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{8C416C79-D49B-4F01-A467-E56D3AA8234C}"
    },
    "execution": {
      "process_id": 14592,
      "thread_id": 10500
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": 26,
    "ProcessCreateTime": "2026-06-02 05:32:25.725Z",
    "ProcessId": 14592,
    "ProcessStartKey": 6755399441100732
  },
  "message": ""
}

Event ID 10002: WindowLayoutChangeStop

Channel: Tracing
Task: WindowLayoutChange
Opcode: Stop

Fields #

Name	Description
`hWnd` UInt32
`Packed_High_Height_Low_Width` UInt32
`PRAID` UnicodeString
`PackageFullName` UnicodeString

Provenance

ETW provider GUID {8C416C79-D49B-4F01-A467-E56D3AA8234C}

Defined in win32kbase.sys, the binary that emits these events.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.4893, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1000, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4893, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1000, captured 2026-06-02 — Manifest XML pack, 2.0 MB
JD-WIN11-22H2-1-native-20260719, sample captured from a live trace, binary version 10.0.22621.6060, captured 2026-07-19
Native ETL capture of controlled window and input workloads; identifiers were sanitized in catalog examples.