winsrvext
4 events across 2 channels
Event ID 100: Process ProcessImageFileNameWin32 is delaying system shutdown after ShutdownDuration milliseconds.
#Event ID 100: Process ProcessImageFileNameWin32 is delaying system shutdown after ShutdownDuration milliseconds
#Description
Process is delaying system shutdown after milliseconds.
Fields #
| Name | Description |
|---|---|
ProcessImageFileNameWin32 UnicodeString | |
ShutdownDuration UInt32 |
Example Event #
{
"system": {
"provider": "winsrvext",
"guid": "{2B9537F0-4A90-557B-1313-D0CE2827A94A}",
"event_source_name": "",
"event_id": 100,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-16T02:04:06.6335583+00:00",
"event_record_id": 802,
"correlation": {},
"execution": {
"process_id": 952,
"thread_id": 10424
},
"channel": "System",
"computer": "WIN11-25H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"ProcessImageFileNameWin32": "C:\\Windows\\explorer.exe",
"ShutdownDuration": "5000"
},
"message": "Process C:\\Windows\\explorer.exe is delaying system shutdown after 5000 milliseconds."
}
Event ID 101: Process ProcessImageFileNameWin32 from package PackageFullName is delaying system shutdown after ShutdownDuration milliseconds.
#Event ID 101: Process ProcessImageFileNameWin32 from package PackageFullName is delaying system shutdown after ShutdownDuration milliseconds
#Description
Process from package is delaying system shutdown after milliseconds.
Fields #
| Name | Description |
|---|---|
ProcessImageFileNameWin32 UnicodeString | |
PackageFullName UnicodeString | |
ShutdownDuration UInt32 |
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 2b9537f0-4a90-557b-1313-d0ce2827a94a
Defined in winsrvext.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3624, captured 2026-06-02