MSDAPRST.1
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 17 | MSDAPRST.1 formatted output (A) | ETW Trace | N | N |
| 18 | MSDAPRST.1 formatted output (W) | ETW Trace | N | N |
Provenance
ETW provider GUID {64A552E0-6C60-B907-E59C-10F1DFF76B0D}
- WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
- WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: Bid2Etw_MSDAPRST_1
- Win11-26200.6584, schema read from the WMI MOF class, captured 2026-06-02
MOF class: Bid2Etw_MSDAPRST_1