Microsoft-Windows-Windeploy

Event	Title	Channel	Sample	Rule
1001	Windeploy.	Analytic	N	N
1002	Windeploy.	Analytic	N	N
2001	Launching external process "CommandLine".	Analytic	N	N
2002	External process "Command" exited with status ExitCode.	Analytic	N	N
2003	Failed to start external process "Command" with status ExitCode.	Analytic	N	N
3001	Running user-provided script: "CommandLine".	Analytic	N	N
3002	Successfully executed script: "Command".	Analytic	N	N
3003	Failed to execute script: "Command".	Analytic	N	N

Event ID 1001: Windeploy.

Channel: Analytic
Task: RunWindeploy
Opcode: Start

Description

Windeploy.exe is running.

Message #

Windeploy.exe is running.

Fields #

Name	Description
`CommandLine` UnicodeString

Event ID 1002: Windeploy.

Channel: Analytic
Task: RunWindeploy
Opcode: Stop

Description

Windeploy.exe exiting with response Response and status ErrorCode.

Message #

Windeploy.exe exiting with response %1 and status %2.

Fields #

Name	Description
`Response` UInt32
`ErrorCode` UInt32

Event ID 2001: Launching external process "CommandLine".

Channel: Analytic
Task: Launchandwaitforexternalprocess
Opcode: Start

Message #

Launching external process "%1".

Fields #

Name	Description
`CommandLine` UnicodeString

Event ID 2002: External process "Command" exited with status ExitCode.

Channel: Analytic
Task: Launchandwaitforexternalprocess
Opcode: Stop

Message #

External process "%1" exited with status %2.

Fields #

Name	Description
`Command` UnicodeString
`ExitCode` UInt32

Event ID 2003: Failed to start external process "Command" with status ExitCode.

Channel: Analytic
Task: Launchandwaitforexternalprocess
Opcode: Stop

Message #

Failed to start external process "%1" with status %2.

Fields #

Name	Description
`Command` UnicodeString
`ExitCode` UInt32

Event ID 3001: Running user-provided script: "CommandLine".

Channel: Analytic
Task: Runuser_providedscript
Opcode: Start

Message #

Running user-provided script: "%1".

Fields #

Name	Description
`CommandLine` UnicodeString

Event ID 3002: Successfully executed script: "Command".

Channel: Analytic
Task: Runuser_providedscript
Opcode: Stop

Description

Successfully executed script: "Command". Exit code is ExitCode.

Message #

Successfully executed script: "%1". Exit code is %2.

Fields #

Name	Description
`Command` UnicodeString
`ExitCode` UInt32

Event ID 3003: Failed to execute script: "Command".

Channel: Analytic
Task: Runuser_providedscript
Opcode: Stop

Description

Failed to execute script: "Command".Exit code is ExitCode.

Message #

Failed to execute script: "%1".Exit code is %2.

Fields #

Name	Description
`Command` UnicodeString
`ExitCode` UInt32

Provenance

ETW provider GUID 75ebc33e-c8ae-4f93-9ca1-683a53e20cb6

Defined in windeploy.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB