detection.wiki

Microsoft-Windows-WindowsBackup

EventTitleChannelSampleRule
100Windows Backup statusActionCenterNN
101Windows Backup statusActionCenterNN

Event ID 100: Windows Backup status

#
Channel
ActionCenter

Fields #

NameDescription
hc_stateid UInt32
pwszTimeStamp UnicodeString

Event ID 101: Windows Backup status

#
Channel
ActionCenter

Fields #

NameDescription
hc_stateid UInt32

Provenance

ETW provider GUID 01979c6a-42fa-414c-b8aa-eee2c8202018

Defined in sdclt.exe, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB