Microsoft-Windows-WSC-SRV
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 101 | StartServiceStart | Diagnostic | N | N |
| 102 | StartService | Diagnostic | N | N |
| 103 | StartServiceStop | Diagnostic | N | N |
| 104 | StopServiceStart | Diagnostic | N | N |
| 105 | StopServiceStop | Diagnostic | N | N |
| 106 | LaunchUIStart | Diagnostic | N | N |
| 107 | LaunchUIStop | Diagnostic | N | N |
| 108 | EnableFirewallStart | Diagnostic | N | N |
| 109 | EnableFirewallStop | Diagnostic | N | N |
| 110 | EnableAntiSpywareStart | Diagnostic | N | N |
| 111 | EnableAntiSpywareStop | Diagnostic | N | N |
| 112 | LaunchDialogStart | Diagnostic | N | N |
| 113 | LaunchDialogStop | Diagnostic | N | N |
| 114 | GenericMarkerStart | Diagnostic | N | N |
| 115 | GenericMarkerStart115 | Diagnostic | N | N |
| 116 | GenericMarkerStart116 | Diagnostic | N | N |
| 117 | GenericMarkerStop | Diagnostic | N | N |
| 118 | GenericMarkerStop118 | Diagnostic | N | N |
| 119 | GenericMarkerStop119 | Diagnostic | N | N |
Event ID 101: StartServiceStart
#Event ID 102: StartService
#Event ID 103: StartServiceStop
#Event ID 104: StopServiceStart
#Event ID 105: StopServiceStop
#Event ID 106: LaunchUIStart
#Event ID 107: LaunchUIStop
#Event ID 108: EnableFirewallStart
#Event ID 109: EnableFirewallStop
#Event ID 110: EnableAntiSpywareStart
#Event ID 111: EnableAntiSpywareStop
#Event ID 112: LaunchDialogStart
#Event ID 113: LaunchDialogStop
#Event ID 114: GenericMarkerStart
#Event ID 115: GenericMarkerStart115
#Event ID 116: GenericMarkerStart116
#Event ID 117: GenericMarkerStop
#Event ID 118: GenericMarkerStop118
#Event ID 119: GenericMarkerStop119
#Provenance
ETW provider GUID 5857d6ca-9732-4454-809b-2a87b70881f8
Defined in wscui.cpl, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB