From 4c6c1639eee9e3a1bb2cb805fbd1f0373e785990 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 12 Nov 2020 14:30:55 +0000 Subject: [PATCH 01/41] update to privacy events --- ...ndows-diagnostic-events-and-fields-1703.md | 87 ++- ...ndows-diagnostic-events-and-fields-1709.md | 87 ++- ...ndows-diagnostic-events-and-fields-1803.md | 104 +++- ...ndows-diagnostic-events-and-fields-1809.md | 406 ++++++++++---- ...ndows-diagnostic-events-and-fields-1903.md | 518 +++++++++++++++++- ...-diagnostic-data-events-and-fields-2004.md | 284 ++++++++-- 6 files changed, 1292 insertions(+), 194 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index d3555a0e8a..5a75aeb713 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -2490,7 +2490,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. See [HWID](#hwid). - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.asp - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -2678,6 +2678,31 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** The configured memory slot speed in MHz. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. @@ -6417,6 +6442,62 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete + +This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that became complete. +- **ResultId** The final result of the interaction campaign. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** The overall result generated by the evaluation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 2be76e6660..f4bfc0d442 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -2512,7 +2512,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -2712,6 +2712,31 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** The configured memory slot speed in MHz. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. @@ -6724,6 +6749,62 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete + +This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that became complete. +- **ResultId** The final result of the interaction campaign. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index b9030aba9a..a5c2718237 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -3470,7 +3470,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -3675,6 +3675,23 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** The configured memory slot speed in MHz. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync This diagnostic event indicates a new sync is being generated for this object type. @@ -4574,6 +4591,31 @@ The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties + +This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. + +The following fields are available: + +- **nodeId** Constructed from nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. +- **nodeOperatingSystem** A user friendly description of the node's OS version. +- **nodeOSVersion** A major or minor build version string for the node's OS. +- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyperconverged cluster. +- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. + + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -8373,6 +8415,62 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete + +This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that became complete. +- **ResultId** The final result of the interaction campaign. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 12bf3f543c..4795516628 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -2551,19 +2551,6 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common Data Fields - -### Ms.Device.DeviceInventoryChange - -Describes the installation state for all hardware and software components available on a particular device. - -The following fields are available: - -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events @@ -2795,6 +2782,12 @@ The following fields are available: ## Diagnostic data events +### Microsoft.Windows.Test.WindowsCoreTelemetryTestProvider.WindowsCoreTelemetryTestEvent + +This is an internal-only test event used to validate the utc.app and telemetry.asm-windowsdefault settings and namespaces before publishing. The provider of this event is assigned to the Windows Core Telemetry group provider in order to test. The data collected with this event is used to keep Windows performing properly. + + + ### TelClientSynthetic.AbnormalShutdown_0 This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -3307,6 +3300,19 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator WaitForRebootUi call. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. @@ -3579,82 +3585,149 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEnteringState + +This event indicates that DTUNotificationUX has started processing a workflow state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** The coordinator version of Direct To Update. +- **CV** Correlation vector. +- **State** State of the workflow. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEvaluation + +This event indicates that Applicability DLL ran a set of applicability tests. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** The enumeration code of action that was handled. +- **ActiveTestResults** The bitmask results of applicability tests. +- **ActiveTestsRun** The bitmask of applicability tests that were run. +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** The coordinator version of Direct To Update. +- **CV** Correlation vector. +- **FullTestResults** The bitmask of results of applicability tests. +- **FullTestsRun** The bitmask of applicability tests that were run. +- **SuppressedTests** The bitmask of applicability tests that were unable to run due to suppression caused by the configuration settings. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEvaluationError + +This event indicates that Applicability DLL failed on a test. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **FailedTest** The enumeration code of the test that failed. +- **HRESULT** An error (if any) that occurred. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExit + +This event indicates that DTUNotificationUX has finished execution. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **HRESULTCausingExit** HRESULT Causing an abnormal exit, or S_OK for normal exits. +- **ProcessExitCode** The exit code that DTUNotificationUX returns to DTUCoordinator. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExitingState + +This event indicates that DTUNotificationUX has stopped processing a workflow state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **HRESULT** Error (if any) that occurred. +- **NextState** Next workflow state we will enter. +- **State** The state of the workflow. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXFinalAcceptDialogDisplayed + +This event indicates that the Final Accept dialog has been shown. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **EnterpriseAttribution** If true, the user is told that the enterprise managed the reboot. +- **HRESULT** Error (if any) that occurred. +- **UserResponse** The enumeration code indicating the user response to a dialog. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXFirstAcceptDialogDisplayed + +This event indicates that the First Accept dialog has been shown. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **EnterpriseAttribution** If true, the user is told that the enterprise managed the reboot. +- **HRESULT** Error (if any) that occurred. +- **UserResponse** Enumeration code indicating the user response to a dialog. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXLaunch + +This event indicates that DTUNotificationUX has launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CommandLine** Command line passed to DTUNotificationUX. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXUserCannotReboot + +This event indicates that the user has no restart privilege. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXUserInitatedRestartFailed + +This event indicates that the system failed to restart. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + ## DISM events -### Microsoft.Windows.StartRep.DISMLatesInstalledLCU - -This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM - - -### Microsoft.Windows.StartRep.DISMPendingInstall - -This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **DISMPendingInstallPackageName** The name of the pending package. - - -### Microsoft.Windows.StartRep.DISMRevertPendingActions - -This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The result from the operation to revert pending packages. - - -### Microsoft.Windows.StartRep.DISMUninstallLCU - -This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The error code that is being reported by DISM. - - -### Microsoft.Windows.StartRep.SRTRepairActionEnd - -This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The error code that is reported. -- **SRTRepairAction** The action that was taken by SRT. - - -### Microsoft.Windows.StartRep.SRTRepairActionStart - -This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **SRTRepairAction** The action that is being taken by SRT. - - -### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd - -This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The final result code for the root cause operation. -- **SRTRootCauseDiag** The name of the root cause operation that ran. - - -### Microsoft.Windows.StartRep.SRTRootCauseDiagStart - -This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **SRTRootCauseDiag** The name of a specific diagnostic. - - ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -3682,6 +3755,15 @@ The following fields are available: - **errorCode** The result code returned by the event. +### Microsoft.Windows.StartRepairCore.DISMUninstallLCU + +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + ### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -4332,7 +4414,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). The following fields are available: @@ -4423,7 +4505,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.De~ice.DeviceInventoryChange](#msde~icedeviceinventorychange). The following fields are available: @@ -4573,11 +4655,19 @@ The following fields are available: - **Manufacturer** Name of the DRAM manufacturer - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. -- **Speed** MHZ the memory is currently configured & used at. +- **Speed** The configured memory slot speed in MHz. - **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. - **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync This diagnostic event indicates a new sync is being generated for this object type. @@ -4929,7 +5019,7 @@ The following fields are available: This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChangd](#msdevicedeviceinventorychangd). The following fields are available: @@ -4955,15 +5045,6 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ## Kernel events -### IO - -This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup. - -The following fields are available: - -- **BytesRead** The total number of bytes read from or read by the OS upon system startup. -- **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. @@ -5543,7 +5624,7 @@ The following fields are available: - **winInetError** The HResult of the operation. -## ONNX runtime events +## Other events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5570,6 +5651,94 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Size of the battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -7601,18 +7770,6 @@ The following fields are available: - **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise - **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). -### Value - -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. - -The following fields are available: - -- **Algorithm** The algorithm used to preserve privacy. -- **DPRange** The upper bound of the range being measured. -- **DPValue** The randomized response returned by the client. -- **Epsilon** The level of privacy to be applied. -- **HistType** The histogram type if the algorithm is a histogram algorithm. -- **PertProb** The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”. ## Windows Error Reporting MTT events @@ -8013,7 +8170,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -8028,7 +8185,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -8044,7 +8201,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -9077,6 +9234,19 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackCause** The reason for UUP fall back. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 1623bf2d24..76b3ba247f 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 --- @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -486,11 +486,18 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_19H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_21H1** The count of the number of this particular object type present on this device. - **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **DecisionTest_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_RS3** The count of the number of this particular object type present on this device. +- **DecisionTest_RS4** The count of the number of this particular object type present on this device. +- **DecisionTest_RS5** The count of the number of this particular object type present on this device. +- **DecisionTest_TH1** The count of the number of this particular object type present on this device. +- **DecisionTest_TH2** The count of the number of this particular object type present on this device. - **InventoryApplicationFile** The count of the number of this particular object type present on this device. - **InventoryDeviceContainer** A count of device container objects in cache. - **InventoryDevicePnp** A count of device Plug and Play objects in cache. @@ -968,6 +975,17 @@ The following fields are available: - **MigApplication** Is there a matching info block with a mig for the current mode of upgrade? +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove + +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -2762,6 +2780,12 @@ This event reports the results of deferring Windows Content to keep Windows up t ## Diagnostic data events +### Microsoft.Windows.Test.WindowsCoreTelemetryTestProvider.WindowsCoreTelemetryTestEvent + +This is an internal-only test event used to validate the utc.app and telemetry.asm-windowsdefault settings and namespaces before publishing. The provider of this event is assigned to the Windows Core Telemetry group provider in order to test. The data collected with this event is used to keep Windows performing properly + + + ### TelClientSynthetic.AbnormalShutdown_0 This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -3101,6 +3125,194 @@ This event is a low latency health alert that is part of the 4Nines device healt ## Direct to update events +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure + +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector +- **hResult** HRESULT of the failure + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess + +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure + +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess + +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess + +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess + +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure + +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess + +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack + +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **DeployPhase** Current Deploy Phase. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess + +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection + +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **rebootUiSelection** Selection on the Reboot UI. + + +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess + +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. @@ -3115,6 +3327,187 @@ The following fields are available: - **hResult** HRESULT of the failure +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess + +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ApplicabilityResult** The result of the applicability check. +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess + +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ApplicabilityResult** The result code indicating whether the update is applicable. +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **CV_new** New correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **CV_new** New correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded + +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure + +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **DownloadAndExtractCabFunction_failureReason** Reason why the update download and extract process failed. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess + +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess + +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **DownloadAndExtractCabFunction_hResult** HRESULT of the download and extract. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess + +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **DownloadAndExtractCabFunction_hResult** HRESULT of the download and extraction. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess + +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the update campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess + +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + ## DISM events ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU @@ -3655,7 +4048,7 @@ The following fields are available: This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInven|oryChange](#msdevicedeviceinven|orychange). The following fields are available: @@ -3758,7 +4151,7 @@ The following fields are available: This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DmviceInventoryChange](#msdevicedmviceinventorychange). The following fields are available: @@ -3769,7 +4162,7 @@ The following fields are available: This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) +This event includes fields from [Ms.Device,DeviceInventoryChange](#msdevice,deviceinventorychange). The following fields are available: @@ -3929,7 +4322,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device @@ -4126,7 +4519,7 @@ The following fields are available: - **Manufacturer** Name of the DRAM manufacturer - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. -- **Speed** MHZ the memory is currently configured & used at. +- **Speed** The configured memory slot speed in MHz. - **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. - **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. @@ -4653,6 +5046,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4680,6 +5074,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4708,6 +5103,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4735,6 +5131,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4767,6 +5164,8 @@ The following fields are available: - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. - **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. @@ -4835,6 +5234,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -5065,7 +5465,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## ONNX runtime events +## Other events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5092,7 +5492,20 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Surface events +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Hardware level data about battery performance. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + ### Microsoft.Surface.Health.Binary.Prod.McuHealthLog @@ -5105,7 +5518,6 @@ The following fields are available: - **healthLogSize** 4KB. - **productId** Identifier for product model. -## Update health events ### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked @@ -5286,6 +5698,7 @@ The following fields are available: - **CV** Correlation vector. - **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. - **ExpeditePolicyId** The policy Id of the expedite request. - **ExpediteResult** Boolean value for success or failure. - **ExpediteUpdaterCurrentUbr** The UBR of the device. @@ -5347,6 +5760,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved + +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. @@ -5418,6 +5843,24 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. @@ -5429,6 +5872,28 @@ The following fields are available: - **PackageVersion** Current package version of UpdateHealthTools. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin + +The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The global event counter counts the total events for the provider. +- **PackageVersion** The version for the current package. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -6315,6 +6780,7 @@ The following fields are available: - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeBundle** Cumulative size (in bytes) of the downloaded bundle content. - **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. - **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. - **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. @@ -6324,11 +6790,13 @@ The following fields are available: - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique ID for each flight. - **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **NumberOfHops** Number of intermediate packages used to reach target version. - **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). - **PackageCategoriesSkipped** Indicates package categories that were skipped, if applicable. - **PackageCountOptional** Number of optional packages requested. - **PackageCountRequired** Number of required packages requested. - **PackageCountTotal** Total number of packages needed. +- **PackageCountTotalBundle** Total number of bundle packages. - **PackageCountTotalCanonical** Total number of canonical packages. - **PackageCountTotalDiff** Total number of diff packages. - **PackageCountTotalExpress** Total number of express packages. @@ -7533,6 +8001,12 @@ This event indicates that the Quality Rollback process has started. The data col +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded + +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled @@ -8407,6 +8881,17 @@ The following fields are available: - **wuDeviceid** WU device ID. +### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkNonSystem + +This event ensures that only callers with system or admin privileges are allowed to schedule work through Windows Update Universal Orchestrator. The data collected with this event is used to help keep Windows product and service secure. + +The following fields are available: + +- **updaterCmdLine** Updater Command Line. +- **updaterId** Updater ID. +- **wuDeviceid** Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. @@ -8504,6 +8989,19 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackCause** The reason for UUP fall back. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index b1c3b25c91..1bd826bfd0 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 11/12/2020 --- @@ -264,9 +264,18 @@ The following fields are available: - **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. +- **DecisionTest_19H1** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_21H1** The count of the number of this particular object type present on this device. - **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. +- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. +- **DecisionTest_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_RS3** The count of the number of this particular object type present on this device. +- **DecisionTest_RS4** The count of the number of this particular object type present on this device. +- **DecisionTest_RS5** The count of the number of this particular object type present on this device. +- **DecisionTest_TH1** The count of the number of this particular object type present on this device. +- **DecisionTest_TH2** The count of the number of this particular object type present on this device. - **InventoryApplicationFile** The count of the number of this particular object type present on this device. - **InventoryLanguagePack** The count of the number of this particular object type present on this device. - **InventoryMediaCenter** The count of the number of this particular object type present on this device. @@ -488,6 +497,17 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -754,6 +774,17 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1393,23 +1424,6 @@ The following fields are available: ## Audio endpoint events -### MicArrayGeometry - -This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. - -The following fields are available: - -- **MicCoords** The location and orientation of the microphone element. -- **usFrequencyBandHi** The high end of the frequency range for the microphone. -- **usFrequencyBandLo** The low end of the frequency range for the microphone. -- **usMicArrayType** The type of the microphone array. -- **usNumberOfMicrophones** The number of microphones in the array. -- **usVersion** The version of the microphone array specification. -- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). -- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). -- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). -- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). - ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -1638,7 +1652,7 @@ The following fields are available: - **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. - **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. - **OSEdition** Retrieves the version of the current OS. -- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc - **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). - **OSSKU** Retrieves the Friendly Name of OS Edition. - **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. @@ -1786,7 +1800,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: - **CalendarType** The calendar identifiers that are used to specify different calendars. -- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. - **LocaleName** Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function. - **LongDateFormat** The long date format the user has selected. @@ -2098,18 +2112,6 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common data fields - -### Ms.Device.DeviceInventoryChange - -Describes the installation state for all hardware and software components available on a particular device. - -The following fields are available: - -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. ## Component-based servicing events @@ -3463,11 +3465,19 @@ The following fields are available: - **Manufacturer** Name of the DRAM manufacturer. - **Model** Model and submodel of the memory. - **Slot** Slot the DRAM is plugged into the motherboard. -- **Speed** MHZ the memory is currently configured and used at. +- **Speed** The configured memory slot speed in MHz. - **Type** Reports DDR, etc. as an enumeration value per DMTF SMBIOS standard version 3.3.0, section 7.18.2. - **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync This diagnostic event indicates a new sync is being generated for this object type. @@ -3939,6 +3949,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -3966,6 +3977,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -3993,6 +4005,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4020,6 +4033,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4120,6 +4134,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4361,6 +4376,23 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +## Other events + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Battery Performance data. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Size of the battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5071,6 +5103,24 @@ The following fields are available: - **PackageVersion** The package version label. +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + ### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5087,6 +5137,22 @@ The following fields are available: - **PackageVersion** The package version label. +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + ### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. @@ -5195,6 +5261,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved + +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. @@ -5306,6 +5384,17 @@ The following fields are available: - **PackageVersion** Current package version of UpdateHealthTools. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin + +This event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The global event counter for counting total events for the provider. +- **PackageVersion** The version for the current package. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5374,6 +5463,7 @@ The following fields are available: - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeBundle** Cumulative size (in bytes) of the downloaded bundle content. - **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. - **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. - **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. @@ -5383,11 +5473,13 @@ The following fields are available: - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique ID for each flight. - **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **NumberOfHops** Number of intermediate packages used to reach target version. - **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). - **PackageCategoriesSkipped** Indicates package categories that were skipped, if applicable. - **PackageCountOptional** Number of optional packages requested. - **PackageCountRequired** Number of required packages requested. - **PackageCountTotal** Total number of packages needed. +- **PackageCountTotalBundle** Total number of bundle packages. - **PackageCountTotalCanonical** Total number of canonical packages. - **PackageCountTotalDiff** Total number of diff packages. - **PackageCountTotalExpress** Total number of express packages. @@ -5979,6 +6071,19 @@ The following fields are available: - **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. +### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties + +This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. + +The following fields are available: + +- **nodeId** Constructed from nodeTypeId concatenated with the hostname or IP address that gateway uses to connecting to this node. +- **nodeOperatingSystem** A user friendly description of the node's OS version. +- **nodeOSVersion** A major or minor build version string for the node's OS. +- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. +- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. + + ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed @@ -6052,7 +6157,7 @@ The following fields are available: ### Microsoft.Windows.Sense.Client.PerformanceScript.OnboardingScript -This event is triggered whenever Microsoft Defender for Endpoint onboarding script is run. The data collected with this event is used to keep Windows performing properly. +This event is triggered whenever WDATP onboarding script is run. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6584,6 +6689,7 @@ The following fields are available: - **cdnUrl** Url of the source Content Distribution Network (CDN). - **congestionPrevention** Indicates a download may have been suspended to prevent network congestion. - **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **doErrorCode** The Delivery Optimization error code that was returned. - **downlinkBps** The maximum measured available download bandwidth (in bytes per second). - **downlinkUsageBps** The download speed (in bytes per second). - **downloadMode** The download mode used for this file download session. @@ -6667,6 +6773,7 @@ The following fields are available: - **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM). - **diceRoll** Random number used for determining if a client will use peering. - **doClientVersion** The version of the Delivery Optimization client. +- **doErrorCode** The Delivery Optimization error code that was returned. - **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100). - **downloadModeReason** Reason for the download. - **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9). @@ -6992,6 +7099,7 @@ The following fields are available: - **applicableUpdateList** The list of available updates. - **durationInSeconds** The amount of time (in seconds) it took for the event to run. - **expeditedMode** Indicates whether Expedited Mode is on. +- **networkCostPolicy** The network cost. - **scanTriggerSource** Indicates whether the scan is Interactive or Background. - **scenario** The result code of the event. - **scenarioReason** The reason for the result code (scenario). @@ -7034,6 +7142,23 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels + +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **configVersion** The escalation configuration version on the device. +- **downloadElapsedTime** Indicates how long since the download is required on device. +- **downloadRiskLevel** At-risk level of download phase. +- **installElapsedTime** Indicates how long since the install is required on device. +- **installRiskLevel** The at-risk level of install phase. +- **isSediment** Assessment of whether is device is at risk. +- **scanElapsedTime** Indicates how long since the scan is required on device. +- **scanRiskLevel** At-risk level of the scan phase. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. @@ -7221,6 +7346,17 @@ The following fields are available: - **wuDeviceid** Unique device ID controlled by the software distribution client. +### Microsoft.Windows.Update.Orchestrator.UpdaterMalformedData + +This event is sent when a registered updater has missing or corrupted information, to help keep Windows up to date. + +The following fields are available: + +- **malformedRegValue** The registry value that contains the malformed or missing entry. +- **updaterId** The ID of the updater. +- **wuDeviceid** Unique device ID used by Windows Update. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. @@ -7338,6 +7474,27 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.CryptcatsvcRebuild + +This event sends data specific to the CryptcatsvcRebuild mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** The unique identifier for each flight. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationNeeded** Information on whether the mitigation was needed. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **ServiceDisabled** Information on whether the service was disabled. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Update. +- **WuId** Unique ID for the Windows Update client. + + ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -7359,29 +7516,6 @@ The following fields are available: - **UpdateId** Unique ID for each Update. - **WuId** Unique ID for the Windows Update client. -### wilActivity - -This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. -- **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. -- **threadId** The ID of the thread on which the activity is executing. ## Windows Update Reserve Manager events @@ -7556,6 +7690,42 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. + + +## XBOX events + +### Microsoft.Xbox.EraControl.EraVmTerminationReason + +This event is triggered on ERA VM termination. + +The following fields are available: + +- **pfn** A package full name. +- **reasonNumber** A number associated with reason. + + +### Microsoft.Xbox.UpdateManager.TaskSuccess + +No content is currently available. + +The following fields are available: + +- **BeginUpdateFlags** No content is currently available. +- **CDNIdentifier** No content is currently available. +- **CDNInfo** No content is currently available. +- **ComboPolicy** No content is currently available. +- **ContentId** No content is currently available. +- **HighwindInfo** No content is currently available. +- **InstallId** No content is currently available. +- **LastCheckTime** No content is currently available. +- **LastResult** No content is currently available. +- **MSEdgeRef** No content is currently available. +- **PowerMode** No content is currently available. +- **RemoteAddress** No content is currently available. +- **SourceVersionId** No content is currently available. +- **TargetVersionId** No content is currently available. + + ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady From 6cd09b9f041d8c1f1c61be176955bc4e94f1b453 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 12 Nov 2020 14:47:01 +0000 Subject: [PATCH 02/41] urlupdate --- .../basic-level-windows-diagnostic-events-and-fields-1709.md | 2 +- .../basic-level-windows-diagnostic-events-and-fields-1803.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index f4bfc0d442..d2131af9b2 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -2512,7 +2512,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index a5c2718237..9302d7418e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -3470,7 +3470,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. From 0df42262996cbd088a7b93587f1a531a768453dc Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 12 Nov 2020 16:09:47 +0000 Subject: [PATCH 03/41] url updates --- ...evel-windows-diagnostic-events-and-fields-1903.md | 12 ++++++------ ...windows-diagnostic-data-events-and-fields-2004.md | 10 +++++----- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 76b3ba247f..59844bf5d6 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -4322,7 +4322,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device @@ -5046,7 +5046,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -5074,7 +5074,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -5103,7 +5103,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -5131,7 +5131,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -5234,7 +5234,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 1bd826bfd0..d8bebbeda9 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -3949,7 +3949,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -3977,7 +3977,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4005,7 +4005,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4033,7 +4033,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. @@ -4134,7 +4134,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. From af3c44508afb6ba579c927e79a2b98e06b8dc324 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 12 Nov 2020 16:40:07 +0000 Subject: [PATCH 04/41] removed windows audit events --- ...ndows-diagnostic-events-and-fields-1803.md | 13 ------- ...-diagnostic-data-events-and-fields-2004.md | 39 ------------------- 2 files changed, 52 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 9302d7418e..01f982ae10 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -4593,19 +4593,6 @@ The following fields are available: ## Other events -### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties - -This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. - -The following fields are available: - -- **nodeId** Constructed from nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. -- **nodeOperatingSystem** A user friendly description of the node's OS version. -- **nodeOSVersion** A major or minor build version string for the node's OS. -- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyperconverged cluster. -- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. - - ### Microsoft.Surface.Battery.Prod.BatteryInfoEvent This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index d8bebbeda9..8eb3bf3783 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -6045,45 +6045,6 @@ The following fields are available: - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. -## Windows Admin Center events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - -### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties - -This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. - -The following fields are available: - -- **nodeId** Constructed from nodeTypeId concatenated with the hostname or IP address that gateway uses to connecting to this node. -- **nodeOperatingSystem** A user friendly description of the node's OS version. -- **nodeOSVersion** A major or minor build version string for the node's OS. -- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. -- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. - - ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed From 67e72a7dd1957d89d3cf120c1354d8468f40e8a2 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 12 Nov 2020 19:11:12 +0000 Subject: [PATCH 05/41] Update basic-level-windows-diagnostic-events-and-fields-1809.md --- .../basic-level-windows-diagnostic-events-and-fields-1809.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 4795516628..6a94bd1f3f 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -43,7 +43,6 @@ You can learn more about Windows functional and diagnostic data through these ar - ## Account trace logging provider events ### Microsoft.Windows.Mitigation.AccountTraceLoggingProvider.General From 9488acfe3e6484551de5ec14145c77e7d2778b96 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 2 Dec 2020 15:04:19 -0800 Subject: [PATCH 06/41] fixing build warnings --- ...ndows-diagnostic-events-and-fields-1809.md | 29 ++++++++++++++++--- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 6a94bd1f3f..acaf8f6900 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -2550,6 +2550,19 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. +## Common Data Fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events @@ -4413,7 +4426,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4504,7 +4517,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.De~ice.DeviceInventoryChange](#msde~icedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -5018,7 +5031,7 @@ The following fields are available: This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChangd](#msdevicedeviceinventorychangd). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -5041,9 +5054,17 @@ This event indicates that this particular data object represented by the objectI This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - ## Kernel events +### IO + +This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup. + +The following fields are available: + +- **BytesRead** The total number of bytes read from or read by the OS upon system startup. +- **BytesWritten** The total number of bytes written to or written by the OS upon system startup. + ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. From 850cdcce2fe0cf6081882c50136946d5fb9f6f67 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 2 Dec 2020 15:16:15 -0800 Subject: [PATCH 07/41] fixing build warnings --- ...ndows-diagnostic-events-and-fields-1903.md | 834 +++++++++--------- ...-diagnostic-data-events-and-fields-2004.md | 55 +- 2 files changed, 470 insertions(+), 419 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 59844bf5d6..b338ac6705 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -4048,7 +4048,7 @@ The following fields are available: This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. -This event includes fields from [Ms.Device.DeviceInven|oryChange](#msdevicedeviceinven|orychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4151,7 +4151,7 @@ The following fields are available: This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DmviceInventoryChange](#msdevicedmviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4162,7 +4162,7 @@ The following fields are available: This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device,DeviceInventoryChange](#msdevice,deviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -5465,7 +5465,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## Other events +## ONNX events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5491,420 +5491,6 @@ The following fields are available: - **totalRunDuration** Total running/evaluation time from last time. - **totalRuns** Total number of running/evaluation from last time. - -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent - -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **batteryData** Hardware level data about battery performance. -- **batteryData.data()** Battery performance data. -- **BatteryDataSize:** Size of the battery performance data. -- **batteryInfo.data()** Battery performance data. -- **BatteryInfoSize:** Battery performance data. -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. - - -### Microsoft.Surface.Health.Binary.Prod.McuHealthLog - -This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. - -The following fields are available: - -- **CUtility::GetTargetNameA(Target)** Sub component name. -- **HealthLog** Health indicator log. -- **healthLogSize** 4KB. -- **productId** Identifier for product model. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked - -This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted - -This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** The list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted - -This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted - -This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted - -This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr - -This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr - -This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete - -This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired - -This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. -- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. -- **ExpediteUsoLastError** Last HResult from the current USO session. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted - -This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). -- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. -- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted - -This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd - -This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. -- **PackageVersion** The package version label for currency tools. -- **UnifiedInstallerInstallResult** The final result code for the unified installer. -- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. -- **UnifiedInstallerPlatformType** The enum indicating the platform type. - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart - -This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** The correlation vector. -- **GlobalEventCounter** Counts the events at the global level for telemetry. -- **PackageVersion** The package version for currency tools. -- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. -- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. -- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. -- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. -- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. -- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. -- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. -- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. -- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. -- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. -- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. -- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. -- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. -- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. -- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved - -This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded - -This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. -- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed - -This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Telemetry event counter. -- **PackageVersion** Version label of the package sending telemetry. -- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted - -This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived - -This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus - -This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails - -The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. -- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. -- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. -- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. -- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. -- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. -- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin - -This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin - -The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The global event counter counts the total events for the provider. -- **PackageVersion** The version for the current package. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin - -This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted - -This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -6565,6 +6151,33 @@ The following fields are available: - **UpdateId** The update ID for a specific piece of content. - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +## Surface events + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Hardware level data about battery performance. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. ## System reset events @@ -9072,6 +8685,391 @@ The following fields are available: - **updateId** The Windows Update device GUID. - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved + +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin + +The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The global event counter counts the total events for the provider. +- **PackageVersion** The version for the current package. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + ### wilActivity diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 8eb3bf3783..d8ff3dc88f 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1424,6 +1424,37 @@ The following fields are available: ## Audio endpoint events +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. See [MicCoords](#miccoords). +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + + +### MicCoords + +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **usType** The type of microphone. +- **wHorizontalAngle** The horizontal angle of the microphone (reported as radians times 10,000). +- **wVerticalAngle** The vertical angle of the microphone (reported as radians times 10,000). +- **wXCoord** The x-coordinate of the microphone. +- **wYCoord** The y-coordinate of the microphone. +- **wZCoord** The z-coordinate of the microphone. + ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -2112,6 +2143,19 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. +## Common Data Fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Component-based servicing events @@ -4376,7 +4420,7 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Other events +## Surface events ### Microsoft.Surface.Battery.Prod.BatteryInfoEvent @@ -7031,6 +7075,15 @@ The following fields are available: - **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hresult** The HResult of the overall activity. +- **threadId** The ID of the thread on which the activity is executing. + ### Microsoft.Windows.Update.Orchestrator.DeferRestart This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. From 91da19004bac7d0d46c74986a90d73891ba13d1f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 2 Dec 2020 15:28:29 -0800 Subject: [PATCH 08/41] build warning --- ...-diagnostic-data-events-and-fields-2004.md | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index d8ff3dc88f..23f490fe70 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -4422,19 +4422,7 @@ The following fields are available: ## Surface events -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **batteryData** Battery Performance data. -- **batteryData.data()** Battery performance data. -- **BatteryDataSize:** Size of the battery performance data. -- **batteryInfo.data()** Battery performance data. -- **BatteryInfoSize:** Size of the battery performance data. -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. ## Privacy consent logging events @@ -4998,6 +4986,19 @@ The following fields are available: - **healthLogSize** 4KB. - **productId** Identifier for product model. +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Battery Performance data. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Size of the battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. ## Update Assistant events From 94f593f4252ac2fa1aaa6412c5942a9a2953a35a Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 10 Dec 2020 11:34:13 +0000 Subject: [PATCH 09/41] NoisyHammerUpdates --- ...ndows-diagnostic-events-and-fields-1703.md | 22 +++++++++---------- ...ndows-diagnostic-events-and-fields-1709.md | 20 ++++++++--------- ...ndows-diagnostic-events-and-fields-1803.md | 20 ++++++++--------- ...ndows-diagnostic-events-and-fields-1809.md | 20 ++++++++--------- ...-diagnostic-data-events-and-fields-2004.md | 5 ----- 5 files changed, 41 insertions(+), 46 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 5a75aeb713..b7c080bbde 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -3198,20 +3198,20 @@ The following fields are available: - **PluginName** Name of the plugin specified for each generic plugin event. - **Reload** True if SIH reload is required. - **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device. -- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started. +- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started. - **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled. - **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists. - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task. -- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran. +- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran. - **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder. -- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed. -- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run. +- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed. +- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run. - **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network. -- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled. -- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists. -- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger. -- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task. -- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task. +- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled. +- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists. +- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled. +- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant. +- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant. - **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in. - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. @@ -3299,7 +3299,7 @@ The following fields are available: - **RemediationDUAKeyDeleteSucceeded** TRUE if the UninstallActive registry key was successfully deleted. - **RemediationDuplicateTokenSucceeded** TRUE if the user token was successfully duplicated. - **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated. -- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully. +- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully. - **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried. - **RemediationRanHibernation** TRUE if the system entered Hibernation. - **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded. @@ -3441,7 +3441,7 @@ The following fields are available: - **DatetimeSyncPlugin** TRUE / FALSE depending on whether the DateTimeSync plug-in ran successfully. - **DiskCleanupPlugin** TRUE / FALSE depending on whether the DiskCleanup plug-in ran successfully. - **GlobalEventCounter** The client-side counter that indicates ordering of events. -- **NoisyHammerPlugin** TRUE / FALSE depending on whether the NoisyHammer plug-in ran successfully. +- **NoisyHammerPlugin** TRUE / FALSE depending on whether the Auto UA plug-in ran successfully. - **PackageVersion** The version number of the current remediation package. - **RebootRequiredPlugin** TRUE / FALSE depending on whether the Reboot plug-in ran successfully. - **RemediationNotifyUserFixIssuesPlugin** TRUE / FALSE depending on whether the User Fix Issues plug-in ran successfully diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index d2131af9b2..43a036171a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -3351,20 +3351,20 @@ The following fields are available: - **PluginName** Name of the plugin specified for each generic plugin event. - **Reload** True if SIH reload is required. - **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device. -- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started. +- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started. - **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled. - **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists. - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task. -- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran. +- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran. - **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder. -- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed. -- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run. +- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed. +- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run. - **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network. -- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled. -- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists. -- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger. -- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task. -- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task. +- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled. +- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists. +- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled. +- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant. +- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant. - **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in. - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. @@ -3486,7 +3486,7 @@ The following fields are available: - **RemediationHibernationMigrated** TRUE if hibernation was migrated. - **RemediationHibernationMigrationSucceeded** TRUE if hibernation migration succeeded. - **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated. -- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully. +- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully. - **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried. - **RemediationRanHibernation** TRUE if the system entered Hibernation. - **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 01f982ae10..6b430136f2 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -4763,20 +4763,20 @@ The following fields are available: - **PluginName** Name of the plugin specified for each generic plugin event. - **Reload** True if SIH reload is required. - **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device. -- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started. +- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started. - **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled. - **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists. - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task. -- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran. +- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran. - **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder. -- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed. -- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run. +- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed. +- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run. - **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network. -- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled. -- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists. -- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger. -- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task. -- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task. +- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled. +- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists. +- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled. +- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant. +- **RemediationNoisyHammerUAExitState** TThe exit code of the Update Assistant. - **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in. - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. @@ -4899,7 +4899,7 @@ The following fields are available: - **RemediationHibernationMigrationSucceeded** TRUE if hibernation migration succeeded. - **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated. - **RemediationNoisyHammerTaskFixSuccessId** Indicates whether the Update Assistant task fix was successful. -- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully. +- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully. - **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried. - **RemediationRanHibernation** TRUE if the system entered Hibernation. - **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index acaf8f6900..cbce21bd98 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -5990,21 +5990,21 @@ The following fields are available: - **RemediationDeviceSkuId** The Windows 10 edition ID that maps to the version of Windows 10 on the device. - **RemediationGetCurrentFolderExist** Indicates whether the GetCurrent folder exists. - **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device. -- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started. +- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started. - **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled. - **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists. - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task. -- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran. +- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran. - **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder. -- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed. -- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run. +- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed. +- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run. - **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network. -- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled. -- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists. -- **RemediationNoisyHammerTasksStalled** Indicates whether a task (Noisy Hammer) is stalled. -- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger. -- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task. -- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task. +- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled. +- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists. +- **RemediationNoisyHammerTasksStalled** TRUE if the Auto UA task is stalled. +- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled. +- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant. +- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant. - **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in. - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationNotifyUserFixIssuesBoxStatusKey** Status of the remediation plug-in. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 23f490fe70..f11efa7639 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -4420,11 +4420,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Surface events - - - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted From bd3d1322b7851a42842102e2009057544c8cf3f6 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 10 Dec 2020 12:17:03 +0000 Subject: [PATCH 10/41] Update required-windows-diagnostic-data-events-and-fields-2004.md --- ...-diagnostic-data-events-and-fields-2004.md | 23 ------------------- 1 file changed, 23 deletions(-) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index f11efa7639..14e31a73f5 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -7701,7 +7701,6 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. - ## XBOX events ### Microsoft.Xbox.EraControl.EraVmTerminationReason @@ -7714,28 +7713,6 @@ The following fields are available: - **reasonNumber** A number associated with reason. -### Microsoft.Xbox.UpdateManager.TaskSuccess - -No content is currently available. - -The following fields are available: - -- **BeginUpdateFlags** No content is currently available. -- **CDNIdentifier** No content is currently available. -- **CDNInfo** No content is currently available. -- **ComboPolicy** No content is currently available. -- **ContentId** No content is currently available. -- **HighwindInfo** No content is currently available. -- **InstallId** No content is currently available. -- **LastCheckTime** No content is currently available. -- **LastResult** No content is currently available. -- **MSEdgeRef** No content is currently available. -- **PowerMode** No content is currently available. -- **RemoteAddress** No content is currently available. -- **SourceVersionId** No content is currently available. -- **TargetVersionId** No content is currently available. - - ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady From 320154fd4819cd19df7c9a9283d04ed2c550f249 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 15 Apr 2021 16:31:40 -0700 Subject: [PATCH 11/41] entery for WMIC --- windows/deployment/planning/windows-10-deprecated-features.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index ccc51614a9..7f49135db7 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,6 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | +| WMIC | WMIC| 21H1 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | | Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | From 6932e4b131790985618967aa618e56aa3ebf4243 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 15 Apr 2021 16:37:23 -0700 Subject: [PATCH 12/41] entry for WMIC --- windows/deployment/planning/windows-10-deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 7f49135db7..7002aac879 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,7 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| WMIC | WMIC| 21H1 | +| Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](https://docs.microsoft.com/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-7.1). Note: This deprecation only applies to the [command-line management tool](https://docs.microsoft.com/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | | Dynamic Disks | The [Dynamic Disks](/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](/windows-server/storage/storage-spaces/overview) in a future release.| 2004 | From a051c1c0a4025aacf98dcce2b5d8a0c6def65f7f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 29 Apr 2021 16:16:29 +0100 Subject: [PATCH 13/41] 21H1EventDescriptionUpdates --- ...ndows-diagnostic-events-and-fields-1703.md | 271 +-- ...ndows-diagnostic-events-and-fields-1709.md | 464 +--- ...ndows-diagnostic-events-and-fields-1803.md | 549 +---- ...ndows-diagnostic-events-and-fields-1809.md | 1215 ++++++----- ...ndows-diagnostic-events-and-fields-1903.md | 1870 ++++++++++++----- ...-diagnostic-data-events-and-fields-2004.md | 1671 ++++++++++----- 6 files changed, 3325 insertions(+), 2715 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index b7c080bbde..1830fe5c61 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 11/12/2020 +ms.date: 04/28/2021 ms.reviewer: --- @@ -52,31 +52,31 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. -- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device. -- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device. -- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device. -- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device. -- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device. -- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device. -- **DecisionDevicePnp_RS2** The count of DataSourceMatchingInfoBlock objects present on this machine targeting the next release of Windows -- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device. -- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device. -- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device. -- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device. -- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device. -- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **InventoryLanguagePack** The count of DecisionApplicationFile objects present on this machine targeting the next release of Windows -- **InventorySystemBios** The count of DecisionDevicePnp objects present on this machine targeting the next release of Windows -- **PCFP** The count of DecisionDriverPackage objects present on this machine targeting the next release of Windows -- **SystemProcessorCompareExchange** The count of DecisionMatchingInfoBlock objects present on this machine targeting the next release of Windows +- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. - **SystemProcessorSse2** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of DecisionSystemBios objects present on this machine targeting the next release of Windows +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. @@ -2490,7 +2490,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. See [HWID](#hwid). - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.asp +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -2691,8 +2691,8 @@ The following fields are available: - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. - **Speed** The configured memory slot speed in MHz. -- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync @@ -2721,84 +2721,6 @@ This event indicates that a new sync is being generated for this object type. Th -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -3608,133 +3530,6 @@ The following fields are available: - **Time** The system time at which the event occurred. -### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings - -This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. - -The following fields are available: - -- **CustomVer** The registry value for targeting. -- **IsMetered** TRUE if the machine is on a metered network. -- **LastVer** The version of the last successful run. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl - -This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date. - -The following fields are available: - -- **AttemptNumber** The count indicating which download attempt is starting. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess - -This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.Error - -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **FailureType** The type of error encountered. -- **FileName** The code file in which the error occurred. -- **HResult** The failure error code. -- **LineNumber** The line number in the code file at which the error occurred. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated - -This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the validated EXE was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess - -This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the successfully extracted content was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.NewUrlFound - -This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ProcessCreated - -This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be executed. - - -### Microsoft.Windows.Sediment.OSRSS.SelfUpdate - -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ServiceVersionMajor** The major version number for the component. -- **ServiceVersionMinor** The minor version number for the component. -- **Time** The system timestamp for when the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.UrlState - -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **Id** A number identifying the URL -- **ServiceVersionMajor** Version info for the component -- **ServiceVersionMinor** Version info for the component -- **StateData** State-specific data, such as which attempt number for the download -- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.) -- **Time** System timestamp the event was fired - - ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. @@ -6467,6 +6262,22 @@ The following fields are available: - **CommandLine** The command line used to launch RUXIMICS. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit + +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch + +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + ### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 43a036171a..0f56bd17f5 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 11/12/2020 +ms.date: 04/28/2021 ms.reviewer: --- @@ -52,40 +52,40 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_RS4** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceDevicePnp_RS4** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. -- **InventoryApplicationFile** The count of the number of this particular object type present on this device. -- **InventoryLanguagePack** The count of InventoryLanguagePack objects present on this machine. -- **InventoryMediaCenter** The count of the number of this particular object type present on this device. -- **InventorySystemBios** The count of the number of this particular object type present on this device. -- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. -- **PCFP** An ID for the system, calculated by hashing hardware identifiers. -- **SystemMemory** The count of the number of this particular object type present on this device. -- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. -- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4** The total number of objects of this type present on this device. +- **InventoryApplicationFile** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventoryMediaCenter** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemMemory** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. +- **SystemProcessorLahfSahf** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. -- **SystemProcessorSse2** The count of SystemProcessorSse2 objects present on this machine. -- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemProcessorSse2** The total number of objects of this type present on this device. +- **SystemTouch** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. +- **Wmdrm_RS4** The total number of objects of this type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd @@ -1963,6 +1963,15 @@ This event is fired by UTC at startup to signal what data we are allowed to coll This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. +The following fields are available: + +- **CensusExitCode** Returns last execution codes from census client run. +- **CensusStartTime** Returns timestamp corresponding to last successful census run. +- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. +- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period. ### TelClientSynthetic.HeartBeat_5 @@ -2725,8 +2734,8 @@ The following fields are available: - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. - **Speed** The configured memory slot speed in MHz. -- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync @@ -2790,237 +2799,6 @@ The following fields are available: - **InventoryVersion** The version of the inventory binary generating the events. -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device -- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device -- **OMID** Identifier for the Office SQM Machine -- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit -- **OTenantId** Unique GUID representing the Microsoft O365 Tenant -- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 -- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. -- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. -- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag -- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request -- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts -- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords -- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control -- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted -- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) -- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL -- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior -- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows -- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OfficeApplication** The name of the Office application. -- **OfficeArchitecture** The bitness of the Office application. -- **OfficeVersion** The version of the Office application. -- **Value** The insights collected about this entity. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OC2rApps** A GUID the describes the Office Click-To-Run apps -- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus -- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word -- **OProductCodes** A GUID that describes the Office MSI products - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **BrowserFlags** Browser flags for Office-related products. -- **ExchangeProviderFlags** Office Exchange provider policies -- **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office Shared Computer Licensing policies - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd - -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Design** Count of files with design issues found -- **Design_x64** Count of files with 64 bit design issues found -- **DuplicateVBA** Count of files with duplicate VBA code -- **HasVBA** Count of files with VBA code -- **Inaccessible** Count of files that were inaccessible for scanning -- **Issues** Count of files with issues detected -- **Issues_x64** Count of files with 64-bit issues detected -- **IssuesNone** Count of files with no issues detected -- **IssuesNone_x64** Count of files with no 64-bit issues detected -- **Locked** Count of files that were locked, preventing scanning -- **NoVBA** Count of files with no VBA inside -- **Protected** Count of files that were password protected, preventing scanning -- **RemLimited** Count of files that require limited remediation changes -- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues -- **RemSignificant** Count of files that require significant remediation changes -- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues -- **Score** Overall compatibility score calculated for scanned content -- **Score_x64** Overall 64-bit compatibility score calculated for scanned content -- **Total** Total number of files scanned -- **Validation** Count of files that require additional manual validation -- **Validation_x64** Count of files that require additional manual validation for 64-bit issues - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd - -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Count** Count of total Microsoft Office VBA rule violations - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -3251,6 +3029,21 @@ The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties + +This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. + +The following fields are available: + +- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. +- **nodeOperatingSystem** A user friendly description of the node's OS version. +- **nodeOSVersion** A major or minor build version string for the node's OS. +- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. +- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. + + ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted @@ -3596,133 +3389,6 @@ The event indicates progress made by the updater. This information assists in ke -### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings - -This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. - -The following fields are available: - -- **CustomVer** The registry value for targeting. -- **IsMetered** TRUE if the machine is on a metered network. -- **LastVer** The version of the last successful run. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl - -This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date. - -The following fields are available: - -- **AttemptNumber** The count indicating which download attempt is starting. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess - -This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.Error - -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **FailureType** The type of error encountered. -- **FileName** The code file in which the error occurred. -- **HResult** The failure error code. -- **LineNumber** The line number in the code file at which the error occurred. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated - -This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the validated EXE was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess - -This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the successfully extracted content was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.NewUrlFound - -This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ProcessCreated - -This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be executed. - - -### Microsoft.Windows.Sediment.OSRSS.SelfUpdate - -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ServiceVersionMajor** The major version number for the component. -- **ServiceVersionMinor** The minor version number for the component. -- **Time** The system timestamp for when the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.UrlState - -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **Id** A number identifying the URL -- **ServiceVersionMajor** Version info for the component -- **ServiceVersionMinor** Version info for the component -- **StateData** State-specific data, such as which attempt number for the download -- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.) -- **Time** System timestamp the event was fired - - ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. @@ -6774,6 +6440,22 @@ The following fields are available: - **CommandLine** The command line used to launch RUXIMICS. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit + +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch + +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + ### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 6b430136f2..7dd91a660b 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 11/12/2020 +ms.date: 04/28/2021 ms.reviewer: --- @@ -52,74 +52,74 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. -- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. -- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. -- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. -- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. -- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. -- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. -- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. -- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. -- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **InventoryApplicationFile** The count of the number of this particular object type present on this device. -- **InventoryLanguagePack** The count of the number of this particular object type present on this device. -- **InventoryMediaCenter** The count of the number of this particular object type present on this device. -- **InventorySystemBios** The count of the number of this particular object type present on this device. -- **InventoryTest** The count of the number of this particular object type present on this device. -- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. -- **PCFP** An ID for the system, calculated by hashing hardware identifiers. -- **SystemMemory** The count of the number of this particular object type present on this device. -- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. -- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS1** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DecisionTest_RS1** The total number of objects of this type present on this device. +- **InventoryApplicationFile** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventoryMediaCenter** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **InventoryTest** The total number of objects of this type present on this device. +- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemMemory** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. +- **SystemProcessorLahfSahf** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. - **SystemProcessorSse2** The total number of objects of this type present on this device. -- **SystemTouch** The count of SystemTouch objects present on this machine. +- **SystemTouch** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of SystemWindowsActivationStatus objects present on this machine. +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS5** The count of the number of this particular object type present on this device. +- **Wmdrm_RS1** The total number of objects of this type present on this device. +- **Wmdrm_RS3** The total number of objects of this type present on this device. +- **Wmdrm_RS5** The total number of objects of this type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd @@ -2288,21 +2288,6 @@ The following fields are available: - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. -### TelClientSynthetic.ConnectivityHeartbeat_0 - -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. - -The following fields are available: - -- **CensusExitCode** Last exit code of the Census task. -- **CensusStartTime** Time of last Census run. -- **CensusTaskEnabled** True if Census is enabled, false otherwise. -- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. -- **NetworkState** The network state of the device. -- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. -- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. - - ### TelClientSynthetic.ConnectivityHeartBeat_0 This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2312,10 +2297,10 @@ The following fields are available: - **CensusExitCode** Last exit code of the Census task. - **CensusStartTime** Time of last Census run. - **CensusTaskEnabled** True if Census is enabled, false otherwise. -- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred. - **NetworkState** The network state of the device. -- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. -- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. +- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. +- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period. ### TelClientSynthetic.HeartBeat_5 @@ -3470,7 +3455,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -3688,8 +3673,8 @@ The following fields are available: - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. - **Speed** The configured memory slot speed in MHz. -- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync @@ -3755,241 +3740,6 @@ The following fields are available: - **InventoryVersion** The version of the inventory binary generating the events. -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device -- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device -- **OMID** Identifier for the Office SQM Machine -- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit -- **OTenantId** Unique GUID representing the Microsoft O365 Tenant -- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 -- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. -- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. -- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag -- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request -- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts -- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords -- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control -- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted -- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) -- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL -- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior -- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows -- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OfficeApplication** The name of the Office application. -- **OfficeArchitecture** The bitness of the Office application. -- **OfficeVersion** The version of the Office application. -- **Value** The insights collected about this entity. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OC2rApps** A GUID the describes the Office Click-To-Run apps -- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus -- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word -- **OProductCodes** A GUID that describes the Office MSI products - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **BrowserFlags** Browser flags for Office-related products. -- **ExchangeProviderFlags** Provider policies for Office Exchange. -- **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd - -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Design** Count of files with design issues found -- **Design_x64** Count of files with 64 bit design issues found -- **DuplicateVBA** Count of files with duplicate VBA code -- **HasVBA** Count of files with VBA code -- **Inaccessible** Count of files that were inaccessible for scanning -- **InventoryVersion** The version of the inventory binary generating the events. -- **Issues** Count of files with issues detected -- **Issues_x64** Count of files with 64-bit issues detected -- **IssuesNone** Count of files with no issues detected -- **IssuesNone_x64** Count of files with no 64-bit issues detected -- **Locked** Count of files that were locked, preventing scanning -- **NoVBA** Count of files with no VBA inside -- **Protected** Count of files that were password protected, preventing scanning -- **RemLimited** Count of files that require limited remediation changes -- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues -- **RemSignificant** Count of files that require significant remediation changes -- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues -- **Score** Overall compatibility score calculated for scanned content -- **Score_x64** Overall 64-bit compatibility score calculated for scanned content -- **Total** Total number of files scanned -- **Validation** Count of files that require additional manual validation -- **Validation_x64** Count of files that require additional manual validation for 64-bit issues - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd - -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Count** Count of total Microsoft Office VBA rule violations - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -4776,7 +4526,7 @@ The following fields are available: - **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists. - **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled. - **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant. -- **RemediationNoisyHammerUAExitState** TThe exit code of the Update Assistant. +- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant. - **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in. - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. @@ -5018,133 +4768,6 @@ The following fields are available: - **Time** The system time at which the phase chance occurred. -### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings - -This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. - -The following fields are available: - -- **CustomVer** The registry value for targeting. -- **IsMetered** TRUE if the machine is on a metered network. -- **LastVer** The version of the last successful run. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl - -This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date. - -The following fields are available: - -- **AttemptNumber** The count indicating which download attempt is starting. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess - -This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which data was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.Error - -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **FailureType** The type of error encountered. -- **FileName** The code file in which the error occurred. -- **HResult** The failure error code. -- **LineNumber** The line number in the code file at which the error occurred. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated - -This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the validated EXE was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess - -This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The URL from which the successfully extracted content was downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.NewUrlFound - -This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be downloaded. - - -### Microsoft.Windows.Sediment.OSRSS.ProcessCreated - -This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date. - -The following fields are available: - -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. -- **Url** The new URL from which content will be executed. - - -### Microsoft.Windows.Sediment.OSRSS.SelfUpdate - -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ServiceVersionMajor** The major version number for the component. -- **ServiceVersionMinor** The minor version number for the component. -- **Time** The system timestamp for when the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.UrlState - -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **Id** A number identifying the URL. -- **ServiceVersionMajor** Version information for the component. -- **ServiceVersionMinor** Version information for the component. -- **StateData** State-specific data, such as the attempt number for the download. -- **StateNumber** A number identifying the current state of the URL (for example, found, downloading, extracted). -- **Time** System timestamp when the event was started. - - ### Microsoft.Windows.Sediment.ServiceInstaller.AttemptingUpdate This event indicates the Operating System Remediation System Service (OSRSS) installer is attempting an update to itself. This information helps ensure Windows is up to date. @@ -8427,6 +8050,36 @@ The following fields are available: - **CommandLine** The command line used to launch RUXIMICS. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit + +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch + +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent + +This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. +- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. +- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. +- **ResultId** The result generated by the evaluation and presentation. +- **WasCompleted** True if the user interaction campaign is complete. +- **WasPresented** True if the user interaction campaign is displayed to the user. + + ### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 04442b83d6..32fd5f8439 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -1,5 +1,5 @@ --- -description: Use this article to learn more about what Windows 10 version 1809 diagnostic data is gathered at the basic level. +description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Windows 10, version 1809 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 11/12/2020 +ms.date: 04/28/2021 ms.reviewer: --- @@ -43,6 +43,7 @@ You can learn more about Windows functional and diagnostic data through these ar + ## Account trace logging provider events ### Microsoft.Windows.Mitigation.AccountTraceLoggingProvider.General @@ -306,272 +307,289 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_19ASetup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceApplicationFile_RS2** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19ASetup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19ASetup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. -- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS3Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS4Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS3Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS4Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS4Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19ASetup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. -- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. -- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. -- **DatasourceSystemBios_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. -- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. -- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. -- **DecisionMatchingInfoBlock_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS4** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1803 present on this device. -- **DecisionMatchingInfoBlock_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. -- **DecisionMatchingInfoPassive_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DecisionMatchingInfoPostUpgrade_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. -- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. -- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. -- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. -- **DecisionMediaCenter_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS4** The total DecisionMediaCenter objects targeting Windows 10 version 1803 present on this device. -- **DecisionMediaCenter_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19ASetup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. -- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. -- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. -- **DecisionSystemBios_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. -- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. -- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **InventoryApplicationFile** The count of the number of this particular object type present on this device. -- **InventoryDeviceContainer** A count of device container objects in cache. -- **InventoryDevicePnp** A count of device Plug and Play objects in cache. -- **InventoryDriverBinary** A count of driver binary objects in cache. -- **InventoryDriverPackage** A count of device objects in cache. -- **InventoryLanguagePack** The count of the number of this particular object type present on this device. -- **InventoryMediaCenter** The count of the number of this particular object type present on this device. -- **InventorySystemBios** The count of the number of this particular object type present on this device. -- **InventorySystemMachine** The count of the number of this particular object type present on this device. -- **InventorySystemProcessor** The count of the number of this particular object type present on this device. -- **InventoryTest** The count of the number of this particular object type present on this device. -- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. -- **PCFP** The count of the number of this particular object type present on this device. -- **SystemMemory** The count of the number of this particular object type present on this device. -- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. -- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_19ASetup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_19H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19ASetup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19ASetup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19ASetup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS4Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS5Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19ASetup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS4Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS5Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19ASetup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19ASetup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19ASetup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS4Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS5Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19ASetup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19ASetup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19ASetup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS4Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS5Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19ASetup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS4Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS5Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19ASetup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS4Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19ASetup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS4Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS5Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH2** The total number of objects of this type present on this device. +- **DecisionSystemBios_19ASetup** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS1** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS2** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH1** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionSystemProcessor_RS2** The total number of objects of this type present on this device. +- **DecisionTest_20H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_21H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_RS1** The total number of objects of this type present on this device. +- **InventoryApplicationFile** The total number of objects of this type present on this device. +- **InventoryDeviceContainer** The total number of objects of this type present on this device. +- **InventoryDevicePnp** The total number of objects of this type present on this device. +- **InventoryDriverBinary** The total number of objects of this type present on this device. +- **InventoryDriverPackage** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventoryMediaCenter** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **InventorySystemMachine** The total number of objects of this type present on this device. +- **InventorySystemProcessor** The total number of objects of this type present on this device. +- **InventoryTest** The total number of objects of this type present on this device. +- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemMemory** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. +- **SystemProcessorLahfSahf** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. - **SystemProcessorSse2** The total number of objects of this type present on this device. -- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemTouch** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_19ASetup** The count of the number of this particular object type present on this device. -- **Wmdrm_19H1** The count of the number of this particular object type present on this device. -- **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. -- **Wmdrm_20H1** The count of the number of this particular object type present on this device. -- **Wmdrm_20H1Setup** The count of the number of this particular object type present on this device. -- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS3Setup** The count of the number of this particular object type present on this device. -- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. -- **Wmdrm_RS4Setup** The count of the number of this particular object type present on this device. -- **Wmdrm_RS5** The count of the number of this particular object type present on this device. -- **Wmdrm_RS5Setup** The count of the number of this particular object type present on this device. -- **Wmdrm_TH1** The count of the number of this particular object type present on this device. -- **Wmdrm_TH2** The count of the number of this particular object type present on this device. +- **Wmdrm_19ASetup** The total number of objects of this type present on this device. +- **Wmdrm_19H1** The total number of objects of this type present on this device. +- **Wmdrm_19H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_20H1** The total number of objects of this type present on this device. +- **Wmdrm_20H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_21H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_RS1** The total number of objects of this type present on this device. +- **Wmdrm_RS2** The total number of objects of this type present on this device. +- **Wmdrm_RS3** The total number of objects of this type present on this device. +- **Wmdrm_RS3Setup** The total number of objects of this type present on this device. +- **Wmdrm_RS4** The total number of objects of this type present on this device. +- **Wmdrm_RS4Setup** The total number of objects of this type present on this device. +- **Wmdrm_RS5** The total number of objects of this type present on this device. +- **Wmdrm_RS5Setup** The total number of objects of this type present on this device. +- **Wmdrm_TH1** The total number of objects of this type present on this device. +- **Wmdrm_TH2** The total number of objects of this type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd @@ -1117,6 +1135,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSModeStateAdd + +This event sends true/false compatibility decision data about the S mode state. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Appraiser decision about eligibility to upgrade. +- **LockdownMode** S mode lockdown mode. + + +### Microsoft.Windows.Appraiser.General.DecisionSModeStateStartSync + +The DecisionSModeStateStartSync event indicates that a new set of DecisionSModeStateAdd events will be sent. This event is used to make compatibility decisions about the S mode state. Microsoft uses this information to understand and address problems regarding the S mode state for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd This event sends compatibility decision data about the BIOS to help keep Windows up to date. @@ -1153,6 +1195,127 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeAdd + +This event indicates that this object type was added. This data refers to the Disk size in the device. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser decision during evaluation of hardware requirements during OS upgrade. +- **TotalSize** Total disk size in Mb. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeStartSync + +Start sync event for physical disk size data. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresAdd + +This data attribute refers to the number of Cores a CPU supports. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** The Appraisal decision about eligibility to upgrade. +- **CpuCores** Number of CPU Cores. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresStartSync + +This event signals the start of telemetry collection for CPU cores in Appraiser. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedAdd + +This event sends compatibility decision data about the CPU, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser OS eligibility decision. +- **Mhz** CPU speed in MHz. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedStartSync + +This event collects data for CPU speed in MHz. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionAdd + +This event collects data about the Trusted Platform Module (TPM) in the device. TPM technology is designed to provide hardware-based, security-related functions. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision based on the device's TPM support. +- **TpmVersionInfo** The version of Trusted Platform Module (TPM) technology in the device. + + +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionStartSync + +The DecisionTpmVersionStartSync event indicates that a new set of DecisionTpmVersionAdd events will be sent. This event is used to make compatibility decisions about the TPM. Microsoft uses this information to understand and address problems regarding the TPM for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootAdd + +This event collects information about data on support and state of UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision when checking for UEFI support. +- **SecureBootCapable** Is UEFI supported? +- **SecureBootEnabled** Is UEFI enabled? + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootStartSync + +Start sync event data for UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + ### Microsoft.Windows.Appraiser.General.GatedRegChange This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. @@ -2533,7 +2696,8 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common Data Fields + +## Common data fields ### Ms.Device.DeviceInventoryChange @@ -2541,11 +2705,12 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. + ## Compatibility events @@ -2896,13 +3061,13 @@ This event sends data about the connectivity status of the Connected User Experi The following fields are available: -- **CensusExitCode** Last exit code of the Census task. -- **CensusStartTime** Time of last Census run. -- **CensusTaskEnabled** True if Census is enabled, false otherwise. -- **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** The network state of the device. +- **CensusExitCode** Returns last execution codes from census client run. +- **CensusStartTime** Returns timestamp corresponding to last successful census run. +- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. -- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. +- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period. ### TelClientSynthetic.HeartBeat_5 @@ -3723,6 +3888,80 @@ The following fields are available: ## DISM events +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -4409,7 +4648,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). The following fields are available: @@ -4445,7 +4684,7 @@ The following fields are available: - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -4651,8 +4890,8 @@ The following fields are available: - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. - **Speed** The configured memory slot speed in MHz. -- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration as per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove @@ -4726,248 +4965,6 @@ The following fields are available: - **InventoryVersion** The version of the inventory binary generating the events. -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device -- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device -- **OMID** Identifier for the Office SQM Machine -- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit -- **OTenantId** Unique GUID representing the Microsoft O365 Tenant -- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 -- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. -- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. -- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag -- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request -- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts -- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords -- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control -- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted -- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) -- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL -- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior -- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows -- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OfficeApplication** The name of the Office application. -- **OfficeArchitecture** The bitness of the Office application. -- **OfficeVersion** The version of the Office application. -- **Value** The insights collected about this entity. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OC2rApps** A GUID the describes the Office Click-To-Run apps -- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus -- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word -- **OProductCodes** A GUID that describes the Office MSI products - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **BrowserFlags** Browser flags for Office-related products. -- **ExchangeProviderFlags** Provider policies for Office Exchange. -- **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd - -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Design** Count of files with design issues found. -- **Design_x64** Count of files with 64 bit design issues found. -- **DuplicateVBA** Count of files with duplicate VBA code. -- **HasVBA** Count of files with VBA code. -- **Inaccessible** Count of files that were inaccessible for scanning. -- **InventoryVersion** The version of the inventory binary generating the events. -- **Issues** Count of files with issues detected. -- **Issues_x64** Count of files with 64-bit issues detected. -- **IssuesNone** Count of files with no issues detected. -- **IssuesNone_x64** Count of files with no 64-bit issues detected. -- **Locked** Count of files that were locked, preventing scanning. -- **NoVBA** Count of files with no VBA inside. -- **Protected** Count of files that were password protected, preventing scanning. -- **RemLimited** Count of files that require limited remediation changes. -- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues. -- **RemSignificant** Count of files that require significant remediation changes. -- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues. -- **Score** Overall compatibility score calculated for scanned content. -- **Score_x64** Overall 64-bit compatibility score calculated for scanned content. -- **Total** Total number of files scanned. -- **Validation** Count of files that require additional manual validation. -- **Validation_x64** Count of files that require additional manual validation for 64-bit issues. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd - -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Count** Count of total Microsoft Office VBA rule violations -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -5037,17 +5034,9 @@ This event indicates that this particular data object represented by the objectI This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + ## Kernel events -### IO - -This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup. - -The following fields are available: - -- **BytesRead** The total number of bytes read from or read by the OS upon system startup. -- **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. @@ -5627,7 +5616,7 @@ The following fields are available: - **winInetError** The HResult of the operation. -## Other events +## ONNX runtime events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5654,6 +5643,21 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties + +This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. + +The following fields are available: + +- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. +- **nodeOperatingSystem** A user friendly description of the node's OS version. +- **nodeOSVersion** A major or minor build version string for the node's OS. +- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. +- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. + + ### Microsoft.Surface.Battery.Prod.BatteryInfoEvent This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. @@ -5668,78 +5672,107 @@ The following fields are available: - **szBatteryInfo** Battery performance data. -### Microsoft.Windows.StartRep.DISMLatesInstalledLCU +### Microsoft.Windows.Deployment.Imaging.AppExit -This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM +- **hr** HResult returned from app exit. +- **sId** Session Id of the application. +- **totalTimeInMs** Total time taken in Ms. -### Microsoft.Windows.StartRep.DISMPendingInstall +### Microsoft.Windows.Deployment.Imaging.AppInvoked -This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **DISMPendingInstallPackageName** The name of the pending package. +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. +- **sId** Id of the session. -### Microsoft.Windows.StartRep.DISMRevertPendingActions +### Microsoft.Windows.Deployment.Imaging.Failed -This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **ErrorCode** The result from the operation to revert pending packages. +- **cs** Line that failed. +- **ec** Execution status. +- **hr** HResult returned. +- **msg** Message returned. +- **stack** Stack information. -### Microsoft.Windows.StartRep.DISMUninstallLCU +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted -This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **ErrorCode** The error code that is being reported by DISM. +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **sId** Session id for the application. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. -### Microsoft.Windows.StartRep.SRTRepairActionEnd +### Microsoft.Windows.Deployment.Imaging.ImagingStarted -This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **ErrorCode** The error code that is reported. -- **SRTRepairAction** The action that was taken by SRT. +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. +- **sId** Session id for the app. -### Microsoft.Windows.StartRep.SRTRepairActionStart +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit -This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **SRTRepairAction** The action that is being taken by SRT. +- **CommandLine** The command line used to launch RUXIMICS. -### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit -This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **ErrorCode** The final result code for the root cause operation. -- **SRTRootCauseDiag** The name of the root cause operation that ran. +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. -### Microsoft.Windows.StartRep.SRTRootCauseDiagStart +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch -This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. -The following fields are available: - -- **SRTRootCauseDiag** The name of a specific diagnostic. ## Privacy consent logging events @@ -8220,12 +8253,62 @@ The following fields are available: ## Windows Update CSP events +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed + +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable + +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded + +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of Windows Update for Business connection check. + + ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. @@ -8240,6 +8323,12 @@ The following fields are available: - **wUfBConnected** Result of WUfB connection check. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded + +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled @@ -9530,15 +9619,15 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin -This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. +This event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: - **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. +- **GlobalEventCounter** The global event counter for counting total events for the provider. +- **PackageVersion** The version for the current package. ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index e94c8ff457..1cc399f38c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -1,5 +1,5 @@ --- -description: Use this article to learn more about what required Windows 10 version 1903 diagnostic data is gathered. +description: Use this article to learn more about what required Windows diagnostic data is gathered. title: Windows 10, version 1909 and Windows 10, version 1903 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 11/12/2020 +ms.date: 04/28/2021 --- @@ -270,236 +270,410 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceApplicationFile_RS2** An ID for the system, calculated by hashing hardware identifiers. -- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. -- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19ASetup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. -- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. -- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. -- **DatasourceSystemBios_RS3Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. -- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. -- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. -- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. -- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. -- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. -- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. -- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. -- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19ASetup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. -- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. -- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. -- **DecisionSystemBios_RS3Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. -- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. -- **DecisionTest_19H1** The count of the number of this particular object type present on this device. -- **DecisionTest_20H1** The count of the number of this particular object type present on this device. -- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **DecisionTest_RS2** The count of the number of this particular object type present on this device. -- **DecisionTest_RS3** The count of the number of this particular object type present on this device. -- **DecisionTest_RS4** The count of the number of this particular object type present on this device. -- **DecisionTest_RS5** The count of the number of this particular object type present on this device. -- **DecisionTest_TH1** The count of the number of this particular object type present on this device. -- **DecisionTest_TH2** The count of the number of this particular object type present on this device. -- **InventoryApplicationFile** The count of the number of this particular object type present on this device. -- **InventoryDeviceContainer** A count of device container objects in cache. -- **InventoryDevicePnp** A count of device Plug and Play objects in cache. -- **InventoryDriverBinary** A count of driver binary objects in cache. -- **InventoryDriverPackage** A count of device objects in cache. -- **InventoryLanguagePack** The count of the number of this particular object type present on this device. -- **InventoryMediaCenter** The count of the number of this particular object type present on this device. -- **InventorySystemBios** The count of the number of this particular object type present on this device. -- **InventorySystemMachine** The count of the number of this particular object type present on this device. -- **InventorySystemProcessor** The count of the number of this particular object type present on this device. -- **InventoryTest** The count of the number of this particular object type present on this device. -- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. -- **PCFP** The count of the number of this particular object type present on this device. -- **SystemMemory** The count of the number of this particular object type present on this device. -- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. -- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_19H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_CO21H2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_CO21H2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_CO21H2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_CO21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_CO21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_CO21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19ASetup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_CO21H2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_CO21H2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_CO21H2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_CO21H2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_CO21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_CO21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_CO21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_CO21H2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH2** The total number of objects of this type present on this device. +- **DecisionSModeState_20H1** The total number of objects of this type present on this device. +- **DecisionSModeState_21H1** The total number of objects of this type present on this device. +- **DecisionSModeState_21H2** The total number of objects of this type present on this device. +- **DecisionSModeState_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSModeState_CO21H2** The total number of objects of this type present on this device. +- **DecisionSModeState_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSModeState_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_19ASetup** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H2** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemBios_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS1** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS2** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH1** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_20H1** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_21H1** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_21H2** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_20H1** The total number of objects of this type present on this device. +- **DecisionSystemMemory_21H1** The total number of objects of this type present on this device. +- **DecisionSystemMemory_21H2** The total number of objects of this type present on this device. +- **DecisionSystemMemory_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemMemory_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessor_RS2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_20H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_21H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_20H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_21H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_20H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_21H1** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_CO21H2** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_19H1** The total number of objects of this type present on this device. +- **DecisionTest_20H1** The total number of objects of this type present on this device. +- **DecisionTest_20H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_21H1** The total number of objects of this type present on this device. +- **DecisionTest_21H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_21H2** The total number of objects of this type present on this device. +- **DecisionTest_21H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_CO21H2** The total number of objects of this type present on this device. +- **DecisionTest_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_RS1** The total number of objects of this type present on this device. +- **DecisionTest_RS2** The total number of objects of this type present on this device. +- **DecisionTest_RS3** The total number of objects of this type present on this device. +- **DecisionTest_RS4** The total number of objects of this type present on this device. +- **DecisionTest_RS5** The total number of objects of this type present on this device. +- **DecisionTest_TH1** The total number of objects of this type present on this device. +- **DecisionTest_TH2** The total number of objects of this type present on this device. +- **DecisionTpmVersion_20H1** The total number of objects of this type present on this device. +- **DecisionTpmVersion_21H1** The total number of objects of this type present on this device. +- **DecisionTpmVersion_21H2** The total number of objects of this type present on this device. +- **DecisionTpmVersion_21H2Setup** The total number of objects of this type present on this device. +- **DecisionTpmVersion_CO21H2** The total number of objects of this type present on this device. +- **DecisionTpmVersion_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionTpmVersion_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_20H1** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_21H1** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_21H2** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_21H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_CO21H2** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_CU22H2Setup** The total number of objects of this type present on this device. +- **InventoryApplicationFile** The total number of objects of this type present on this device. +- **InventoryDeviceContainer** The total number of objects of this type present on this device. +- **InventoryDevicePnp** The total number of objects of this type present on this device. +- **InventoryDriverBinary** The total number of objects of this type present on this device. +- **InventoryDriverPackage** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventoryMediaCenter** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **InventorySystemMachine** The total number of objects of this type present on this device. +- **InventorySystemProcessor** The total number of objects of this type present on this device. +- **InventoryTest** The total number of objects of this type present on this device. +- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemMemory** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. +- **SystemProcessorLahfSahf** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. - **SystemProcessorSse2** The total number of objects of this type present on this device. -- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemTouch** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_19H1** The count of the number of this particular object type present on this device. -- **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. -- **Wmdrm_20H1** The count of the number of this particular object type present on this device. -- **Wmdrm_20H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. -- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. -- **Wmdrm_RS5** The count of the number of this particular object type present on this device. -- **Wmdrm_TH1** The count of the number of this particular object type present on this device. -- **Wmdrm_TH2** The count of the number of this particular object type present on this device. +- **Wmdrm_19H1** The total number of objects of this type present on this device. +- **Wmdrm_19H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_20H1** The total number of objects of this type present on this device. +- **Wmdrm_20H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_21H1** The total number of objects of this type present on this device. +- **Wmdrm_21H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_21H2** The total number of objects of this type present on this device. +- **Wmdrm_21H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_CO21H2** The total number of objects of this type present on this device. +- **Wmdrm_CO21H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_CU22H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_RS1** The total number of objects of this type present on this device. +- **Wmdrm_RS2** The total number of objects of this type present on this device. +- **Wmdrm_RS3** The total number of objects of this type present on this device. +- **Wmdrm_RS4** The total number of objects of this type present on this device. +- **Wmdrm_RS5** The total number of objects of this type present on this device. +- **Wmdrm_TH1** The total number of objects of this type present on this device. +- **Wmdrm_TH2** The total number of objects of this type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd @@ -1039,6 +1213,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSModeStateAdd + +This event sends true/false compatibility decision data about the S mode state. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Appraiser decision about eligibility to upgrade. +- **LockdownMode** S mode lockdown mode. + + +### Microsoft.Windows.Appraiser.General.DecisionSModeStateStartSync + +The DecisionSModeStateStartSync event indicates that a new set of DecisionSModeStateAdd events will be sent. This event is used to make compatibility decisions about the S mode state. Microsoft uses this information to understand and address problems regarding the S mode state for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd This event sends compatibility decision data about the BIOS to help keep Windows up to date. @@ -1075,6 +1273,106 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeAdd + +This event indicates that this object type was added. This data refers to the Disk size in the device. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser decision for upgrade experience marker. +- **TotalSize** Disk size in Gb. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeStartSync + +Start sync event for physical disk size data. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresAdd + +This data attribute refers to the number of Cores a CPU supports. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** The Appraisal decision about eligibility to upgrade. +- **CpuCores** Number of CPU Cores. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresStartSync + +This event signals the start of telemetry collection for CPU cores in Appraiser. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuModelAdd + +This event sends true/false compatibility decision data about the CPU. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Armv81Support** Arm v8.1 Atomics support. +- **Blocking** Appraiser decision about eligibility to upgrade. +- **CpuFamily** Cpu family. +- **CpuModel** Cpu model. +- **CpuStepping** Cpu stepping. +- **CpuVendor** Cpu vendor. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuModelStartSync + +The DecisionSystemProcessorCpuModelStartSync event indicates that a new set of DecisionSystemProcessorCpuModelAdd events will be sent. This event is used to make compatibility decisions about the CPU. Microsoft uses this information to understand and address problems regarding the CPU for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedAdd + +This event sends compatibility decision data about the CPU, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser OS eligibility decision. +- **Mhz** CPU speed in MHz. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedStartSync + +This event collects data for CPU speed in MHz. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionTestAdd This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. @@ -1110,6 +1408,55 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser binary (executable) generating the events. +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionAdd + +This event collects data about the Trusted Platform Module (TPM) in the device. TPM technology is designed to provide hardware-based, security-related functions. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision based on the device's TPM support. +- **TpmVersionInfo** The version of Trusted Platform Module (TPM) technology in the device. + + +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionStartSync + +The DecisionTpmVersionStartSync event indicates that a new set of DecisionTpmVersionAdd events will be sent. This event is used to make compatibility decisions about the TPM. Microsoft uses this information to understand and address problems regarding the TPM for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootAdd + +This event collects information about data on support and state of UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision when checking for UEFI support. +- **SecureBootCapable** Is UEFI supported? +- **SecureBootEnabled** Is UEFI enabled? + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootStartSync + +Start sync event data for UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + ### Microsoft.Windows.Appraiser.General.GatedRegChange This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. @@ -2073,6 +2420,7 @@ This event sends data about the mobile and cellular network used by the device ( The following fields are available: +- **CellularModemHWInstanceId0** HardwareInstanceId of the embedded Mobile broadband modem, as reported and used by PnP system to identify the WWAN modem device in Windows system. Empty string (null string) indicates that this property is unknown for telemetry. - **IMEI0** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. - **IMEI1** Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage. - **MCC0** Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. @@ -2084,10 +2432,13 @@ The following fields are available: - **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US. - **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. - **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. +- **ModemOptionalCapabilityBitMap0** A bit map of optional capabilities in modem, such as eSIM support. - **NetworkAdapterGUID** The GUID of the primary network adapter. - **NetworkCost** Represents the network cost associated with a connection. - **SPN0** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. - **SPN1** Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage. +- **SupportedDataClassBitMap0** A bit map of the supported data classes (i.g, 5g 4g...) that the modem is capable of. +- **SupportedDataSubClassBitMap0** A bit map of data subclasses that the modem is capable of. ### Census.OS @@ -2214,6 +2565,7 @@ The following fields are available: - **IsSawGuest** Indicates whether the device is running as a Secure Admin Workstation Guest. - **IsSawHost** Indicates whether the device is running as a Secure Admin Workstation Host. - **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. +- **NGCSecurityProperties** String representation of NGC security information. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. - **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. @@ -2744,6 +3096,61 @@ This event reports the results of deferring Windows Content to keep Windows up t +## Deployment extensions + +### DeploymentTelemetry.Deployment_End + +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** Client ID of the user utilizing the D360 API. +- **ErrorCode** Error code of action. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **Mode** Phase in upgrade. +- **RelatedCV** The correction vector (CV) of any other related events +- **Result** End result of the action. + + +### DeploymentTelemetry.Deployment_SetupBoxLaunch + +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** The client ID of the user utilizing the D360 API. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **Quiet** Whether Setup will run in quiet mode or full mode. +- **RelatedCV** The correlation vector (CV) of any other related events. +- **SetupMode** The current setup phase. + + +### DeploymentTelemetry.Deployment_SetupBoxResult + +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** Client ID of the user utilizing the D360 API. +- **ErrorCode** Error code of the action. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **Quiet** Indicates whether Setup will run in quiet mode or full mode. +- **RelatedCV** The correlation vector (CV) of any other related events. +- **SetupMode** The current Setup phase. + + +### DeploymentTelemetry.Deployment_Start + +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ClientId** Client ID of the user utilizing the D360 API. +- **FlightId** The specific ID of the Windows Insider build the device is getting. +- **Mode** The current phase of the upgrade. +- **RelatedCV** The correlation vector (CV) of any other related events. + + ## Diagnostic data events ### Microsoft.Windows.Test.WindowsCoreTelemetryTestProvider.WindowsCoreTelemetryTestEvent @@ -2855,6 +3262,7 @@ The following fields are available: - **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. - **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. - **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **IsProcessorMode** True if it is Processor Mode, false otherwise. - **PreviousPermissions** Bitmask of previous telemetry state. - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. @@ -2865,13 +3273,13 @@ This event sends data about the connectivity status of the Connected User Experi The following fields are available: -- **CensusExitCode** Last exit code of the Census task. -- **CensusStartTime** Time of last Census run. -- **CensusTaskEnabled** True if Census is enabled, false otherwise. -- **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** The network state of the device. +- **CensusExitCode** Returns last execution codes from census client run. +- **CensusStartTime** Returns timestamp corresponding to last successful census run. +- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. -- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. +- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period. ### TelClientSynthetic.EventMonitor_0 @@ -3091,6 +3499,37 @@ This event is a low latency health alert that is part of the 4Nines device healt ## Direct to update events +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability + +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ApplicabilityResult** Result of CheckApplicability function. +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **IsCTA** If device has the CTA regkey set. +- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the AAD (Azure Active Directory) domain. +- **IsDeviceADDomainJoined** Indicates whether the device is logged in to the AD (Active Directory) domain. +- **IsDeviceCloverTrail** Indicates whether the device has a Clover Trail system installed. +- **IsDeviceDiskSpaceLow** If device disk space is low. +- **IsDeviceEnterpriseSku** If device is an Enterprise SKU. +- **IsDeviceFeatureUpdatingPaused** Indicates whether Feature Update is paused on the device. +- **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network. +- **IsDeviceOobeBlocked** Indicates whether the OOBE (Out of Box Experience) is blocked on the device. +- **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device. +- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date. +- **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated. +- **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications. +- **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services). +- **IsDeviceWUFBManaged** If device is WUfB managed. +- **IsDeviceZeroExhaust** Indicates whether the device subscribes to the Zero Exhaust policy to minimize connections from Windows to Microsoft. +- **IsGreaterThanMaxRetry** Indicates whether the DTU (Direct to Update) service has exceeded its maximum retry count. +- **IsVolumeLicensed** Indicates whether a volume license was used to authenticate the operating system or applications on the device. + + ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. @@ -3254,6 +3693,19 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator WaitForRebootUi call. + +The following fields are available: + +- **CampaignID** Campaign ID being run. +- **ClientID** Client ID being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **hResult** HRESULT of the failure. + + ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. @@ -3462,6 +3914,19 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** Campaign ID being run +- **ClientID** Client ID being run +- **CoordinatorVersion** Coordinator version of DTU +- **CV** Correlation vector +- **hResult** HRESULT of the failure + + ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. @@ -3474,6 +3939,120 @@ The following fields are available: - **CV** Correlation vector. +### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure + +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** The ID of the campaigning being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. +- **hResult** The HRESULT of the failure. + + +### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess + +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CampaignID** ID of the campaign being run. +- **ClientID** ID of the client receiving the update. +- **CoordinatorVersion** Coordinator version of Direct to Update. +- **CV** Correlation vector. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEnteringState + +This event indicates that DTUNotificationUX has started processing a workflow state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** The coordinator version of Direct To Update. +- **CV** Correlation vector. +- **State** State of the workflow. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEvaluation + +This event indicates that Applicability DLL ran a set of applicability tests. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **Action** The enumeration code of action that was handled. +- **ActiveTestExpectedResults** Bitmask of expected results of applicability tests. +- **ActiveTestResults** The bitmask results of applicability tests. +- **ActiveTestsRun** The bitmask of applicability tests that were run. +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** The coordinator version of Direct To Update. +- **CV** Correlation vector. +- **FullTestResults** The bitmask of results of applicability tests. +- **FullTestsRun** The bitmask of applicability tests that were run. +- **SuppressedTests** The bitmask of applicability tests that were unable to run due to suppression caused by the configuration settings. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExit + +This event indicates that DTUNotificationUX has finished execution. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **HRESULTCausingExit** HRESULT Causing an abnormal exit, or S_OK for normal exits. +- **ProcessExitCode** The exit code that DTUNotificationUX returns to DTUCoordinator. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExitingState + +This event indicates that DTUNotificationUX has stopped processing a workflow state. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **HRESULT** Error (if any) that occurred. +- **NextState** Next workflow state we will enter. +- **State** The state of the workflow. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXFirstAcceptDialogDisplayed + +This event indicates that the First Accept dialog has been shown. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. +- **EnterpriseAttribution** If true, the user is told that the enterprise managed the reboot. +- **HRESULT** Error (if any) that occurred. +- **UserResponse** Enumeration code indicating the user response to a dialog. + + +### Microsoft.Windows.DirectToUpdate.DTUNotificationUXLaunch + +This event indicates that DTUNotificationUX has launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CampaignID** The ID of the campaign being run. +- **ClientID** The ID of the client being run. +- **CommandLine** Command line passed to DTUNotificationUX. +- **CoordinatorVersion** Coordinator version of DTU. +- **CV** Correlation vector. + + ## DISM events ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU @@ -3954,6 +4533,8 @@ The following fields are available: - **FileSigningInfo** A count of file signing objects in cache. - **Generic** A count of generic objects in cache. - **HwItem** A count of hwitem objects in cache. +- **InventoryAcpiPhatHealthRecord** No content is currently available. +- **InventoryAcpiPhatVersionElement** No content is currently available. - **InventoryApplication** A count of application objects in cache. - **InventoryApplicationAppV** A count of application AppV objects in cache. - **InventoryApplicationDriver** A count of application driver objects in cache @@ -3964,6 +4545,7 @@ The following fields are available: - **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache. - **InventoryDeviceMediaClass** A count of device media objects in cache. - **InventoryDevicePnp** A count of device Plug and Play objects in cache. +- **InventoryDeviceSensor** No content is currently available. - **InventoryDeviceUsbHubClass** A count of device usb objects in cache - **InventoryDriverBinary** A count of driver binary objects in cache. - **InventoryDriverPackage** A count of device objects in cache. @@ -3977,6 +4559,7 @@ The following fields are available: - **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache - **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache - **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache +- **InventoryVersion** No content is currently available. - **Metadata** A count of metadata objects in cache. - **Orphan** A count of orphan file objects in cache. - **Programs** A count of program objects in cache. @@ -4025,6 +4608,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **LattePackageId** The ID of the Latte package. - **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. @@ -4288,7 +4872,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device @@ -4326,6 +4910,29 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.Core.InventoryDeviceSensorAdd + +This event sends basic metadata about sensor devices on a machine. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **Manufacturer** Sensor manufacturer. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceSensorStartSync + +This event indicates that a new set of InventoryDeviceSensor events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. @@ -4561,248 +5168,6 @@ The following fields are available: - **InventoryVersion** The version of the inventory binary generating the events. -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device -- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device -- **OMID** Identifier for the Office SQM Machine -- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit -- **OTenantId** Unique GUID representing the Microsoft O365 Tenant -- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 -- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. -- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. -- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag -- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request -- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts -- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords -- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control -- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted -- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) -- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL -- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior -- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows -- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OfficeApplication** The name of the Office application. -- **OfficeArchitecture** The bitness of the Office application. -- **OfficeVersion** The version of the Office application. -- **Value** The insights collected about this entity. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OC2rApps** A GUID the describes the Office Click-To-Run apps -- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus -- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word -- **OProductCodes** A GUID that describes the Office MSI products - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **BrowserFlags** Browser flags for Office-related products. -- **ExchangeProviderFlags** Provider policies for Office Exchange. -- **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd - -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Design** Count of files with design issues found. -- **Design_x64** Count of files with 64 bit design issues found. -- **DuplicateVBA** Count of files with duplicate VBA code. -- **HasVBA** Count of files with VBA code. -- **Inaccessible** Count of files that were inaccessible for scanning. -- **InventoryVersion** The version of the inventory binary generating the events. -- **Issues** Count of files with issues detected. -- **Issues_x64** Count of files with 64-bit issues detected. -- **IssuesNone** Count of files with no issues detected. -- **IssuesNone_x64** Count of files with no 64-bit issues detected. -- **Locked** Count of files that were locked, preventing scanning. -- **NoVBA** Count of files with no VBA inside. -- **Protected** Count of files that were password protected, preventing scanning. -- **RemLimited** Count of files that require limited remediation changes. -- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues. -- **RemSignificant** Count of files that require significant remediation changes. -- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues. -- **Score** Overall compatibility score calculated for scanned content. -- **Score_x64** Overall 64-bit compatibility score calculated for scanned content. -- **Total** Total number of files scanned. -- **Validation** Count of files that require additional manual validation. -- **Validation_x64** Count of files that require additional manual validation for 64-bit issues. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd - -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Count** Count of total Microsoft Office VBA rule violations -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -5005,6 +5370,8 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. @@ -5015,10 +5382,12 @@ The following fields are available: - **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -5033,6 +5402,7 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. @@ -5043,10 +5413,12 @@ The following fields are available: - **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -5062,20 +5434,25 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. - **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_localId** If the device is using Windows Defender Application Guard, this is the Software Quality Metrics (SQM) ID of the container. - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -5090,6 +5467,8 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. @@ -5100,10 +5479,12 @@ The following fields are available: - **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -5155,6 +5536,9 @@ The following fields are available: - **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **expDeviceId** A non-unique resettable device ID to identify a device in experimentation. +- **expETag** An identifier representing all service applied configurations and experiments when current update happens. Used for testing only. +- **hwDiskType** Device’s hardware disk type. - **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. @@ -5162,8 +5546,12 @@ The following fields are available: - **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwLogcicalCpus** Number of logical CPUs of the device. Used for testing only. +- **hwLogicalCpus** Number of logical CPUs of the device. - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **oemProductManufacturer** The device manufacturer name. +- **oemProductName** The product name of the device defined by device manufacturer. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. - **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. @@ -5193,6 +5581,8 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. @@ -5203,10 +5593,12 @@ The following fields are available: - **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -5431,7 +5823,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## ONNX events +## ONNX runtime events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5457,6 +5849,460 @@ The following fields are available: - **totalRunDuration** Total running/evaluation time from last time. - **totalRuns** Total number of running/evaluation from last time. + +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **telemetryPrivacyType** The telemetry opt-in setting for this gateway. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + +### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties + +This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. + +The following fields are available: + +- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. +- **nodeOperatingSystem** A user friendly description of the node's OS version. +- **nodeOSVersion** A major or minor build version string for the node's OS. +- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. +- **nodeUuid** Universal unique identifier GUID. +- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. + + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Hardware level data about battery performance. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + + +### Microsoft.Windows.Deployment.Imaging.AppExit + +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned from app exit. +- **sId** Session Id of the application. +- **totalTimeInMs** Total time taken in Ms. + + +### Microsoft.Windows.Deployment.Imaging.AppInvoked + +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. +- **sId** Id of the session. + + +### Microsoft.Windows.Deployment.Imaging.Failed + +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned. +- **msg** Message returned. +- **sId** Session Id. +- **stack** Stack information. + + +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted + +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **sId** Session id for the application. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. + + +### Microsoft.Windows.Deployment.Imaging.ImagingStarted + +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. +- **sId** Session id for the app. + + +### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete + +This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **applicable** The operations that were needed to be attempted. +- **failed** Result of the individual operations that were attempted. +- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationFailed + +This event is raised after an executable delivered by Mitigation Service has run and failed. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. Failure data will also be used for root-cause investigation by feature teams, as signal to halt mitigation rollout and, possible follow-up action on specific devices still impacted by the problem because the mitigation failed (i.e. reoffer it to impacted devices). The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **atleastOneMitigationSucceeded** Bool flag indicating if at least one mitigation succeeded. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **countDownloadedPayload** Count instances of payload downloaded. +- **description** Description of failure. +- **devicePreference** Recommended Troubleshooting Setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionHR** HR code of the execution of the mitigation. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, eg when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **exitCode** Exit code of the execution of the mitigation. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Config state of the experiment. +- **hr** HRESULT for error code. +- **isActiveSessionPresent** If an active user session is present on the device. +- **isCriticalMitigationAvailable** If a critical mitigation is available to this device. +- **isFilteringSuccessful** If the filtering operation was successful. +- **isReApply** reApply status for the mitigation. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationRequestWithCompressionFailed** Boolean flag indicating if HTTP request with compression failed for this device. +- **mitigationServiceResultFetched** Boolean flag indicating if mitigation details were fetched from the admin service. +- **mitigationVersion** String indicating version of the mitigation. +- **oneSettingsMetadataParsed** If OneSettings metadata was parsed successfully. +- **oneSettingsSchemaVersion** Schema version used by the OneSettings parser. +- **onlyNoOptMitigationsPresent** Checks if all mitigations were no opt. +- **parsedOneSettingsFile** Indicates if OneSettings parsing was successful. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **subType** Error type. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalNumberOfApplicableMitigations** Total number of applicable mitigations. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationSucceeded + +This event is raised after an executable delivered by Mitigation Service has successfully run. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **devicePreference** Recommended troubleshooting setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, for example, when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Feature state for the experiment. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationVersion** String indicating version of the mitigation. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ControlId** String identifying the control (if any) that was selected by the user during presentation. +- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. +- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. +- **InteractionCampaignID** The ID of the interaction campaign that was processed. +- **ResultId** The result of the evaluation/presentation. +- **WasCompleted** True if the interaction campaign is complete. +- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit + +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch + +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent + +This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. +- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. +- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. +- **ResultId** The result generated by the evaluation and presentation. +- **WasCompleted** True if the user interaction campaign is complete. +- **WasPresented** True if the user interaction campaign is displayed to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. + + +### Microsoft.Xbox.Multiplayer.Bumblelion.OnConnectToNetworkCompleted + +No content is currently available. + +The following fields are available: + +- **ClientInstanceId** The client-generated globally unique identifier of this instance of bumblelion. +- **ConnectDurationInMs** The duration of the isolated connection operation in milliseconds. +- **DurationInMs** The duration of this request in milliseconds. +- **ErrorDetail** The PartyError error detail code. +- **Hostname** The hostname of the relay we are trying to connect to. +- **IsLocalUdpSocketBindAddressConfigurationTitleSpecified** Whether the title has overridden the local UDP socket bind address configuration for this instance of PlayFab Party. +- **LocalConnectionId** A local identifier to disambiguate multiple connections to the same network from a single client. +- **LocalUdpSocketBindAddressConfigurationOptions** The additional options set by the title to control how the Party library binds to a UDP socket. +- **LocalUdpSocketBindAddressConfigurationPort** The port value specified by the title in the local UDP socket bind address configuration. +- **LocalUdpSocketSelectedPort** The bound port for this instance of PlayFab Party. +- **NetworkIdentifier** The network's unique identifier. +- **Port** The port we are trying to connect to. +- **QosLatencyInMs** Qos latency in ms. +- **QosRank** Qos rank. +- **RegionName** The region Name associated with the underlying relay for the network. +- **Result** The PartyStateChangeResult of the operation. +- **TotalDurationInMs** The duration of connection operation and all associated operations queued before it in milliseconds. + + +### Microsoft.Xbox.Multiplayer.Bumblelion.OnCreateNewNetworkCompleted + +No content is currently available. + +The following fields are available: + +- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. +- **DirectPeerConnectivityOptions** The direct peer connectivity options specified when creating the network. +- **DurationInMs** The duration of this request in milliseconds. +- **ErrorDetail** The PartyError error detail code. +- **Hostname** The hostname of the relay we are trying to create. +- **MaxDeviceCount** The maximum device count specified in the network configuration. +- **MaxDevicesPerUserCount** The maximum devices per user count specified in the network configuration. +- **MaxEndpointsPerDeviceCount** The maximum endpoints per device count specified in the network configuration. +- **MaxUserCount** The maximum user count specified in the network configuration. +- **MaxUsersPerDeviceCount** The maximum users per device count specified in the network configuration. +- **NetworkIdentifier** The network's unique identifier. +- **Port** The relay's port. +- **PreferredRegionLatenciesInMs** Preferred region latencies in ms. +- **PreferredRegionNames** Preferred region names. +- **RegionCount** The count of regions specified when creating the network. +- **RegionName** The region name associated with the newly created network. Empty if the creation failed. +- **RequestedRelayBuildAliasId** The requested relay build alias ID. +- **RequestedRelayVersion** The requested relay version including the protocol version and tag. +- **Result** The PartyStateChangeResult of the operation. +- **ServerId** The ServerId field from the PlayFab RequestPartyResponse. +- **VmId** The VmId field from the PlayFab RequestPartyResponse. + + +### Microsoft.Xbox.Multiplayer.Bumblelion.OnNetworkDestroyed + +This event is emitted when a network is destroyed. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **AuthenticatedLocalUserCount** The count of authenticated local users when the network was destroyed. +- **AuthenticatedLocalUserPeakCount** The peak count of authenticated local users over the lifetime of the network. +- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. +- **ErrorDetail** The PartyError error detail code. +- **FirstNetworkIdentifier** The network's unique identifier at the time it was created. +- **Hostname** The relay's hostName. +- **LocalConnectionId** A local identifier to disambiguate multiple connections to the same network from a single client. +- **LocalPrivateEndpointCount** The count of local private endpoints when the network was destroyed. +- **LocalPrivateEndpointPeakCount** The peak count of local private endpoints over the lifetime of the network. +- **LocalPublicEndpointCount** The count of local public endpoints when the network was destroyed. +- **LocalPublicEndpointPeakCount** The peak count of local public endpoints over the lifetime of the network. +- **LocalUserCount** The count of local users when the network was destroyed. +- **LocalUserPeakCount** The peak count of local users over the lifetime of the network. +- **MigrationCount** The number of migrations attempted. +- **NetworkIdentifier** The network's unique identifier. +- **Port** The relay's port. +- **Reason** The PartyDestroyedReason that the network was destroyed. +- **RegionName** The region Name associated with the underlying relay for the network. +- **RemoteDeviceActiveDirectLinkPeakCount** The peak count of remote devices to which the local device had concurrently chosen the direct link as the data transmission path over the lifetime of the network. +- **RemoteDeviceCount** The count of remote devices when the network was destroyed. +- **RemoteDeviceEvaluatingDirectLinkPeakCount** The peak count of remote devices to which the local device was concurrently evaluating a direct peer connection over the lifetime of the network. +- **RemoteDevicePeakCount** The peak count of remote devices over the lifetime of the network. +- **RemotePrivateEndpointCount** The count of remote private endpoints when the network was destroyed. +- **RemotePrivateEndpointPeakCount** The peak count of remote private endpoints over the lifetime of the network. +- **RemotePublicEndpointCount** The count of remote public endpoints when the network was destroyed. +- **RemotePublicEndpointPeakCount** The peak count of remote public endpoints over the lifetime of the network. +- **StateBeforeDestroy** The last NetworkModelState of the network before it was destroyed. +- **TimeSpentInAuthenticatedStateInMs** The total number of milliseconds spent in the Authenticated state. +- **TimeSpentInConnectingStateInMs** The total number of milliseconds spent in the Connecting state. +- **TimeSpentInDeauthenticatingStateInMs** The total number of milliseconds spent in the Deauthenticating state. +- **TimeSpentInLeavingStateInMs** The total number of milliseconds spent in the Leaving state. +- **TimeSpentInNewStateInMs** The total number of milliseconds spent in the New state. +- **TimeSpentInReadyStateInMs** The total number of milliseconds spent in the Ready state. +- **TimeSpentInUnauthenticatedStateInMs** The total number of milliseconds spent in the Unauthenticated state. + + +### Microsoft.Xbox.Multiplayer.Bumblelion.OnPlayFabError + +No content is currently available. + +The following fields are available: + +- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. +- **ErrorCode** The PlayFabError ErrorCode value. +- **ErrorMessage** The PlayFabError ErrorMessage value. +- **ErrorName** The PlayFabError ErrorName value. +- **HttpStatusCode** The PlayFabError HttpCode value. +- **HttpStatusString** The PlayFabError HttpStatus value. +- **RequestId** The OutstandingPlayFabRequestID of the request that had an error. +- **RequestType** The OutstandingPlayFabRequestType of the request that had an error. + + +### Microsoft.Xbox.Multiplayer.Bumblelion.OnQosCompleted + +No content is currently available. + +The following fields are available: + +- **AverageLatenciesInMilliseconds** A semicolon-delimited list of average latencies across all pings to a given QoS server, in milliseconds. +- **AverageLatencyVariancesInMilliseconds** A semicolon-delimited list of latency variances (stddev squared) across all pings to a given QoS server, in milliseconds. +- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. +- **ErrorDetail** The PartyError detail code provided to the game as a result of the QoS operation. +- **FirstAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the first ping attempted to each QoS server. +- **FirstResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the first ping that had a successful response, to each QoS server. +- **Hostnames** A semicolon-delimited list of QoS server hostNames. +- **IpAddresses** A semicolon-delimited list of QoS server IP addresses. +- **LastAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the last ping attempted to each QoS server. +- **LastResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the last ping that had a successful response, to each QoS server. +- **LatenciesInMilliseconds** A semicolon-delimited list of median latencies across all pings to a given QoS server, in milliseconds. +- **MaximumLatenciesInMilliseconds** A semicolon-delimited list of maximum latencies across all pings to a given QoS server, in milliseconds. +- **MinimumLatenciesInMilliseconds** A semicolon-delimited list of minimum latencies across all pings to a given QoS server, in milliseconds. +- **PingErrorCodes** A semicolon-delimited list of the last error code encountered while pinging each QoS server. +- **PingFailureCounts** A semicolon-delimited list of failed ping counts to each QoS server. +- **PingFailureDueToTimeoutCounts** A semicolon-delimited list of timed-out ping counts to each QoS server. +- **PingSuccessCounts** A semicolon-delimited list of successful ping counts to each QoS server. +- **RegionCount** The number of regions. +- **RegionNames** A semicolon-delimited list of region names. +- **SecondAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the second ping attempted to each QoS server. +- **SecondResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the second ping that had a successful response, to each QoS server. +- **StateChangeResult** The PartyStateChangeResult provided to the game as a result of the QoS operation. +- **TimeToGetRegionListInMilliseconds** The time it took to get the region list, in milliseconds. +- **TimeToMeasureLatencyInMilliseconds** The time it took to measure latency to all regions, in milliseconds. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5627,6 +6473,32 @@ The following fields are available: - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. +## SIH events + +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ## Software update events ### SoftwareUpdateClientTelemetry.CheckForUpdates @@ -6117,33 +6989,6 @@ The following fields are available: - **UpdateId** The update ID for a specific piece of content. - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. -## Surface events - -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent - -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **batteryData** Hardware level data about battery performance. -- **batteryData.data()** Battery performance data. -- **BatteryDataSize:** Size of the battery performance data. -- **batteryInfo.data()** Battery performance data. -- **BatteryInfoSize:** Battery performance data. -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. - - -### Microsoft.Surface.Health.Binary.Prod.McuHealthLog - -This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. - -The following fields are available: - -- **CUtility::GetTargetNameA(Target)** Sub component name. -- **HealthLog** Health indicator log. -- **healthLogSize** 4KB. -- **productId** Identifier for product model. ## System reset events @@ -6451,6 +7296,7 @@ The following fields are available: - **ScenarioId** Indicates the update scenario. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdatePriority** Indicates the priority that Update Agent is requested to run in for the install phase of an update. ### Update360Telemetry.UpdateAgentMerge @@ -8651,6 +9497,7 @@ The following fields are available: - **updateId** The Windows Update device GUID. - **wuDeviceid** The Windows Update device GUID. + ### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. @@ -8777,6 +9624,9 @@ The following fields are available: - **ExpediteUpdaterCurrentUbr** The ubr of the device. - **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. - **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **ExpediteUpdatesInProgress** Comma delimited list of updates in progress. +- **ExpediteUsoCorrelationVector** The current USO correlation vector as surfaced from the USO store. +- **ExpediteUsoLastError** The last error as surfaced from the USO store. - **GlobalEventCounter** Counts the number of events for this provider. - **PackageVersion** The package version label. @@ -8804,6 +9654,7 @@ This event sends results of the expedite USO scan. The data collected with this The following fields are available: - **CV** Correlation vector. +- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. - **ExpediteErrorBitMap** Bit map value for any error code. - **ExpeditePolicyId** The policy ID of the expedite request. - **ExpediteResult** Boolean value for success or failure. @@ -8993,17 +9844,6 @@ The following fields are available: - **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin - -This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. - - ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 2605b80713..be1464937c 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,5 +1,5 @@ --- -description: Use this article to learn more about what required Windows 10 version 2004 and version 20H2 diagnostic data is gathered. +description: Use this article to learn more about what required Windows diagnostic data is gathered. title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/30/2020 +ms.date: 04/28/2021 --- @@ -57,210 +57,346 @@ This event lists the types of objects and how many of each exist on the client d The following fields are available: -- **DatasourceApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DatasourceApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DatasourceDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DatasourceDriverPackage_RS2** The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device. -- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DatasourceDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoBlock_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPassive_RS2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS2** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DataSourceMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device. -- **DatasourceSystemBios_RS2** The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device. -- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device. -- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS4Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DatasourceSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS2** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH1** The count of the number of this particular object type present on this device. -- **DecisionApplicationFile_TH2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device. -- **DecisionDevicePnp_RS2** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH1** The count of the number of this particular object type present on this device. -- **DecisionDevicePnp_TH2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device. -- **DecisionDriverPackage_RS2** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS4Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH1** The count of the number of this particular object type present on this device. -- **DecisionDriverPackage_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device. -- **DecisionMatchingInfoBlock_RS2** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device. -- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device. -- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoBlock_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPassive_RS2** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device. -- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPassive_TH2** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_19H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device. -- **DecisionMatchingInfoPostUpgrade_RS2** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device. -- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device. -- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH1** The count of the number of this particular object type present on this device. -- **DecisionMatchingInfoPostUpgrade_TH2** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_19H1Setup** The total DecisionMediaCenter objects targeting the next release of Windows on this device. -- **DecisionMediaCenter_20H1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device. -- **DecisionMediaCenter_RS2** The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device. -- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device. -- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH1** The count of the number of this particular object type present on this device. -- **DecisionMediaCenter_TH2** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_20H1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_20H1Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device. -- **DecisionSystemBios_RS2** The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device. -- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device. -- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device. -- **DecisionSystemBios_RS4Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device. -- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. -- **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. -- **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. -- **InventoryApplicationFile** The count of the number of this particular object type present on this device. -- **InventoryLanguagePack** The count of the number of this particular object type present on this device. -- **InventoryMediaCenter** The count of the number of this particular object type present on this device. -- **InventorySystemBios** The count of the number of this particular object type present on this device. -- **InventoryTest** The count of the number of this particular object type present on this device. -- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device. -- **PCFP** The count of the number of this particular object type present on this device. -- **SystemMemory** The count of the number of this particular object type present on this device. -- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device. -- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device. +- **DatasourceApplicationFile_19H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS2** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH1** The total number of objects of this type present on this device. +- **DatasourceApplicationFile_TH2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS2** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH1** The total number of objects of this type present on this device. +- **DatasourceDevicePnp_TH2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS2** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH1** The total number of objects of this type present on this device. +- **DatasourceDriverPackage_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DataSourceMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_21H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_CO21H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_CU22H2Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS2** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device. +- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH1** The total number of objects of this type present on this device. +- **DatasourceSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_19H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_20H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H1Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_21H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS2** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device. +- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH1** The total number of objects of this type present on this device. +- **DecisionApplicationFile_TH2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_21H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device. +- **DecisionDevicePnp_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH1** The total number of objects of this type present on this device. +- **DecisionDevicePnp_TH2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_19H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_20H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H1Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_21H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS2** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS4Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device. +- **DecisionDriverPackage_RS5Setup** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH1** The total number of objects of this type present on this device. +- **DecisionDriverPackage_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoBlock_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPassive_TH2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH1** The total number of objects of this type present on this device. +- **DecisionMatchingInfoPostUpgrade_TH2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_19H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_20H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H1Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_21H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS2** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device. +- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH1** The total number of objects of this type present on this device. +- **DecisionMediaCenter_TH2** The total number of objects of this type present on this device. +- **DecisionSModeState_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSModeState_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSModeState_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_20H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H1** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H1Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H2** The total number of objects of this type present on this device. +- **DecisionSystemBios_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS1** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS2** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS3** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS4Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5** The total number of objects of this type present on this device. +- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH1** The total number of objects of this type present on this device. +- **DecisionSystemBios_TH2** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemDiskSize_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemMemory_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuCores_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuModel_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionSystemProcessorCpuSpeed_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_19H1** The total number of objects of this type present on this device. +- **DecisionTest_20H1** The total number of objects of this type present on this device. +- **DecisionTest_20H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_21H1** The total number of objects of this type present on this device. +- **DecisionTest_21H1Setup** The total number of objects of this type present on this device. +- **DecisionTest_21H2** The total number of objects of this type present on this device. +- **DecisionTest_21H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionTest_RS1** The total number of objects of this type present on this device. +- **DecisionTest_RS2** The total number of objects of this type present on this device. +- **DecisionTest_RS3** The total number of objects of this type present on this device. +- **DecisionTest_RS4** The total number of objects of this type present on this device. +- **DecisionTest_RS5** The total number of objects of this type present on this device. +- **DecisionTest_TH1** The total number of objects of this type present on this device. +- **DecisionTest_TH2** The total number of objects of this type present on this device. +- **DecisionTpmVersion_21H2Setup** The total number of objects of this type present on this device. +- **DecisionTpmVersion_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionTpmVersion_CU22H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_21H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_CO21H2Setup** The total number of objects of this type present on this device. +- **DecisionUefiSecureBoot_CU22H2Setup** The total number of objects of this type present on this device. +- **InventoryApplicationFile** The total number of objects of this type present on this device. +- **InventoryLanguagePack** The total number of objects of this type present on this device. +- **InventoryMediaCenter** The total number of objects of this type present on this device. +- **InventorySystemBios** The total number of objects of this type present on this device. +- **InventoryTest** The total number of objects of this type present on this device. +- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device. +- **PCFP** The total number of objects of this type present on this device. +- **SystemMemory** The total number of objects of this type present on this device. +- **SystemProcessorCompareExchange** The total number of objects of this type present on this device. +- **SystemProcessorLahfSahf** The total number of objects of this type present on this device. - **SystemProcessorNx** The total number of objects of this type present on this device. - **SystemProcessorPrefetchW** The total number of objects of this type present on this device. - **SystemProcessorSse2** The total number of objects of this type present on this device. -- **SystemTouch** The count of the number of this particular object type present on this device. +- **SystemTouch** The total number of objects of this type present on this device. - **SystemWim** The total number of objects of this type present on this device. -- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device. +- **SystemWindowsActivationStatus** The total number of objects of this type present on this device. - **SystemWlan** The total number of objects of this type present on this device. -- **Wmdrm_19H1** The count of the number of this particular object type present on this device. -- **Wmdrm_19H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. -- **Wmdrm_20H1** The count of the number of this particular object type present on this device. -- **Wmdrm_20H1Setup** The total Wmdrm objects targeting the next release of Windows on this device. -- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS2** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers. -- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device. -- **Wmdrm_RS5** The count of the number of this particular object type present on this device. -- **Wmdrm_TH1** The count of the number of this particular object type present on this device. -- **Wmdrm_TH2** The count of the number of this particular object type present on this device. +- **Wmdrm_19H1** The total number of objects of this type present on this device. +- **Wmdrm_19H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_20H1** The total number of objects of this type present on this device. +- **Wmdrm_20H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_21H1** The total number of objects of this type present on this device. +- **Wmdrm_21H1Setup** The total number of objects of this type present on this device. +- **Wmdrm_21H2** The total number of objects of this type present on this device. +- **Wmdrm_21H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_CO21H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_CU22H2Setup** The total number of objects of this type present on this device. +- **Wmdrm_RS1** The total number of objects of this type present on this device. +- **Wmdrm_RS2** The total number of objects of this type present on this device. +- **Wmdrm_RS3** The total number of objects of this type present on this device. +- **Wmdrm_RS4** The total number of objects of this type present on this device. +- **Wmdrm_RS5** The total number of objects of this type present on this device. +- **Wmdrm_TH1** The total number of objects of this type present on this device. +- **Wmdrm_TH2** The total number of objects of this type present on this device. ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd @@ -452,6 +588,17 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -718,6 +865,17 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -757,6 +915,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSModeStateAdd + +This event sends true/false compatibility decision data about the S mode state. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. +- **Blocking** Appraiser decision about eligibility to upgrade. +- **LockdownMode** S mode lockdown mode. + + +### Microsoft.Windows.Appraiser.General.DecisionSModeStateStartSync + +The DecisionSModeStateStartSync event indicates that a new set of DecisionSModeStateAdd events will be sent. This event is used to make compatibility decisions about the S mode state. Microsoft uses this information to understand and address problems regarding the S mode state for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd This event sends compatibility decision data about the BIOS to help keep Windows up to date. @@ -782,6 +964,180 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeAdd + +This event indicates that this object type was added. This data refers to the Disk size in the device. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser decision during evaluation of hardware requirements during OS upgrade. +- **TotalSize** Total disk size in Mb. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemDiskSizeStartSync + +Start sync event for physical disk size data. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemMemoryAdd + +This event sends compatibility decision data about the system memory to help keep Windows up to date. Microsoft uses this information to understand and address problems regarding system memory for computers receiving updates. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Blocking information. +- **MemoryRequirementViolated** Memory information. +- **ramKB** Memory information in KB. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemMemoryStartSync + +The DecisionSystemMemoryStartSync event indicates that a new set of DecisionSystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresAdd + +This data attribute refers to the number of Cores a CPU supports. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** The Appraisal decision about eligibility to upgrade. +- **CpuCores** Number of CPU Cores. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuCoresStartSync + +This event signals the start of telemetry collection for CPU cores in Appraiser. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuModelAdd + +This event sends true/false compatibility decision data about the CPU. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Armv81Support** Arm v8.1 Atomics support. +- **Blocking** Appraiser decision about eligibility to upgrade. +- **CpuFamily** Cpu family. +- **CpuModel** Cpu model. +- **CpuStepping** Cpu stepping. +- **CpuVendor** Cpu vendor. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuModelStartSync + +The DecisionSystemProcessorCpuModelStartSync event indicates that a new set of DecisionSystemProcessorCpuModelAdd events will be sent. This event is used to make compatibility decisions about the CPU. Microsoft uses this information to understand and address problems regarding the CPU for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedAdd + +This event sends compatibility decision data about the CPU, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser OS eligibility decision. +- **Mhz** CPU speed in MHz. + + +### Microsoft.Windows.Appraiser.General.DecisionSystemProcessorCpuSpeedStartSync + +This event collects data for CPU speed in MHz. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionAdd + +This event collects data about the Trusted Platform Module (TPM) in the device. TPM technology is designed to provide hardware-based, security-related functions. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision based on the device's TPM support. +- **TpmVersionInfo** The version of Trusted Platform Module (TPM) technology in the device. + + +### Microsoft.Windows.Appraiser.General.DecisionTpmVersionStartSync + +The DecisionTpmVersionStartSync event indicates that a new set of DecisionTpmVersionAdd events will be sent. This event is used to make compatibility decisions about the TPM. Microsoft uses this information to understand and address problems regarding the TPM for computers receiving updates. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootAdd + +This event collects information about data on support and state of UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. +- **Blocking** Appraiser upgradeability decision when checking for UEFI support. +- **SecureBootCapable** Is UEFI supported? +- **SecureBootEnabled** Is UEFI enabled? + + +### Microsoft.Windows.Appraiser.General.DecisionUefiSecureBootStartSync + +Start sync event data for UEFI Secure boot. UEFI is a verification mechanism for ensuring that code launched by firmware is trusted. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser file generating the events. + + ### Microsoft.Windows.Appraiser.General.GatedRegChange This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date. @@ -1357,23 +1713,6 @@ The following fields are available: ## Audio endpoint events -### MicArrayGeometry - -This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. - -The following fields are available: - -- **MicCoords** The location and orientation of the microphone element. -- **usFrequencyBandHi** The high end of the frequency range for the microphone. -- **usFrequencyBandLo** The low end of the frequency range for the microphone. -- **usMicArrayType** The type of the microphone array. -- **usNumberOfMicrophones** The number of microphones in the array. -- **usVersion** The version of the microphone array specification. -- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). -- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). -- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). -- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). - ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -1602,7 +1941,7 @@ The following fields are available: - **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store. - **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine. - **OSEdition** Retrieves the version of the current OS. -- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc. +- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc - **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC). - **OSSKU** Retrieves the Friendly Name of OS Edition. - **OSSubscriptionStatus** Represents the existing status for enterprise subscription feature for PRO machines. @@ -2062,18 +2401,6 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common data fields - -### Ms.Device.DeviceInventoryChange - -Describes the installation state for all hardware and software components available on a particular device. - -The following fields are available: - -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. ## Component-based servicing events @@ -2338,6 +2665,7 @@ The following fields are available: - **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. - **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. - **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **IsProcessorMode** True if it is Processor Mode, false otherwise. - **PreviousPermissions** Bitmask of previous telemetry state. - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. @@ -2356,6 +2684,7 @@ The following fields are available: - **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. - **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. - **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **IsProcessorMode** True if it is Processor Mode, false otherwise. - **PreviousPermissions** Bitmask of previous telemetry state. - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. @@ -2366,13 +2695,13 @@ This event sends data about the connectivity status of the Connected User Experi The following fields are available: -- **CensusExitCode** Last exit code of the Census task. -- **CensusStartTime** Time of last Census run. -- **CensusTaskEnabled** True if Census is enabled, false otherwise. -- **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** The network state of the device. +- **CensusExitCode** Returns last execution codes from census client run. +- **CensusStartTime** Returns timestamp corresponding to last successful census run. +- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. -- **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. +- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period. ### TelClientSynthetic.HeartBeat_5 @@ -2598,9 +2927,11 @@ The following fields are available: - **DeviceInstanceId** The unique identifier of the device in the system. - **FirstInstallDate** The first time a driver was installed on this device. +- **InstallFlags** Flag indicating how driver setup was called. - **LastDriverDate** Date of the driver that is being replaced. - **LastDriverInbox** Indicates whether the previous driver was included with Windows. - **LastDriverInfName** Name of the INF file (the setup information file) of the driver being replaced. +- **LastDriverPackageId** ID of the driver package installed on the device before the current install operation began. ID contains the name + architecture + hash. - **LastDriverVersion** The version of the driver that is being replaced. - **LastFirmwareDate** The date of the last firmware reported from the EFI System Resource Table (ESRT). - **LastFirmwareRevision** The last firmware revision number reported from EFI System Resource Table (ESRT). @@ -2980,6 +3311,7 @@ The following fields are available: - **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache - **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache - **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache +- **InventoryVersion** The version of the inventory binary generating the events. - **Metadata** A count of metadata objects in cache. - **Orphan** A count of orphan file objects in cache. - **Programs** A count of program objects in cache. @@ -3010,6 +3342,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **LattePackageId** The ID of the Latte package. - **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. @@ -3248,7 +3581,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device @@ -3286,6 +3619,29 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.Core.InventoryDeviceSensorAdd + +This event sends basic metadata about sensor devices on a machine. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. +- **Manufacturer** Sensor manufacturer. + + +### Microsoft.Windows.Inventory.Core.InventoryDeviceSensorStartSync + +This event indicates that a new set of InventoryDeviceSensor events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **InventoryVersion** The version of the inventory binary generating the events. + + ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. @@ -3427,9 +3783,17 @@ The following fields are available: - **Manufacturer** Name of the DRAM manufacturer. - **Model** Model and submodel of the memory. - **Slot** Slot the DRAM is plugged into the motherboard. -- **Speed** MHZ the memory is currently configured and used at. -- **Type** Reports DDR, etc. as an enumeration value per DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Speed** The configured memory slot speed in MHz. +- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration as per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync @@ -3495,248 +3859,6 @@ The following fields are available: - **InventoryVersion** The version of the inventory binary generating the events. -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd - -This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device -- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device -- **OMID** Identifier for the Office SQM Machine -- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit -- **OTenantId** Unique GUID representing the Microsoft O365 Tenant -- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000 -- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows) - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd - -This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature. -- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files. -- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag -- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request -- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2) -- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts -- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords -- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control -- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted -- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC) -- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL -- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior -- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows -- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd - -This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OfficeApplication** The name of the Office application. -- **OfficeArchitecture** The bitness of the Office application. -- **OfficeVersion** The version of the Office application. -- **Value** The insights collected about this entity. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd - -This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. -- **OC2rApps** A GUID the describes the Office Click-To-Run apps -- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus -- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word -- **OProductCodes** A GUID that describes the Office MSI products - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd - -This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **BrowserFlags** Browser flags for Office-related products. -- **ExchangeProviderFlags** Provider policies for Office Exchange. -- **InventoryVersion** The version of the inventory binary generating the events. -- **SharedComputerLicensing** Office shared computer licensing policies. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync - -This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd - -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Design** Count of files with design issues found. -- **Design_x64** Count of files with 64 bit design issues found. -- **DuplicateVBA** Count of files with duplicate VBA code. -- **HasVBA** Count of files with VBA code. -- **Inaccessible** Count of files that were inaccessible for scanning. -- **InventoryVersion** The version of the inventory binary generating the events. -- **Issues** Count of files with issues detected. -- **Issues_x64** Count of files with 64-bit issues detected. -- **IssuesNone** Count of files with no issues detected. -- **IssuesNone_x64** Count of files with no 64-bit issues detected. -- **Locked** Count of files that were locked, preventing scanning. -- **NoVBA** Count of files with no VBA inside. -- **Protected** Count of files that were password protected, preventing scanning. -- **RemLimited** Count of files that require limited remediation changes. -- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues. -- **RemSignificant** Count of files that require significant remediation changes. -- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues. -- **Score** Overall compatibility score calculated for scanned content. -- **Score_x64** Overall 64-bit compatibility score calculated for scanned content. -- **Total** Total number of files scanned. -- **Validation** Count of files that require additional manual validation. -- **Validation_x64** Count of files that require additional manual validation for 64-bit issues. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd - -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **Count** Count of total Microsoft Office VBA rule violations -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove - -This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync - -This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - -### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync - -This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - -The following fields are available: - -- **InventoryVersion** The version of the inventory binary generating the events. - - ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. @@ -3896,19 +4018,25 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. - **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_localId** If the device is using Windows Defender Application Guard, this is the Software Quality Metrics (SQM) ID of the container. - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -3923,19 +4051,24 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. - **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_localId** If the device is using Windows Defender Application Guard, this is the Software Quality Metrics (SQM) ID of the container. - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -3950,19 +4083,25 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. - **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_localId** If the device is using Windows Defender Application Guard, this is the Software Quality Metrics (SQM) ID of the container. - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -3977,19 +4116,25 @@ The following fields are available: - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. - **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_localId** If the device is using Windows Defender Application Guard, this is the Software Quality Metrics (SQM) ID of the container. - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -4040,6 +4185,10 @@ The following fields are available: - **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. - **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **expDeviceId** A non-unique resettable device ID to identify a device in experimentation. +- **expEtag** An identifier representing all service applied configurations and experiments when current update happens. Used for testing only. +- **expETag** An identifier representing all service applied configurations and experiments when current update happens. Used for testing only. +- **hwDiskType** Device’s hardware disk type. - **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. @@ -4047,8 +4196,12 @@ The following fields are available: - **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwLogcicalCpus** Number of logical CPUs of the device. Used for testing only. +- **hwLogicalCpus** Number of logical CPUs of the device. - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **oemProductManufacturer** The device manufacturer name. +- **oemProductName** The product name of the device defined by device manufacturer. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. - **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. @@ -4074,9 +4227,12 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_env** The environment from which the event was logged when testing; otherwise, the field is omitted or left blank. - **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **brandCode** Contains the 4 character brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **Channel** An integer indicating the channel of the installation (Canary or Dev). - **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. - **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. @@ -4084,12 +4240,15 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **installSourceName** A string representation of the installation source. - **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. - **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. - **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. - **pop_sample** A value indicating how the device's data is being sampled. +- **reactivationBrandCode** Contains the 4 character reactivation brand code or distribution tag that has been assigned to a partner. Not every Windows install will have a brand code. - **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. - **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. @@ -4325,6 +4484,168 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +## Other events + +### Microsoft.Windows.Deployment.Imaging.AppExit + +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned from app exit. +- **totalTimeInMs** Total time taken in Ms. + + +### Microsoft.Windows.Deployment.Imaging.AppInvoked + +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. + + +### Microsoft.Windows.Deployment.Imaging.Failed + +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cs** Line that failed. +- **ec** Execution status. +- **hr** HResult returned. +- **msg** Message returned. +- **stack** Stack information. + + +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted + +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. + + +### Microsoft.Windows.Deployment.Imaging.ImagingStarted + +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. + + +### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete + +This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **applicable** The operations that were needed to be attempted. +- **failed** Result of the individual operations that were attempted. +- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ControlId** String identifying the control (if any) that was selected by the user during presentation. +- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. +- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. +- **InteractionCampaignID** The ID of the interaction campaign that was processed. +- **ResultId** The result of the evaluation/presentation. +- **WasCompleted** True if the interaction campaign is complete. +- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent + +This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. +- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. +- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. +- **ResultId** The result generated by the evaluation and presentation. +- **WasCompleted** True if the user interaction campaign is complete. +- **WasPresented** True if the user interaction campaign is displayed to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. + + +### SFR.NandDefragSubmitFailed + +No content is currently available. + + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -4353,37 +4674,6 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Sediment events - -### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings - -This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date. - -The following fields are available: - -- **CustomVer** The registry value for targeting. -- **IsMetered** TRUE if the machine is on a metered network. -- **LastVer** The version of the last successful run. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - -### Microsoft.Windows.Sediment.OSRSS.Error - -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **FailureType** The type of error encountered. -- **FileName** The code file in which the error occurred. -- **HResult** The failure error code. -- **LineNumber** The line number in the code file at which the error occurred. -- **ServiceVersionMajor** The Major version information of the component. -- **ServiceVersionMinor** The Minor version information of the component. -- **Time** The system time at which the event occurred. - - ## Setup events ### Microsoft.Windows.Setup.WinSetupBoot.BootBlockStart @@ -4460,6 +4750,12 @@ The following fields are available: - **ActivityMatchingId** Contains a unique ID identifying a single CheckForUpdates session from initialization to completion. - **AllowCachedResults** Indicates if the scan allowed using cached results. - **ApplicableUpdateInfo** Metadata for the updates which were detected as applicable +- **BiosFamily** The family of the BIOS (Basic Input Output System). +- **BiosName** The name of the device BIOS. +- **BiosReleaseDate** The release date of the device BIOS. +- **BiosSKUNumber** The sku number of the device BIOS. +- **BIOSVendor** The vendor of the BIOS. +- **BiosVersion** The version of the BIOS. - **BranchReadinessLevel** The servicing branch configured on the device. - **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null. - **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client. @@ -4469,8 +4765,10 @@ The following fields are available: - **ClientVersion** The version number of the software distribution client. - **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0. - **Context** Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown +- **CurrentMobileOperator** The mobile operator the device is currently connected to. - **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000). - **DeferredUpdates** Update IDs which are currently being deferred until a later time +- **DeviceModel** The device model. - **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered. - **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. - **DriverSyncPassPerformed** Were drivers scanned this time? @@ -4483,6 +4781,9 @@ The following fields are available: - **FeatureUpdateDeferral** The deferral period configured for feature OS updates on the device (in days). - **FeatureUpdatePause** Indicates whether feature OS updates are paused on the device. - **FeatureUpdatePausePeriod** The pause duration configured for feature OS updates on the device (in days). +- **FlightBranch** The branch that a device is on if participating in flighting (pre-release builds). +- **FlightRing** The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds). +- **HomeMobileOperator** The mobile operator that the device was originally intended to work with. - **IntentPFNs** Intended application-set metadata for atomic update scenarios. - **IPVersion** Indicates whether the download took place over IPv4 or IPv6 - **IsWUfBDualScanEnabled** Indicates if Windows Update for Business dual scan is enabled on the device. @@ -4504,6 +4805,7 @@ The following fields are available: - **PauseFeatureUpdatesStartTime** If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window. - **PauseQualityUpdatesEndTime** If quality OS updates are paused on the device, this is the date and time for the end of the pause time window. - **PauseQualityUpdatesStartTime** If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window. +- **PhonePreviewEnabled** Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced. - **ProcessName** The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided. - **QualityUpdateDeferral** The deferral period configured for quality OS updates on the device (in days). - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -4514,8 +4816,11 @@ The following fields are available: - **ScanProps** This is a 32-bit integer containing Boolean properties for a given Windows Update scan. The following bits are used; all remaining bits are reserved and set to zero. Bit 0 (0x1): IsInteractive - is set to 1 if the scan is requested by a user, or 0 if the scan is requested by Automatic Updates. Bit 1 (0x2): IsSeeker - is set to 1 if the Windows Update client's Seeker functionality is enabled. Seeker functionality is enabled on certain interactive scans, and results in the scans returning certain updates that are in the initial stages of release (not yet released for full adoption via Automatic Updates). - **ServiceGuid** An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.). - **ServiceUrl** The environment URL a device is configured to scan with +- **ShippingMobileOperator** The mobile operator that a device shipped on. - **StatusCode** Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult). - **SyncType** Describes the type of scan the event was +- **SystemBIOSMajorRelease** Major version of the BIOS. +- **SystemBIOSMinorRelease** Minor version of the BIOS. - **TargetMetadataVersion** For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null. - **TargetReleaseVersion** The value selected for the target release version policy. - **TotalNumMetadataSignatures** The total number of metadata signatures checks done for new metadata that was synced down. @@ -4875,6 +5180,21 @@ The following fields are available: ## Surface events +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Battery Performance data. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Size of the battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + ### Microsoft.Surface.Health.Binary.Prod.McuHealthLog This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. @@ -5035,6 +5355,24 @@ The following fields are available: - **PackageVersion** The package version label. +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + ### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5051,6 +5389,22 @@ The following fields are available: - **PackageVersion** The package version label. +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + ### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. @@ -5072,7 +5426,9 @@ This event sends results of the expedite USO scan. The data collected with this The following fields are available: +- **CartPolicySetOnDevice** True if the cart policy is set for the device. - **CV** Correlation vector. +- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. - **ExpediteErrorBitMap** Bit map value for any error code. - **ExpeditePolicyId** The policy ID of the expedite request. - **ExpediteResult** Boolean value for success or failure. @@ -5096,8 +5452,10 @@ This event sends telemetry that USO scan has been started. The data collected wi The following fields are available: +- **CartPolicySetOnDevice** True if the cart policy is set for a given device. - **CV** Correlation vector. - **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. - **ExpeditePolicyId** The policy Id of the expedite request. - **ExpediteResult** Boolean value for success or failure. - **ExpediteUpdaterCurrentUbr** The UBR of the device. @@ -5159,6 +5517,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved + +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. @@ -5259,15 +5629,15 @@ The following fields are available: - **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin -This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. +This event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: - **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. +- **GlobalEventCounter** The global event counter for counting total events for the provider. +- **PackageVersion** The version for the current package. ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin @@ -5338,6 +5708,7 @@ The following fields are available: - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeBundle** Cumulative size (in bytes) of the downloaded bundle content. - **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. - **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. - **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. @@ -5347,11 +5718,13 @@ The following fields are available: - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique ID for each flight. - **InternalFailureResult** Indicates a non-fatal error from a plugin. +- **NumberOfHops** Number of intermediate packages used to reach target version. - **ObjectId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). - **PackageCategoriesSkipped** Indicates package categories that were skipped, if applicable. - **PackageCountOptional** Number of optional packages requested. - **PackageCountRequired** Number of required packages requested. - **PackageCountTotal** Total number of packages needed. +- **PackageCountTotalBundle** Total number of bundle packages. - **PackageCountTotalCanonical** Total number of canonical packages. - **PackageCountTotalDiff** Total number of diff packages. - **PackageCountTotalExpress** Total number of express packages. @@ -5427,6 +5800,24 @@ The following fields are available: - **ScenarioId** Indicates the update scenario. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdatePriority** Indicates the priority that Update Agent is requested to run in for the install phase of an update. + + +### Update360Telemetry.UpdateAgentMerge + +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **ErrorCode** The error code returned for the current merge phase. +- **FlightId** Unique ID for each flight. +- **MergeId** The unique ID to join two update sessions being merged. +- **ObjectId** Unique value for each Update Agent mode. +- **RelatedCV** Related correlation vector value. +- **Result** Outcome of the merge phase of the update. +- **ScenarioId** Indicates the update scenario. +- **SessionId** Unique value for each attempt. +- **UpdateId** Unique ID for each update. ### Update360Telemetry.UpdateAgentMitigationResult @@ -5917,32 +6308,6 @@ The following fields are available: - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. -## Windows Admin Center events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed @@ -6016,7 +6381,7 @@ The following fields are available: ### Microsoft.Windows.Sense.Client.PerformanceScript.OnboardingScript -This event is triggered whenever Microsoft Defender for Endpoint onboarding script is run. The data collected with this event is used to keep Windows performing properly. +This event is triggered whenever WDATP onboarding script is run. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -6139,6 +6504,18 @@ The following fields are available: - **WUContentId** The Windows Update content ID. +### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds + +This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure. + + + +### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare + +This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure. + + + ### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure. @@ -6202,6 +6579,15 @@ The following fields are available: - **HResult** The result code of the last action performed before this operation. +### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds + +This event is sent after sending the inventory of the products installed to determine whether updates for those products are available. It's used to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed before this operation. + + ### Microsoft.Windows.StoreAgent.Telemetry.EndInstall This event is sent after a product has been installed to help keep Windows up-to-date and secure. @@ -6294,6 +6680,15 @@ The following fields are available: - **WUContentId** The Windows Update content ID. +### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare + +This event is sent after a scan for available app updates to help keep Windows up-to-date and secure. + +The following fields are available: + +- **HResult** The result code of the last action performed. + + ### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete This event is sent at the end of an app install or update to help keep Windows up-to-date and secure. @@ -6477,6 +6872,28 @@ This event sends basic information indicating that Feature Rollback has started. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded + +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. @@ -6492,6 +6909,18 @@ The following fields are available: - **wUfBConnected** Result of WUfB connection check. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded + +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled @@ -6548,6 +6977,7 @@ The following fields are available: - **cdnUrl** Url of the source Content Distribution Network (CDN). - **congestionPrevention** Indicates a download may have been suspended to prevent network congestion. - **dataSourcesTotal** Bytes received per source type, accumulated for the whole session. +- **doErrorCode** The Delivery Optimization error code that was returned. - **downlinkBps** The maximum measured available download bandwidth (in bytes per second). - **downlinkUsageBps** The download speed (in bytes per second). - **downloadMode** The download mode used for this file download session. @@ -6631,6 +7061,7 @@ The following fields are available: - **deviceProfile** Identifies the usage or form factor (such as Desktop, Xbox, or VM). - **diceRoll** Random number used for determining if a client will use peering. - **doClientVersion** The version of the Delivery Optimization client. +- **doErrorCode** The Delivery Optimization error code that was returned. - **downloadMode** The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100). - **downloadModeReason** Reason for the download. - **downloadModeSrc** Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9). @@ -6946,6 +7377,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.Detection + +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. + +The following fields are available: + +- **detectionBlockreason** The reason detection did not complete. +- **eventScenario** End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed. +- **interactive** Indicates whether the session was user initiated. +- **updateScenarioType** Identifies the type of update session being performed. +- **wuDeviceid** The unique device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.DetectionActivity This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date. @@ -6956,6 +7400,7 @@ The following fields are available: - **applicableUpdateList** The list of available updates. - **durationInSeconds** The amount of time (in seconds) it took for the event to run. - **expeditedMode** Indicates whether Expedited Mode is on. +- **networkCostPolicy** The network cost. - **scanTriggerSource** Indicates whether the scan is Interactive or Background. - **scenario** The result code of the event. - **scenarioReason** The reason for the result code (scenario). @@ -6998,6 +7443,23 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels + +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **configVersion** The escalation configuration version on the device. +- **downloadElapsedTime** Indicates how long since the download is required on device. +- **downloadRiskLevel** At-risk level of download phase. +- **installElapsedTime** Indicates how long since the install is required on device. +- **installRiskLevel** The at-risk level of install phase. +- **isSediment** Assessment of whether is device is at risk. +- **scanElapsedTime** Indicates how long since the scan is required on device. +- **scanRiskLevel** At-risk level of the scan phase. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. @@ -7086,6 +7548,12 @@ The following fields are available: This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. +The following fields are available: + +- **errorCode** Hex code for the error message, to allow lookup of the specific error. +- **settingsDownloadTime** Timestamp of the last attempt to acquire settings. +- **settingsETag** Version identifier for the settings. +- **wuDeviceid** Unique device ID used by Windows Update. ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask @@ -7116,6 +7584,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable + +This event defines when an optional update is available for the device to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** The unique identifier of the Windows Insider build on this device. +- **isFeatureUpdate** Indicates whether the update is a Feature Update. +- **revisionNumber** The revision number of the update. +- **updateId** The GUID (Globally Unique Identifier) of the update. +- **wuDeviceid** The Windows Update device identifier. + + ### Microsoft.Windows.Update.Orchestrator.StickUpdate This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. @@ -7185,6 +7666,30 @@ The following fields are available: - **wuDeviceid** Unique device ID controlled by the software distribution client. +### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh + +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. + +The following fields are available: + +- **configuredPoliciescount** Number of policies on the device. +- **policiesNamevaluesource** Policy name and source of policy (group policy, MDM or flight). +- **policyCacherefreshtime** Time when policy cache was refreshed. +- **updateInstalluxsetting** Indicates whether a user has set policies via a user experience option. +- **wuDeviceid** Unique device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.UpdaterMalformedData + +This event is sent when a registered updater has missing or corrupted information, to help keep Windows up to date. + +The following fields are available: + +- **malformedRegValue** The registry value that contains the malformed or missing entry. +- **updaterId** The ID of the updater. +- **wuDeviceid** Unique device ID used by Windows Update. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. @@ -7302,6 +7807,27 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.CryptcatsvcRebuild + +This event sends data specific to the CryptcatsvcRebuild mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** The unique identifier for each flight. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationNeeded** Information on whether the mitigation was needed. +- **MitigationScenario** The update scenario in which the mitigation was executed. +- **RelatedCV** Correlation vector value generated from the latest USO scan. +- **Result** HResult of this operation. +- **ScenarioId** ID indicating the mitigation scenario. +- **ScenarioSupported** Indicates whether the scenario was supported. +- **ServiceDisabled** Information on whether the service was disabled. +- **SessionId** Unique value for each update attempt. +- **UpdateId** Unique ID for each Update. +- **WuId** Unique ID for the Windows Update client. + + ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -7323,29 +7849,6 @@ The following fields are available: - **UpdateId** Unique ID for each Update. - **WuId** Unique ID for the Windows Update client. -### wilActivity - -This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. -- **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. -- **threadId** The ID of the thread on which the activity is executing. ## Windows Update Reserve Manager events @@ -7520,6 +8023,38 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. + + +## XBOX events + +### Microsoft.Xbox.EraControl.EraVmTerminationReason + +This event is triggered on ERA VM termination. + +The following fields are available: + +- **pfn** A package full name. +- **reasonNumber** A number associated with reason. + + +### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.1.SFR.XvdStreamingStart + +This event indicates that the XVDD streaming engine encountered an error when attempting to start streaming. + + + +### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.2.SFR.XvdStreamingStart + +This event indicates that the XVDD streaming engine encountered an error when attempting to start streaming. + + + +### XboxUpdate.NewSystemBoot + +This event indicates a new first boot into the system OS. + + + ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady From 3ee7d19621adefaf807d56517ba01a6418dd07f8 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 29 Apr 2021 16:36:28 +0100 Subject: [PATCH 14/41] update to versions --- .../basic-level-windows-diagnostic-events-and-fields-1703.md | 2 +- .../basic-level-windows-diagnostic-events-and-fields-1709.md | 2 +- .../basic-level-windows-diagnostic-events-and-fields-1803.md | 2 +- .../basic-level-windows-diagnostic-events-and-fields-1809.md | 4 ++-- .../basic-level-windows-diagnostic-events-and-fields-1903.md | 2 +- ...equired-windows-diagnostic-data-events-and-fields-2004.md | 5 +++-- windows/privacy/toc.yml | 2 +- 7 files changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 1830fe5c61..492fd0f8b9 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 0f56bd17f5..fadd1d0b31 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 7dd91a660b..5f10eba0c9 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 32fd5f8439..a11a2a2a37 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -4648,7 +4648,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 1cc399f38c..6777b7b07d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index be1464937c..5cb6293b88 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,6 +1,6 @@ --- description: Use this article to learn more about what required Windows diagnostic data is gathered. -title: Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) +title: Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -17,7 +17,7 @@ ms.date: 04/28/2021 --- -# Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields +# Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields > [!IMPORTANT] @@ -26,6 +26,7 @@ ms.date: 04/28/2021 **Applies to** +- Windows 10, version 21H1 - Windows 10, version 20H2 - Windows 10, version 2004 diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 52a6ddd6da..b631e434ef 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -15,7 +15,7 @@ href: Microsoft-DiagnosticDataViewer.md - name: Required Windows diagnostic data events and fields items: - - name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields + - name: Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields href: required-windows-diagnostic-data-events-and-fields-2004.md - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1903.md From 4ff268f843b2894f8377dd12b014814c118e893b Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 29 Apr 2021 10:00:46 -0700 Subject: [PATCH 15/41] removing file --- windows/deployment/images/configmgr-assets.png | Bin 139547 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/deployment/images/configmgr-assets.png diff --git a/windows/deployment/images/configmgr-assets.png b/windows/deployment/images/configmgr-assets.png deleted file mode 100644 index ac315148c5f7fa276cb84521b26d1332adcb144c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 139547 zcmZs?byQnH*Ed=(6f5pfG^Mx{hqOS82MV;fmqH3jfDjzgqQ%`MMGB?3I}|Avthl=- zI0Pr$KF@pKb=UpY_s3at=B%^U?3ww^o-Mx}q770edBX7I&Ye3Xswzr4ckbNJzjNnq z0KubwU-}w9wEb)D!gZ7t?vxBNZU5^$uzjuh`p%v5D57i2hyVJ7jw*)mJ9j8t{`1^j z_{8dd=g#d9Ri)Q@?q)lt55F*vkK;32aRX3UMmP2cB%Ey-><>e$3<7J$5=QVrr`nAdW-DNp6zjM(fJkIsKP4>C`;O2nv?c;O!2;sLts7Kyr?vJb^DdkRqLGDPr zTf2KqlKEh7NAGJIVx|OjNSe51S#jSI9YrQ~!$;3qcb0tAL9 zc2F8B?|pu-+!0L1`k$Bb`%j;?=M?#`ad74h%YD_Meke!cwA^a;{rXP;=ijV|?$<2I z4>Y|GdqSSyt=SfKECAo|ZM|hTws?1awx^vzEO*?_=yg56_6fhX z?=zM4MKj}?23lYC3>!9|k_MAM3FInSdxn%^%k&5p(of}nPac=0sx_Bl_KcHQZKaN= zUZcG*(r13iH_?B%%`NlH4Rlp!+g^Wj z8(pPphW>sT91tMFzd-y{^r_=a(7^itF8_b`L54sLWIK==IH(;F-2-Lg*j@Qm)x{$x$LK4N3Y*u%$9|Fl*hC8i7Uyn^ZS4>{m-W+-vs6CY9lfB_pr!_=WNVC zyun0zyda+qQLtf2QM^RHO@1VIB=y(M^-?>qPP=1ag>c4YqMxKNXL5OpiRQfHeG$SR zY$+6G8vHVGx{m=h$*Hj{qD@_5+%T%>E%gO4juFza44dIg>hexKtoF%wdaW+ang0WH zOR=NIC?h^4tsbJlTxD5RZ##WwPR_veo@hNMv~f1I-iT@lffKQEyGp(;JD4q2K|^&Z zpeiu%lvM+m*8=*z3-xb_QFmJ#2N}keE`SGv!Wn1 zSds>V676~-S%Q0leNWH=c3>|U_=;K4w1yvzKmSAD2q$>F5!BS(EO}028HcNuD^Hkq zDDX`;goujAbWZ$eVRm`(Mm1LESullzO|M&%Rod5xgsGl&pRCQiF-LD#zsw(o4QnSg z`AJgVLk@>)A7;NlRSylE&O<|roKv{ZEDg+R)5DSullbBd2veR=o9}pgOSVzl{F9T$ z+Y0kf$l`~ait^q~=1)VEn2mW{@8mpJb?$~I7Ngq$`NlyDAF^_X7U z=t1s3iEp1Jlb;o74-{R-eK``K+|RRdHgQr9GdI&$t#9bI74EPS!tPjl_5S#i&7YZNvR9`HSYiw$N zrKjGv!p1q-9n6UTRS=ayf?OZ_r`(K*{-;e-;Ola$aA=yVi$Qn2c75Wh-*Gri=$ZIw zyCnT6qPQW-tjEqvnIa=Y%B5<3cqU$P^zy+(3ACf3nx9?MpxLwe956hepztDvoPzQ7 zoBF3C-UQ6d^9ly47C!%7ql~DJ?AufSQK|nnmQwdWO4WUTxg>qz`rLW#qRCF^+r=>r zJ4=DmXoFY~N$FpS`VV>^wkOQhxN9FxD?M1JPI%GgNR_2RRqhVR^g4REBjQ1KEmod~umB!x`R z>z#@x`cS~_yEyg@G3aSfwN0fE%5tQg`qjRfOUsU2BGgkYwnh+fn(pJu~c+ z{E0P#gMXdN-BgVz@Klq*=C(IM%$J*;_}8UKphe`IXCu(OrN4m9@Vr4e7q>#KN2&!=`Y;w*)rfBP0l z`3c*bS9&Sw^JP8XbXEHBdB8;Z*xkjR!AqfidiOKJ#_{nD>thS%)7+sv3q;H?w<+Gk zg|nzJP!o0G(I)2UH}0lxfqg*}i|29WZu5p*IMAIMH!rAMKvK4cT86MOEwis@`n&R{ zTJo16^>StFwy7Ha3l5AMkmD`tw0C+N`bPRL*1k0wPY72aLps{ZB&^PuSCQ4%P0+)j zx~Wki+^c3Wb0_tUCy45o7ScbKXdnD{Q@uLOrRH7Z{{t82_;PNuUucYbUqEZR6J?LfQz%JEp**W}Q6BDU^+2>4^l^C|?#%Q?qMRQQ1w5hgF zxx;^kEpIMfNw#>O=y~t;fX~-r8khY_GeYgEG#+gVNsetZ+W0HDWQ173+S?+tUFoM3 zE$Qd1-i_&X9b9*~sm$oUr)jG)r&#s*I_dhe z&@mq{E6-mV^MW`wX|5_n_@dURSA}$Cmo+>p>O4BR~S|0mBaI~sGoiAOPlc6oGR5ols!z&f@!$WkDKTzqf zbb@o7WTn>idT7{7SmC16Riv@z+Eb24h|*G{z#g3yVf4%{*FEP?{lWG*KBIbQ$fh`m^U0&qol zJf6l+5d>A<17oh5;PRikh(nZp3>M#%;j~QG(?3p6LpPCoRK=8es>n3p8}!B&HuP+> zE};fBW2k?0yfGmAsr4j169CN=_aY!8W*P<{ zfh}~3`8(`}eLYGqC13S@?^Gpz>`7|0pvtuCO7UuRW*fB3c~-2C>OlD(D#~8>S;?NS z$V|aehIOmkwdGf4qH}F=mI#X~@Ij?Gh(Y>pzNAMY>6CbjJ{jXABI#uAB+z9v7fS21 zF2?7%3$BKj$zwXTmTCYCoxg*~Q-d`XSJh`~97^P^8ayQN;$)x&#IssBf$hDv2F{IU zd_{CsK1qtxk!5Q5ZI7vh9i5j+d=!7!nk6<*?=dxDM-_zGqvM?zupuNOn;GC{^vvW4NvOt@-w6{sS z3><2)R;g5~^$;xrWin-#AS@8pa?*GQEyk{K^P>q@OS*hghl{FfkhBrmf)I$MCbP-Y zkpdLkbDcU-+^%dJq4;L(>H7iWcF`6IAk4F7kY80NV?7!1C*)bjv~+HU<$^cP(B$Bc zmYs}&j?HnoXW{l*4sMA1dz*{E3K^Wyu4?gM9c}?`+ z-n>ofw9HVGLA~Ubv1M~4f{>-|n7dYRzk1*I7nWtzmd11+!t^9c9Xpx!80M!9yqxyL z5PmT4@;RuncRJrANxqs-jHDXovR23~I7!3G8->~^=@VD0xhGbC;l zhrIF%JVO8L3`UXBigV|C1gCQ!+1W#srN;xcp9O?gFc7oo0QO#wefVHG_w#PDB=lL3 zc)U6tl$p|bCNtrjzB9*ZOm8ylR~|#XH_PJnO1{%HYe|PNAS0-2P)vH%@Zc;1W*+V! z5J;f&lQb{d-ZX-3oGs>AU(Rdh-#eXQr=iJPY&tv~0L>ttsAR{)XPRj>X)-?>*zYqx zHUTAzf%{;y4A^Sqq;=|$SgGYR2RamF%VX2trl zxtY^gG)Wgu4Y03N2>)Cf`($kUg90Rf&Ju1Hpw2nXypLWFjDl2B1kuO8o87<})5Qs{ ze#;nkoT4ty;)40c!B~6D9Pk)FC1**)MTGUz#8i#=O~cx=%BiR~APsmHnJ%jtjQHJg1U6%v-rn z^5PIo-L&H%iE$SU1*d2^Yz}kU^PmL-m(EhA1tTT#V#M^aN<&0mz7_p5FtD`EM1zfw zirkjR9(hefCe|50f_k1*R-|r>3NKtvuURkWay3KFesZb2$@w`j&B88wHWh5x6_xJ& zXs_vl)u7S2KwV)AiiQmlvh0`d^NkNp6hQOifsLkdkUq)NON${JE_qIN5c4|+4~OXj z!PTc49jC}3-05qt9qPn)qwo)6dINk_{@*yvxnmnwejwYk?}AboJM3HTl!-g_4tIKUiM20;8f2sck&nuU zGLCtDVQh>F`3*W$5n|>`YkFvh}cGTnk{v4r@M5FQIW-|7whnL`i*! zLOe^j8|`K>bk$CuEO+&usSYc2y}bz>3!&BL6)!The56KR^2oe3+d z%=|hbYW1-3_Q(A^(o>yGEYgjT<#wo5kF4?YkL_eb%@2??#PV zKh;BRy?3jpCHKQ@w`c?~f5zD{7LOfEp<`hie7DMm(pnulHRgE8$;Wt0& zPcA$lHOn7fJ&BSi zGR^X|n~8mlZHH#uEYN~PDPge&=~sRqdk5FW#dQ zFZgLCgB!k3XES@Vy0yNCzcH~b z_Z0M7qM!%ZnBBJGoYdO*D8z8xrypQm@{-|Et=eo5t4&Ro8l4PVPVZ5f$(%r+kVY`1 zTe^yJr3;Zq3Sl6dL&SAW5@shC>24?jgO(?LKZZ6x%4hcag7F-Nb|4tPFPucn8Y0E{ zG$*1??UjF$-P9HD6{4gKv7x)L*?B)`f7m9azCY=-Pc92DPju6iTS^PGE#U-zR2ViM zrSxXBT(zJ&S^%)E}A5@F4td`J7An)+8?Od7{f z#@Sp^SNlSf+!2EK6Kmhp{D3SO!q8&$s@4ssna461KKff%zb4X*+!=BHx0||}D9iE! zkQbV+yMs0<9;=~Ye!fGrb5+D)rd!t>zg}i+Fr73ln4F}U6tLMgTZ*X7ej!D%{Ne9@ zrq{2AcMkJ*7o2h>Rl;%`$f+tePtC^b5uz&SqWdyobBi$3sxYxl2ZkEz9hxbq13Ss- z6*0X*vo2-LmWmpuoG}FfZ;zBQT5{Dao_DV{pdcWJvtLlxTKy&$wDKF=QFa^uD6Zr>zF$>x11%y-yl#w= ze;2}szRDQN2)|wM&6)LeU_8~`b#soeK+0ITg#g+wtqfqycIJ)&77H5wALDp?!rjiH zBn`3s}$)wCE9{}-hO^NIKz}9mwqoAZrFP+g@$fCcg z^WMN&^Ox8Se(HP_q+ly~G3-A!KzA^+fYf`*RV$-jaFV}MEU?JQ_;g$1D$$e|?j5o^4w4V!kJCOx!d4z1$+t4059!?2fOC1rq zwBmf9E3!`V#{=zmm6?KV&5Q#W_dSV$H}fyg=XioK7GMBpXDRaJrR-53h3xf_)s6^) zEJF-FjPL0l{JpNf@V)TMoIEb@SdeDKeot0ZU|$H%jzgN?P?faY2+yBh4Wq+cxFVKJ zt%Fv-^n8t3FN@>O(3W(|DQ3C7MpHN3M8$pT^4Q~v+u$e_Xp6Y@Aa2D^2VU|`9$0oD zcvq`T-8uwsueIi#H6&yXKDUUJ0i8EVe$6%u3OKE2)NWutM#nwj;?v1AzdcddaT~Tw z9UQuKXU3l&vu=IVK>a0`o4;#1GXfG>0<2;B&6c?%F4`+E3Ii>0;o(h0lR4U(a3Z8(>KHl)kmoSaSCnK~9SjC!9Bwtviw z8wsHVtYjt8fEgWEG-6-P^L<^#nvAk6R?)UwCYe?!C`XSz%-m8y29onv+ z-(H+mZwcCLDn*MR@!mVlx69JxRf0^*VP^3MD%6h7%FHTFk&>70;}J*4K$GC1beCvQ zO%-YG5JhXlK_Qe`V+Ns>F*btoiMY7M0DxmP*}yCA*+|GA)n~nX`C5`sCFYL2~6UBKWtZyTkLaepqi6j>7xt$p{Q;n;moWuBPo17m8Zwt>K zx4IQ{)H z7v3mqL2d9S@ol;zTAxqUjmVYsZBr?Xc6 zmhgHp3R!rAn_X zgQA9|SZL^mR92((;iHw-n`gVrUGjfSIEQozeYt>q~F#h<+SCs&w< zz_!Zc$(1Tm`M_i3xh{Wq$tc-an*QAT*F}acO2<_z|4paJ%RXnzpVI;O+sl7Bod9t* z#)*iobru^xTBNC}d6`{QLGSbH^TA>o2PMzI~m2`DzR#g1Q7b8pudG= zn72TLex}#G9PZt`HL8LK>`btPbhVjS*2ks5>uoK%+HPOTy)n`98s2Z1yB)$FFe&+U zho-|7%1;$58a0EhYx>e2YXL`bo4(9Mi|MPRX0AE~FcWGohM>;QkB%F!yjRVA151%- z>|FLHJl1p|JOZb}&BoM8m?~W#EejU$0gdsy5G2ql0HnA z$G#dRWk+3%)Vds5hY+=S8_c~(yR;ubZF^&g7KdAY#=ZO-;}eRj>6Wk5lSt*`m<^>| zZM?GZk(N4|)L4%S)=tv>X$XK3exJT=DX(CXOn~dp@Et1Z%Om1SA@s*!s*J zY?`l}A)DLAqkN(-;BP_@o`0f{-<5(cD>QC`h(}MV=QE_s{>2AQPg(so?_3S9BO6`= zVt4Y3uJ%o?d3W>s(>6%~r3FZ{Ig>w}AzV0l>jO@iIBaW- z7%r~a$!VbAg(%!qMXaX_j#pF7oW{~#NnJ4x@q4Yl)pJ5vNygT^%Xyn3rv9e=h+e&< z>rnP0(!}lO{Zd9T!=$rCczywld_@L$PWVWiF57LcU?XpGhFX1$@0WVH$ZhNGwthoI zc~(|iF8^+O+8vW(Gr(rr?&irPo~PZOeSW|0aNh{2o6q|FCf<3i7d0Z^m8Lz0vbe3C zRB0X*X1*|#$&zqX6H@OPyQ@pYYxiIX?AIBAQ@5PoX&CyNy0K)LQ#E(m1U!i5K)gwJ zO{2x>Ff;jVZHB_lrdO@Ci@gcGd0YEOdQyxlA<2hz)6_fAn49R-Jm~f+p|#y(@mBZ|F|#G~=eKK& z;O)qJgK^!Dr9Nj8A2XbC_egxi7D+0p>b5Wd zRRC@N3O>4QryeFk9s*Q{=Dw^{r{OMFDz)s8n|qJ_WImjDa_3Dj!iYVfPYxT}<(r`6 zIwbr5qhY*-D(^mKB0{Y2-d8eK&v)#lvegxFk4~@YTT1BYR2@IxQuVU3Sj2yOGh04+ zA}@JC*+?KYKp?d{Y+G~G)AJkk##UK|{qVUN>bNG?l%uy#Lzph6EsWQJoPH{xzh|k- z)>t``DNul|W8p4}_e~fL|BKXT{~QbjfK$4I5FcT%g3D$(s3=4KKv{{*?@;QSvpqjR zJ2g0<9BfC2Pj5^4p5b2<8VBq!IAIjic>IBaIZeJ+%L!-O%A@GQ)zdy6=3lB29sg8P z)#=CrP?pXq63&%>pP@fD8sG1KSobh?J>SvlZIRP;^CeGsZQKL_^NG37A$>*}{GNJt zp^YQvOBp3sOS~dlWZD76QN_YU%pz9zJ(v(&;d!mU4s zm^95#5r5jOfgIg}$~m(mj)A3r2`l>6+RisN<;{NT0=zq-AH@ZI!)QN$G*Kjm_;pYR zAIW+7=kkc4Fp`^)NFQNXJ42eyItmEMG85-(ldiT*1_FGbp7&~~S1TgzDENTr9#t8D zi>MoYKuTPAS?1Q@`7M63T8)oR3jhD3>K2oiI^u%DO2vnf@(We!>Wk$As)Vv>lZcn_#PP|J$ zqz{HzUeVupWR{rJ>vTjv&u~8RJ)e(SXNt8a?*-cQrd0}ip4g3QF~=%gO@-)|d0#k> z_hQB=9Wrztw_|Lv@w_OLVjHir;-8FHq&Sbg^4k{|t1q|_>!7Ef-Za-~CU0WHL+&5` z8S*w6t-yh^Jf(sYIgiu7_gd$5*b@va-mcx-MY}RSx4gbkxVbEq05?#ba!f4m-ZmNa z3d5A%xi?>**5_lo43q!H|k5O9HtGX=kEvp6a~;(TV}^6+LCx1JLW>V{fB zwz{nIowD^t&UZCBZ_DKIfn>I;!#9JsAf^1C{IN%Nh8af`&Epr5_Xv+^!b}=#-nutq zHUE?9TkVKscmCxcO-#_VfR5cVo5j_WRK_CzX zC1u(eT|pP=P2%6u!%{2EJx!L9^vl1Kjx-GTBwy>>8Aeo7F;NxJ27Vl9@OZ2~ppKVh zd&aYRY!>Xj#yQ{B2T@DEGwnEL3%95h!#(n?95(hP#r&93QGPwb#%Th^cPF$?I6HAg z@J6}VO6CpJrO!lG`&#I=1^*Vt)2p7RUtWNOEzq53$qbrH(_ z`5whHqRO^~_>PSsYkUELB;kguYz^b6b+gamwffvaN08d0Tl?t)2~!wLc^lk;XPKI=hSjbhZc*DEBR zdtZvkO}_HgV!QWbC6UwMBy#C;dx&RoIL3P5b1gh`mQl0@xK+=I9kB~w(sPAq$BKmbS{fWzw%3SmfMYd;7FQ^377ZjKy^bxC1C23olXmz zmfOdZBqxZIGUe$IJ)W@hG?C&e+N&vX-^Gypz+p-3N3#kbZ`(KPKOB3$lH>b2fgipv z#%!Fc@Ym$#5gAJn!uFU^-m@uB_1++3;N0c)fn4oM+cdAK)yycaJv%=EI`7H5`2=?} zV))OGyq(K7wylpiy(U8b@~A}W)DZyrP!1>9n7M5Zq~+g4$OzIw zb=Pa_RPoWwSDXWtB6PVsrZgDCdkA9Uv-ulX0>epq@cMjRC2KJyxakl(j1yGL2mePez znq=Rqk5dmDU}Zaaud6RXtM^N~5)=Cz3nO7xc9TYTw$JI@{isDGSKqRFBIj~l1k~(W4xP6jlFRdmR&sKFWmRB#9_Q#y8acfC z0YnF~AcUndtrce!#(4jYgvKPGVgZNQt@?uP%uCD?LF-SL4v*kk+e*J%jxbn!HKv5KfD=v=8H4ag`AGmTLqE(A`#d;W%tpK zjNe#3(1yL_rLkv0Hi1-VkQ57DmIl7k!N$_l2hvh;?Bz|a4}-xmOf7QzhynjKT|#1% zS6**arMfi3hwEa{HF=3|B&aY^P)8z2?&{cl6jG3Webf~Ky$b)vvfN$+E{Tpch)b{g z_~vq@;t$Mv>t}i19EjzO&)>LKTU;|GI zjU3+v&JQdiTMH6}%Ro)%q;q1lP2C4s*#NqlT zLE?b}($*dCAfqh^T^z4n4%HTHAU9*T%aR~y`Yxa`sT(Etbx$J+*Tdg&YNJ16D+?Ct z{|m@0xdGM6!x_s@9#TUO954M%*-Xpl95VD*ICpz9(1WjEALHq+iupWhuuK8Dw3md zEN&h;By#LTXm-CYA+d00EYK%`*W0}D)i-J+h+)Bn&mB~@z~>;@wJDlzr0gKGd7XtX zGG`o|csM)4!poKbe*-i626f=T{J>Qas)Ta$7w|r*HETWSr^MKIIIE>J2cGLX8LF#teb^NWI$yO_ML;&tH3$;(gxwohd9gmWAghY3Zi`a61zE% z`C513`U{TvP}+@&tpyi0x+vr65F2!2{rbkso|2szWjlk?nv!NuaI>1nbI$3V+XY7W ze;HJ(9S@Vzoy&$p3W+=K(nn)4S6085j8as(gxvLr{kt9rS?JNh7tMk;%}fLJH@OZ+ z=03;*Yst^#o9<*8JoFOVA5 zdvg>Btmb6eYyC&alJkDw-S@cK*L_x<@@U!Ln-ptdOX(6MIC?*z{44waWJ1Mi2CqJiHm`q%(sJ2cL58jK}=c;qq5!o36@a$aayrJj>~>3bJ;&a z!6^5d8VU1f3P&0%ef+}?iya_YG*?tWEvno*U?RBA-X|0)HZK&Jf%EO}1{UHj+eM=a zWdh?spgh$VLzi><)iCEmKAg4O%^7JW#hJ|smzpS6wu3;QVcTdHUGSbtR{vU0sxd~ zDi3iSuEH0*oyg6%vSH|W`PbQfweijg8OB&cH{ey61EQ5V|rOrk(zan-opL0Ztw ziq57m;Y8X~&wu_UXW8vxilN^mgr(G^Lc12HBWMh(g4_0SZ6Z}Qv7fHe9!60wl&r=_ zakm}%BL?P$&2LV6G2I7an`FS77O8#N<#}uJ2}ah0vYT)TvN=Xmkw`nU$p1H+PZs*= zG${Q@z?;qobH!#v%4bmbs9^X7r=mJ}A@=v&L$uRk&avY$a-mDptu-iZ&*QGd^_2%( z{`$YGnSfw>_1R2@3VRBOJw{`RqdPqSyI;qcgghRVT>o8gKIKd4I1*k?H{KeH{$#hS zw%ogE-X@6jyc;>=b`K=yE$Ds5Yr9%vOVhy1KQ9vVO!BGoaK1sdl0?RNUv9wtlrzJp z*rE6Fia^i2*k;8uxxcLsaIHAm%d zm8WgaQq%%S7kmPI7yKzH^V(F)nVW{r`;!n>okP6QLP9Km69&N-q*8d|n*-o+6)HjU zpeJf&X;n*NC|iXNV|C1zN(HxCf69LIH@*#pd!_x@IBE>B5Ldx5e!+5dAB>>uipiwn08;+-ACqP~`Pici2%*0i{}q^3Pr% z57GSD{Qff^N-k_bcTv=k&#{6JrPyLTx_HW4R1l>(2cNLy4v+sj3#xDLlW%WnPkZDB zY*o22P=Tww* zlR1o6Y<_NX*m@1CO}%t}(oahhQ}lwz!bhqM@jF4=7ds`HDzAPpP|=?Rd$5sKx!=6| zD53)|>rr|WZ*X+IQl6-<(egXuqy0o~+hr3+X)))sQ@Cb8F;QZK;M$6~#RhJbs3p|g z>_Tgx1B*QRTPfC@&syKj)geB#s&$oHGU0qB2n#C5za%@fW++-Tzuxvt_vqIkfiHD-*V?a8+HG*7uW_I2H=2NXa%WldEYQ$2Sy&)(uX(*xMhNrVv zIYp!*;)0&$^mPl>;DGMQyL)`nM;r9mK=3<(%LNI?KPcE(lVL4YOA!{knf?pnxb4;& z4l{R5QU5+oX1Dn=sW7iQ1MjgaprCL*%bKRusEzX4Z_s2FweU!8q4pxByi^b+_uUAI zLLOXLwAd~Un?7!o(WEnjVbr7y022|g!*vpx8Z>rDu7oo|VsmQn$IbXZx8M=^%|}x$ zidj4bf8rKt()kBfz8d(S?o;KZy~h2)q12Z|x4u?VF4qJbhnKuze;1OKZIwAL&k7Yp zP*lz_uNM2{3G)4)0USQtzcJ#r;GuV@NFk`$Cisl;d!d`J@fP%`_gnPbcVbDK^}F$5 zF8S!El(ic2U&1*lC`2?~$HIj)){yzVDma{ZpiI=`D?O=@>3YesgT zzGI8oZoxMZSaRa{KEUnoE@sVC!qh*IXaEjAwRzxDdofLYe`9;VKaR|+|DfR|zd;j8 z@OM-_BZ`TPoyYcP-Rk8u3Z`S5hvz*jbz; z4>EezU^rE5CC+4taKe>&$~^F2x03&yBsmraHrP_~msa;~fKx{s10amri#Pe=OPE;} z#hc%3Ml{Xu+9B?dB~a6zsO1Y~37P4`#6U1cT(j3-u&W-kNVfe^AD7^sT9OMJ&1=+L zY!2HeIL>JW4R?Mtoz>#4gK&VI{|wa#VwFh_D+|4dwf>&Q_Ok63i5mL`*|5x*bN-__ z`r&KRQ)zH+EAM{#2PIXI7r~9W{Vu^~;w(rFT}(3|i)scQs>sY(q!KYo2|Ki2P z`xX)%6cEMYdq_*UNA zJNh;IjHvkD@oac3r`s!1uBis5bo3yot4qyc?WkoKuKQV1Ugq`C2%p@V3w6cUDz(uD zXu{s$2bT~fbl>}rZ&f~UujvJG(05XTOCq_oX-X9gix_OEJ=n56h*<}z?~uL{IcEm| zbm{*7Wcxwx)c?^&<+Q(XZCXLATfM3^lG?n{7rRuiU~>HBp8a%Sy?I>DLYoAION#lEE^Rd>fXpf&0IA zG)FPYio3G8sTztS*%?sji{mwPg;0~+L>Z|V5TpSyy7oA(0!u>QY)e~?t)Y_5siYk*V|2NX+$yViRkJ?2tMyGhFjYiB*94yYD3~gf$9C-$;jvt{NZ}j;&eYBZ!VC zJGp-``fHnY)Z2fmrrsW{qWmm>Qu5y;LA%J}f5j!`_ONycX_i76(!o;MmQ2%32Fy)m zV6b6^IKTl9or%ok{N$Mv3@mN^T^PqADhJRCss(!;KXWe%(E5j3)mVd<=2)$dN6y7n zn{{7&#aX-FOCFwgt+4v+@?GN+l~20Dx#((;<^5Dp<4s%5I%l81u+ok_uc7BJXh$n0 zhUe-)SEEB-d%|+fs@CY|z*tZ%%lN&S!5R;WUztoK-% z0JCoJ#D+87`4>nJy$W6CCqi7E+Jf4XL*ktFY6V9wYof3YBqq(W2fYPRw-3+PT&yLN zax%jIZ{r?P!1qJbow+rdSvW79*&-gw* z3pXHUzk5aOWBVV-0AbZ_@td_X|CP38TP+9DTt6w%-#XpJ0Kld$LbXnUM5*oStVZ6fn%tk>~* zR2*sYRvn#V7{<2sP?0Nd?sIQ~|H9HlW1Ke_`OJVc)a@Tt%aALeov7j17ANpo_bU$I zK|QsHn`zE3C_HxjzmpDI5L=97e+Xm)?Wl-Y)4NXZ1b=dPiDp* zKHB|*l7__RjTdr8y6Kd7K)Kb>yVX)toN zYwl;8{Y!-H625)NO6$bi@fs=g<>D{E`7>kvCm9AZs!d6o#C_xVqM5d6U1 zl$5o}dDhwFFZbr_X)$UnhnPRW=C)}z|1>=r^Msc$Lw(|3p;y;dNpf&Sgi@pd5`^9J z6Uy&=M1g>^+M-k|)tdy&drYa4_RPigP)7Dp4BTF*cE$P4e93U?m#(s57hGv{ORa2) zS%5TcWHD%=u4J6B5XZ5?wH==ClPHm|)>mEsd<6Yf3*>Vx_#2SVn6u_w8&_6N!C2oU zcrq8y5IF=It`t)zlQNAm`N>#sAyJXi6g?u#zWno>(4dLlBf?lT)xBk^*xo9FR+|@V zI-IuI z`Bow?AM!L&+_5GK%-F*jK*_n#X3Mxmaxblzd)%L8U&m#3ZzkwoL@Bb1FVsA?iij~! z;&z~|al7{pabcQbXjqj|$P zHfi>ZnJmx#4-o|oV`3Q|Dml5uznZzcF{>zx-FySa|M-5Jh|zws(J1u~S9*XO_{w1^ z?Tv|pNfrA^o+3EI0on`^aA1tPbChadOLuHk2pg-G5J>lin8|Iw3x)hew`1}V0@|js zmkuN~!DeZJ#r>buajUyO`QI!||7xBuBYBUhRVJHKqA*UnbR90B;!@rF!lYJ~z_oZ7 z3V9^{!HOg4EHE=o=YQ+Om7L{c zY0}>&^y_dw(}HwfZ^Ph{Wa->*mi$epWE?dG*Wnm)m`oXo!G1AKzsMH?k!pMQy-?Q) zeNa))DNz{=P$DH>}zuu-rD+~ zMN{}LPfA}KCq32emB|s-Xz`wS$r6Qm23euj_FntVlV81s1V~lSs7&N=z5=t1wGnw4 zENu*aqLe<+l6$TLx`3%M_v3@ z-cD*aD0cie>heDY_5X;Jkzdq7j53Pu2Z#FQ7T~a_swLqJ6e^#sGRcUyMSm_kDydS0 z6jetLr(1xKrmqoOcc?=YYsJ5VrbuSKm-EOQeoG*!zU{ls1g{_ zabpVX4c~440 zV+{CCQhBF#)03vi;Vwj&rvlv{kC@zczw*KoU#2klf(;~`U~dn_v3Txg0y%E}{8Lm` z4zge=+Y1`swxBGLOJs*8E!|?^4RS}JAIm3~&|z;g&h6c)sGFLib8&IoJ1x%cO{v{y zuy6nal{Ns8<;kno4!fl}788-&U-zG^oBUmuo@O{8Y?O(n!~e^d{eRaOg9o0Rq4(5o zetR$uTboBo49-k1GPSxj`YFWGNuA%8brg$NA8^)kj;;@lVWa_QU=e=*z^-?Kiovwg z`5=L<(mJ|iX81*#gYP&(xtW>*C_*qq12C#OouvQ(xrU?d+_TZ&!Ok64_=s;-l@SGa z@P&BLRgBuY6I%Vcy~5}nS@i2gR}^P^v?@Y+;FZsg#GH0+kH3#=g2USrC5k-;xT?Si z9}UWf@~;P3cg66$aTHzG)3>$7!}SV8p8}oNV%_>0pkt*-8!uZn*BbI;m7BW?L-2wU$h#F_nP8h2Ls2t#7>l%Dhni)&nJe8pv14|@c-Sr` z3I{p^dGmLLBd^gW)(~ftWeJox4cC=w$7!4hvwJ;W@(!atxQn|xab{AR0{XIrx-<>+f5H1-KQ1(42NQY} zknJ)jp%_`p(>EpB=7LQ6B!r+0Kzq2wN^^F&qMUl|d5$qhuqVqB3f z&AHlpF2(T@4F9SSB#9|?RG`e5fI}*?4)ka{;deUn?zMN0r zmu(3dgx@?j_b_nxF2ng^rn{*{ix7Mj-Y%GwX(Bi<1 zyFodGP31f?Hh_WDn+4ZX4KM;2loMX+IH1cuCdCrY7c+`xDk+?ONP{dJ@2C=q&mtQg zX*^Q;#%x+@UnKc!Pm|G3Oy&)Ip8~Vzy_JFQZX0?Ir^6BE6jS}EvWWOUQV?p1cfUle zAFG9C3<64GL?R#|rvWsfdljRew6;~%Y$Fl95kg7BFO_?Mm73gSSrH%>L6ekGc0EzK z4QtOT%#vs}m!46oc#U*Y&ZJIP!UT2XpzTnDBwa{v#F8y@R#mA=Pl1o{(GtxqCxGk^>c)e_|ydWfW2rGN&XXqcfBRo>5CN2^}dY<2g;V#sg)M zu;SYJYKub^b=^+tA|biwPFzBYvcdwxat*6y6OEky(l4zjVK!C`}%Wj=tRl}LmC zzf*Mn4=h*wZz?jhh>TZ5)xjT>9W9V$(TtlJ4#q-3EQp58^eedpo4{}71lxtwDoRiW zqMld~57!~1#>2)Y-GZ3vn~3cRi$*%K1d(UzA)9VkQEOIqt&=$&6FjI^TNDE>vTqaO zG(;>>nbsXo&Wvj2L1&b~?{FGT9Vi=C?oTHzp>Hj^(xkb#`hTk3!5z;ZRaII?%x8@pW{nJ|v{7LyVdStso*z)uFu`Urv zO>(S?kY&xU&i^jQ${-$7nnJf$V7L;bkiA?U{?BUv+vR-;lboUTCb*|2BJQ=vAaz4A zWS5I8@v(}=N9zyLRfs7;F=#m!#k`MFtN*u*=4c))vus0|v>}r6U6N9N&P2a#Ael8T zr;hGIsuJxD^@^&zuVCEIrEn8Pd8u;^@A*e~%&)zJU$44@|9=hewT-%w=s1OcYwk}f zA2pX8m7t-#{e4s?AQiQ#fh!+^gw-d`B=$p#u&}Cq<#Z}hNQwkSj0Su0SZ#e>%kflH zeYfJtuM9t94A`N1132CKr0F3+%vx4PTMh8y32_ zd$6hkfwA&RWslBjq!|2bVHFRVW8|O_MK#5;f^KH!hzZl#^1=epgC^XJv2`|WZKW=ah6c5k#MUyYs67e#Zhm8F3Uc@m^&3uet)v(ao>`fTjHqtG zf=zDDrA`$U>4P9e2qTBi@Z`4FQ^$Cmr&j~QK?svr?v0x(TOPs`B!mEC8e-4l17`JQ z0VX6ZI+G-&2TfWii)Cd}vy1^HD$ydy0js2*#REzGIf7sgAFs#8J3ZgA-JUnyg zzdDXA@0;fCfAD`Vo3lad<%1t{5%hT-9Wsv|ccbL9vs=+=Y1obN6>2If21^y1a|njI zsiY~zRpDimjz~5l1etdf1vFO0mX}2dK?0y68qlfakF z?Q4O{(B79@d%K^-;3XT|DEd(f0@K8wY{@{zghY`mg|eUy0U)V&G6~CE~=)9F{KVz z7H0-~Uw5jH4IV4JPHKW~GNh|sl?U-GN;PQ8Dy(oe(Xc-@XOu(TWBxP8Y8^}vG$l|2 z=kGHRJ5Mtji^M~>;;5+z1*6W{j}ko)C&EN0!esY#E>A>}(t#@#%3Khg(HYVLXj7tj zsmw%3a79Vs|2J+jyi`a2Bf$Z#+R2!De1Zs zlN3scNy;qJ5nU;^p&=`WRCvv!)>rUE-;Hr-t#RE>INRq`5{IqvHI`6R3&=n*g)ucF zhV%=iNLrC*NzNA-x~lh4gR>FswhXFEX2!BBn;{OYR*9Y6mpvR)6}C8f)5}(AffSTH zCb;G*yFqlD5+ag%l4Oz+n)*Cum?&ZaW|m$or)(x8NIFiVq-SEFadS1#iJCVbJBkvr z7~R}GImw6acjs{PI~NZMc%i&sfx9~T0dbiUIAQ-;d~$$~8s2>s#fCX~75qZT0KM57 z5Fbhh6KNDltlpk^XbzgN9_&*L+HAXzD4h|3tLiMt-dE2>)FH$fXP_$R9+ZOc;B$?_Y=d&+U>=*zk~L1cNXL zDH@pQA!@8h8tn)O4;H{iu>fjYW!g5XB@m*^)Xz!vjk1h=0WkNVuB;9QEitj}Ut-?C zlHEU5#@m;sH3=1{93;~;#;PNb4VPz$#a5oUNMCq&m0203U0KKh?WuE6;($ymPBRs^ ziR>~yytlI_PJa!43LUhmv^4D5*%^y1ib&ghQ~{_Bsr&Qawd*?lxbWV~`t}EUvaVa| zTbxPV#^mHAouY27Q4rD%6C4g3+?N(P?MV<4519S&P@Kkh9{mx+|Iu*-q7&_rK5c*wjDtT`zS(UzV$w%ZQ%N=dI*yK4bg$-RpYC zWxwQn+6MgEn%DseEFmG6zKx@^Si)LN<&BGC!-vX_HxR!0xaH}R@~~`nqKnMG0$6n- zOOR?9g{z8Ng1B7Wh*XOYRXzwdEVF|y9xcuoy4q-dWOk}yLL0~ma5UE=*%ZfPfIH4| z%>l|r_+caR-sorChAB_hG4@Mw^yRvg)&IP&8Fnk2Pm0*7MbphpWLiU01IYyp>%fz8 zHX71kMi0xxxOKgR4#SxnmWkdyE@YpHx^o^S9iH2D{Dj2wNdbn1W@{!cHls3Vk;-}TmFFxT-8U2ipZ*`mW*n0Y0`Pj{LSp{;ZA_Jagja=IezF6DK$ zK+o(jK}a`{#67Pa)Sw`uF32qOA<<1kGg=@`?~M4^TtphhLYv#*29s-|Z4d(;%^UU zGM?AObind;;A@cviX`HNstpLGzWQaqqiz;M5!S-T%@-Zgej5=6v)A%!CDWgg^#N zaSj5}ul|WjzBvWCEdmR~ked@LfOhMCNtBC8L^R7F3rIBtWX8b&lF@|7sF55eG%8ST zEl9`m(5eQA4nw7I&yWzL-UV=xN13r{l$mLU0Y`|V1V1y00H}0CyDI!|)|w^S8ZMx^ zxL@Hjkq)qRk-e=Ip?DFz#&rlY=^R(kgT`L|IyP1n&8Xj*DHW_^PCWZ|4h*5o1)wV^ zs9bcgRiQjX*L@{H0J7|SR~c*f_kJgt+)W@mS+k2Y(z0&9HE!jY-r!_^awSr6RUwgO z9j#ZqkjA;$I^lI~M7J$FS`iKk<0%fK=ijf_U6t=7_iGdBVMX=iI#KEKIlm))3jcq5 z9%J+V)TFTkHYD`DqgZ8thku5QQQ`^bfC^MTG9ZSe1b^2N2viybB<{ALOmT!2BPsrF zXE~G5fwD>sM^YgzLkkTFYJr)hK~g5C4e_zsnvf5pyl;5Z@I!Wl4flgWU`!1208+;h zeb9s*I;NaJ|J{IOO{E8Goec!TJXlt0{wFpGci7%sYG zz`nL%QF2r>$O*|6swQS|eKm)PKYD3mK{cqsk4B-Y%E2zFR1MtTFL z=We=ex;)N1Rl@rvd8OAe!jwPBI_9%}LF*6}!x_*0SGUtzWhb(CQM-KUOZV3GGv?t} zuoCvr|H6M2>iv1k`<~hCDiG(Y1O6~EKNi6S3Jc|JXi+6~0JKu5Ou30}-7B~TXJ+=d z6l(zn4F57gg^Sd2KGggV6Y@R+N#1vo$DeIv9UxZZ`w0t`QNkE_#{3ivD9$AX3Xz2~z6f1BW1$-S z>=?MtBJ+c{&`?oA>MKw$_w*>=@4HEm#(kmq`x5o2n6x!FzTdlKLZZ6CWgC2?22rQL z9IPac)hje(YQ7oyOri!S!xqn7PgKLt8fb5UVtnPb@PlTo&XeX!kL5c_G8=Vv_FHGK z92~=qZl3 z|9&Rbs#MR3%e#>{J#Dr8Zvi2=^Wl9xPSEms)$;l@>@b8?Oqf2&AzTYLPEtIzQ>d&- zDtdI;NGIqDVIO@cX2EVhz349wv`pg|nH#}sALKw-w z!W$BPdTI&)fl9YyCrp$Q5}pd z8Ce`1j>gm6oPdX;ICzC0j`PgRk|Tba)rbUx4%O=j9m`$>>jc!sg-btnI#q#H^ zhF~);zz;bN{QGW4^$35|>2r)7s`mIIPIH-TFMgRM-xm-59zED?ymXwaPM+=(w5so(LiI<^Qk8yw`x`C6*Mk2XC0+Um*W>>1yM zXCisg2Njejln_J|PYGKRj8_mP$Kc=l!6l_E5FfBO6) zcri4(9a`F`oX7r5JJ?=q>|)5E{(>5T)~0cio40fHKk&Jb0l#X! z?tbljTEju)eIbO1WX%5b_t_O43#ude zd6fi+xqWW zua{Hgdm+kPT7+Eo(v`5tw-Tg|pxg&B6gmZb_|7;4;4LW(TM)k2ri~9ho72j7irI*h zUd#4A+N4H_;5CJ(_c~X5HyR2|5#I>K6wLIOU$(G)oX?TvVUvmTI)AtkW%%5*TWqZf z`1mGH9)kqD=+LH+dDAnTs|DU*j^mPRt}HNhGr;_xb?Er2D|L-H-crkd_;&1W;rz0T z|L?p;M1r3u%*F8V@EQ+O+$k)cC`_pp`=r7la0a}-W_@@=;ShYBE&*lMyZQhhN-yjl zQe-?1Q&5kGo79eM7+96(E=qjt4T_p%!_fYjy<9W7@-r0wo~4ncN7cjZS6k(Z*8FR! z6mqc%npE>K_I^myP70DTgdM(+Bsx$m-Y;DlD8qIsXYk{d=7(neWLkp6DS5MYd=I!# zk?cTLB15Xn*n%%b#g{GiwKm#&B3Uz3+_BZuWKi5O0;R}49SyrlQ1AtX;e4oR%*mT) zv;sxmc?x_0AI@Zvzki`Mh?_zj>sGq{^2dnOdf4P8*q6L+rT4bqn{Q_7ejFDwaK|&> zuLJ#@btW`g7@^~d=mgrTA|0%n553UxIY}K*m7@2ra~IFu`Ow4O;28FQ+dvF|@2gJw z?q|Ngd%b_J|BG=6xU&1rGz4&xdV?Vj#Tq{#fc#R#{M5x7!8^U^HsT1(lbl-V?1fup zIba+%7v(iz_?^!}ZW5XeWXx_yjx)gof#ix}rN|V~BLLX@I9{BsNOuEaUEm3nokW?t zCPGFnp5Csm4{L@eUtZ`$b9=pt?kqC8=vO<5f_5bI0IWTn7-uXXaKStf+2jW@FgCFb z6s9F{rf{a^90#o5gf>CJ3mq6o4oj5ANtJ(2pLWYm*-fElUaN=WA(01OHW76HB1gf^H< zOkv$3xS;qCy>y39c4oP`x#blW{tHgS5(yuI!m)!SX#=< z%M<#y1;4J!ln51Q?L*AE5l*RCe>L5?#Vwzg0kJc2~h=Q zV7sT|OO~h7tjL#Age46qF@;H(&Xt4@KFYC=_qKYu6Zv~|z(KcKBqgRs2yh7pP?tLH zuyJC}oKZB@25ZMuVm(OTH<#JoMc13vza~GyDWxHvO448t%U8XzZ|Swc9Qr~SNMt*y zfX}ZupMl4Poy7W+lYq(DYW~W+tb`IZQu-wMoWq}!Gqi+!!YIpWq(Z-Tnbrmix?Es^ zT|*!1XeC_{Q$VaX(t9}ST08*=qAO?e{@xoR=F_&dE5!WL2K>nsxQSZU+%nlMD?ys^ zsKFg+lG-eem3t25<<7>>upKkG{fmYUdTL>RtOmpP&LdeXVzf8fAf zaA?@S+X^hOIh`xis5SaoR$h)Ark-0wR1|OV+dbVFZhY#mC|LlY(8e9K)DX$ua1TK+ zj4LgN_2mPHTiv_ODc+Hrn}}yOcqFTgr|+$st%d?cQ^u?ss=&}2Zq71z+cqJDyqo@* z;@>Ie@YxW@OMb?fpjhEfOG~RUo5XHtY&0B+1)R(m$DnXNv9Ckebjy(C1FKtGv8dIn z7WlXvb_5m{7cEn^YG_@hZK6M{m#b9&K_cRJXuefzHA+1aFc|b8EPn<9F@iF-J~n&y^GEMP%l*R9F_2(4R zxwr?c{POVMx6|2;dE=E|7M9U!RT>TxAVFDz28Yxlo6nSjLB14oHT{{!ZqpOMejL#e zRyeLE!P$q&X!Hw#=fnUG6k*9k8Sezp(rY}>I_o<*`k)SG-|_a}dRT$du2SctNu0p> zM$~JAJ&w^86=CNCGoELx$m+p@t!y|DkE4*J6I1%{j^lUr?uz-drG$&Sbf+^271W{` zB@aSHpJm${2tAFkY#eJ(l)bxXJM&`>L#3p$wpVVygt7~ytz^4)EZttpSr$q#AqlV1 zbK3Y#?HIsWx}6dGjr}*EV=4Q6HiDo&xwJHcLzC08KD218#%-~Fgl)_J;;wNdm?{oh zjR-r|S!@gkhO{6PWrWoSKh97Y8TRYW){aNeX5*j% z3!UGuNeVjxLx{JNL~3Y5byVIK?iK|K;83x%hpg4{&kL*^1}cSTo9pPOQe9T%h)X*7 zI=^^%%ryoT`63^xqWIG*7v{A#B?%G~3HRpw`f}kh?Vz(VY~9hFvREmavf*0~ol$(~ z@=HiEFyoe*W2e%;Y=6N2^x-se;Y;}yX!t^1CngwsNswetS#T`*2P~s*9s0)9(3TsA zyt@)vS-%St`dH0LKHIs&*m%}x9jHf=^8#HV4 zztBprWh+Eq-N_ zLazf&C>-Q~3Phr*qX}>Wa-7<6S$KM{tr#P}bGynyUX+m|LnuUsPx#RA!BRI=9*^Z` zh+KB))DxYEX#hU7^wOLdXBTTK8pUH7xatF7wyq77lZHPCOUtWE@88&h@T1xn@=rlU zG1vL1EzVBDR&CfRCAxLMLag>8rRpvdVWP15Z`L2Ck9+jHg>~jwfGaG{2?mcD^XXiKbO>_FyYc^r=mtYQmo5$uGggT_-cKDyF zJUZ`oJm>*N0|B`6^ulea<4Zfaov&#PnV0k=)vZ5KzV-V2{PL0#uG>=#(fvkp{_UO< zU-o_Ubd}(h?#lDMnmZ~-%W18+36afagir}@);9DI?J)HIueo6=gPA1HAx}IbF#b+O zJw0|&juc3OYPN1K=YFV=7f12-cujs>_C8@SN4#bGxDd&E9Suh?h$O`9ex~wwYa^ngLEZnu~s-J10jtQ zDXjSbJ2`Y;9P(4G$}%2zJ2NIr4Id|{g*MJ}bR>>gk-i{Gq_VN`r)(>kOHkSjx=sAN z*l&MelQe^Nv;>erF7$hy+LZ7n!#x~wXU=do$M!L&fB+il!YN=y| zu@dg%9;qgTD!_s%V_$|2GYYaNyzWtFPwg8}?0oq(LEzDlUGWkpF@tBSHIP#&{r&tz zX1DnGkkL|T`rx5l{}tuKX;IaR{~%V_v3cT>y+S`GUY-xyeZvvM%4%Dm-RUWv6^y>~ zC2y_!wbFjSj^I<|l8HK7Jt5=nAQtx5^#&(cbQa6hx1+pf=SG%| zq8v+(;yl!-Kw9!2vl=2~-b|KiMq@wu_~yT&2nny>osk+xYU6Nn{p%J=AI!tXi$X!`aWj{UH{vDMusv4W`I<0OAB(9lC$1uh)RkcbyuY8-!5+0Vs%RLCmlj^V_UR| zhWp69>*t1tW^Z@O*3TFRf!U1 z#{|*^KI=Hzma7E+?)aZ@?^;V~&~|x?69TM825@9PAxz5=gtRk{(YT5jE3 zd_Dr@rZNisC40TR^^xh zGhu#2Ngh~RG1&FvcHD*#FHG)*t_K@^5=Re@+=!5tn9H^ziNkr>H(M%wHgEk#b@e@S z?6)nSr89*-q>6110-8LCm7=i6-m8_Q@Y!)?0gO< zjMV^{!XnWb>=DTG@mT%-92v!Kdgu!Z$5?wjmr>}QMZpk?SZgf(k zn{BS=HC~TaGASH_=f3~EIH#(`lr7M-@~v6nris_hSSW2UtgFXVa=9oE6Su!Uz{bk0 zjL)K{#*cr0t$89YW#u~GBA6_Et|$+ZE1i7cE3VL=Qp|*=Fd_^-dog*O$%LFHHx%EV zgMpE8_i5Wg%5_+ciM|TjdJ$fLT(n*)O6PBeT`!8Uai05aBE(6ol|5%mk4(ujdHSZj z2)M1?Z}##X4}Hupk6%annh61z<5`?)j@mL2R8Bc_*tVWVu;l(QmmLHSTg5Qn{PPeZ z{X6m$*SU?Wc8$UJr7<0YJ|Hy5tMN6xlhkIB-0Dw6z6U6?$u;>+e4m@|ty^*;VD5Df z0so%T{c-F&EaMG*d~S9@^WHoM3rG;=+SLeZPBtHrzS29q)okD8kUVGigCfCfjrSoc zG+KqOA%^o3L&eL17Gx@LG92MLhbls?ByVcNwa4EKX1QUJ6QGqC=A)XI!zwO^jGfi< z+C6E-qEkb+->;}tp2GkGrQGy+O+F3Igv&e}Ipw0e=>3fyF*~#K5qcTAu@YvNO$@0r zmfj&GNhyw-+M7UoeNTEba)=z#dB}gn$OBXmIn-#vWw)wuWj1|5*&GP_CSjJArd{bn+$hm>(T0y3W)Dgvu1S7vZ8UwBMAYnFY)Ib3(Tjbv`FCHT}6T)#k50C6j|ouWurw$5XK5hk9#es4~ZI;*rbG)eTWOc z6p`Tev`s-({jP;iOeN(g*u@%{i4p^#x$esi_wcm~@q^(yj+BC}MJ&?e{-ft9vXa*3 z+TH$D_MsEjkGQo>TAWZOAkyr%1fHLw$_|U6?}xX>zr8!~vSajVon*W*^BYr1-``Z1 zQYBe@wy_Gj*MhSMu2Mke$cc54GgYJT=FxkJSbGW4zlrTYSvQ60gl<9ob49Y$T!zaA zz3qN81t~2UBdZIw`1;NlchMnlzkR>=e5)@AR#9I)#u^xUFKzXz179~6&57J(n_b3q z(Ww117*6iA%+j4GT8FBv{GbC1IlO3KD~zo)kk9qIE;0_QQ^KjTTyvc|Z^T}`&G@eD zG|v)B&me|=WV{@YvWfl_&*X=MmaL-QjVMHzO9c9c?32z#tJB9wAHfy|z2q4;c;p7Gay zaFlR1pR31y6uU{@mO{gi)~^OA;jG(fP)a6?2@7xXeAaV25a;pdb#0?|{6GT>kNx`t z_q)Tw^JN65{X}nUFkoHvGixU6s>j({PsCG`bm$o?*niePdb-_Ma$bt3`@)pPt+H1z zA7NnS_uzno_Dx;vd_?tW%##_nUQJbovqHJ-$El}{PCIw|ZF2U4(bxQ`)6>0a^$%#% z!$Ug8$AE#yUx4D~?wAoubq{&YN0#IiJGv(fr#JcRjE`yI;6{`Y(E&a23(sETeUtZ# z+oFPByg|D;qXdG=>T3skwoft#K?>>P9`eRarUA z>6gW%kPZtbj*rS~Vg>NplhDa4idX}I~*m;Xw;@kjZ*nRE+^j<>NeQ=ADay`B~= z>7kzfzp66g1{_91_h_n5dI8?#3EL159GFw6-2aP0&hNJW=jhU zP4q)`tK9>6tLg@`*6M_{FEAOLH(D7pH{fMKBQTkwvPHO=VNT#4sDe}6u5rkHMf8GWq>DO4Kx#Gy z;2NJmP)hF`A(eIi2%?Rk7?)xRTa*G#w1FsZfRpd!u$4(Lo^XE;tmDE*_E3u?q`_QP zJ;U#%DoocNx)s|`-`Z(Gal?1Pzay;qSiN_IS=U~;f#$M(@b>!A+*@tJ2`5KBa8Nj) z5!$kasDem-dM}y~Fcexl&%^qBnq=4cruf@GVNQF~`!d|sK}VdjY3SDKAcx?YW_ePp zGf0D;9V<9IWUA{qAA{ zi+IM3Nwgj3$#w6WrX(JvXs&iT41XG&jHs!xiI$e3{az?($ZxKzH7}*w0^{n>wE%fu zSpBnxr|Vlay|-@jGn4I6??bcr=Gk;UfAd{*HUs{p?D>r2HCPZ2kI}9xG3Dja5X*2j z*|_O=)5Y%J*%rgVqDh{n@(*z3WxlrGFU-IAPTFUd5N~U&9a2h6zRsUAxc9 zs97r>?}u7<0G>D&V4kK-F0b<2X!CtL`t>w~TxZ0ecL_FpIX;AR zSoDLmW~*>iL);me>h@SE60T|EetUK`I6B(Qx8K6o^rsj+W~d=NJSLM72L!xrPfu^) z%|N{T2_Czh=wdTDDJYg%Q|^IA>0F(7buIj=pyiO6BIbahq5|&pNejF_@huh0#57>g zrxJmLoa>e`o}kT^hM+)S{>`2y<0k}%X1o{N*K|a1$#|kW*qi|Ht~v|J|z^4%BQ4M#$?!7O-dDs zamOIwV>UmZk$aBvUtT}0ydocYaEHB9qmKq<%+#KDqQqh7d!y_>@nibmII*zulj*); zr5bcc+FYp~+||d8(};DoBY%&}ktp-U=Sss*lyo8{yJp1-6uSyg-#+bobe|sV#@F$; z#<%ZRod$P!q&{qMv*We%qKx9s(ujty%(Q@3Ia~Kt-bn0e)V3v;{w5+qtL`~$rNHqa z5bc+gVzszC-B>o@DgNpp=f9`{Xivm%oQ7> zG9w8W;jxbbggImSSgm06ay0^Mm?>`)(Q=vy1F668CKvSOm@6O`f`? z+L7?l=BK3O)Z`9^O4+facd5Qw8msy%BM|Q0q1dU5R7|OIg8h|SkMYwY>n60$Un}A* zi&et-`;@MUv84E04SX=Q3di~x`6|v=G#NxG1a?@m(n=7Gebr#A6}GUZrp|>TOO^Ft zXen`!q{+=|d(7bdIQ}`~l{XPWi_w_5OzWWcVDO;^y0d*V#k;o?SFWoW24hj~5hkcn@?*SxBWGTW1Z9)tI^fpqVWzbSu?YIPr4as&UcM$uz3Z=^wtZS-x+U4Ng6%&*J!AP}_Xh?|P3PDDgJAM4n7@wP%UF0MzN`v)`IQ3)wX%5ihQFy*TO*f<+l?Rw^3 z?Q=cKv@a>btCyT)NBLIqRnO-%TAx4|fU7$JPN5G4D zGKLonHCf=KbGqnaoUk&$Rzqhayf|vy_OBMA@-x+)m9w6cZQ!`-hb% zgaH6Rv44#WCRhoa$t)e}7uIwf`tXJ1)Bz}{PFiaI;bT+_%S#55()gFzZzM!sPqz&9REhVJ3G-{4i9zJt~jJq-%XDO?)mSV z_HlrD)BTZbk3v_5ir48G7Ya1lQwmhk22X9mWWqZfaUC1r0t71OK_fX~Pl79AVgIoa zhbfH~i`=r+zi8X0gnHbBtqm4t^gW_{`5I`mhf4k%dziqL%Wd za5hOuYs50T8C_ywMUH6gZ)qL1lbC|)8d`J+<-n38;%%pEbAHgzHEgG`3n` z_INj`2=;-Q77O{GO$v}Ys3C`OH9Fez68&P(rGA~LGSk$`%5ILfMMkW-SE}7{ZsM}$ z0`$R@D0R;Md%T>XoUUzyK>>yJaSaX=g|EGW-e_rRD74K7*CB0ZT zoHS6z#4FI?WRs3Kv|<(4L>ZBMz7J>0D1|jP{wmZ>1A%}QS^GC?$aLBd&(H5rop*S< zSI9v%ewx6!{Vc7~+J%}vtTee`^;kwa=n_*dq_H}>Dhnv+3t^3OL)IT04KJnTId86O zLA&LpeI(@Snuc*t;x%U}4cs}_e<3qG>;6b3Ux;e+G>oZ~R2o~HlPS2FV3yT3^Om_e zLc6r*drUd%?MNZ-MOv5MveYL#HiJ@ri*(GUq#ev~b&j1#yB@cLS#ZDWxlLKIXUfuf zFo}7!Ew!<*iED~qvauC4m!{^TFhX2p&%dsKKk+lDWx-txI#(NVIFYw=oiDjwm;WoG z?Jcgjre}%C1-Jb%<-X8$Zr6T#e@k0Q>-FAP{TmC-RPpPM5n4K#PSJgDM;Kuc%RIBv z(8BL)3X)YeyFK01C!P8)*){!-vE_sA+WG5^X+O0uJI*iA$XZRpm*`vc^_hhCRK&e6 zcz68bx9i}co!<8Q(DKcab{|@rHpA~ek%^4P>|h*bH=3!}i(^dHe{!6U`&9&ofB8F* zK0B}Z8d0-9`!E)#yfS%A!|gJUZ@>6Ad`NtsP@L&xJo2lGNP7Og2uGK^BRCN+c;s9` zj^$tb2AB9Fri};YdmL==#+7Gsju{tal%$w&dCu8{CIAZ zd7gLXOAwOtb>%F6=O@&@g6m1q9c?--e9e%ZDnes&v=U|xE0dwn;%=W=TMDmh8Z0@{ z3Ot=BBUGU~U?D-p_%OLqbNp3Pq%n~B!NOV|pu5Y_B|lJpZWi%=5fM?xDYx;bV(Dl0 z;Ne)1j2_Sg!el369Qc@U+MZMAOv-eam@z3BjGLJf;=E~5jqQ(`*8$AVbq zQakwEt;p3NhFn|~csp{`hBjX=Bx>1=$ul-|y-%lyR&-`R@8rk#Q<^4NI0Z?tX3RT0 z@eerKhT{_VJ=g*%_|r)qF;JkTbkEfF3v};@ykMj`ETMpXjw1Ps9;dCZEyum;ip&Ny zPrNS{7j4H~C+mLSAP_EM0D*4?%a-lCImFSuA0a+JqVQNfY_HCtq_KVGDVp8tug?=y zFS6#929vr=s!PY!!rz&n`lk2W`$!6f+ok;TMWXFY0pdb(1tknnv6m+-r`FrP(PX*K~U{~+tTtd=-JFI}TDnS-XR|2^lu9>hj)4zMf%G3S*&pLnT z;ksc|9i8uEy&Mu3rKc_$3l>N?!kXD}TjoY2ujl3YD^cM#K`FMRtIVUbv5&F{_3OyIys~4b)ec z=B*XhQg2t(_K#8dyBV+#cNa!CR+yUJE$KMFLr2bKm&b;QiaZ#>LM+g$u&=A%h1(0u zM&p%M#`6xA#VM7Zr58PL`}<+OWTgF*YU|~S!5YKz43v~g{GiyXe6$2Wz_YC93+^y-`s1LzqpXHYtSCsA)sV&n$* zF*4Oi5W~~^;-^@!mI-`cc8Qva0A3s)Z|Yrh{Sr+F@NnBU1ed_|v~1RZs1S zy&v*7K70DpvJ#o6dDlgRmF2wcPk#)nby0ayq}JB|2lLXE#w~pkw(;>SIxuh zN(E8yl6l?yy-V&c8gSiRhppNEfXp$J5RU7n=N8LAjtcaYfOOP*aM3XS_Iixzgq&Ll z?y_FMfo}b)0wN2naSS{}p9sJi1sro&#(N%Dt$_3Eyq*pvNC1bZ6y-tfC4T0i2$Y9E zYiXbxyZfs`nQCxHt(d749bJ_8HO@}bO1c2oX{{(ecB3S)X5ElLxP>O%Af;d-KPG7- zRJGE)wma+Ht?J=otsM&S(63Us3qDl@WFI~0C@KJf1XAu&p^CLZal-By6_TSiVVFoz zB_aqTBC%D&f`#^!BII!4$}<-+``TA~sPdfPoUi%w-|WV^`Zjk)OVrq?bRKRq|y zA~n{B-2OiR*gz-0bKEm*$juS^pKxtr(Y`05cf`4^+LBWa=GizBJQrmG8Oml6mi95^ zG%Ms(G-Dfy@J51?Q{l6G9%c3FW~^GoAV=TxrH}Wi9V4sm2x3#aru=8%2Adv_2!N9LHViP(q3HoqnXSGFg6{=$OKT4 zl<}clx~7oTu4otuxkQkl((K}OA{CTtYz&{67{f(Vvlu3XvpzZmQ~T_VgF;8)(C9HZ zI&>lq%^iya5=USc%s^$gq*InaS)>(5O+EC!JM=TN(iRzo@Yr=Kd_u!dmtX+vO{P!5Vxt^;&@6C@Svc0WczXRIR(xT6pa;1wZk5 zt-Ve4Z=F3`^S1qxBG>h)JNFXp*D^tZo-ZHuKoGZ<0T z;BnpfM^d`7eI>4Y{W^4Ix;#D`|9BnZ**2yBWUOvkWv)xx@H_kL({b9VC!nEWfXoAc z*VnY5VZvm5?Wn1!t%_nrYXD1HfCDc4mup6yvDur>m%j2B;wk63O8y>v=mGb* zG`u~2b@rKLb}@`3L7HkKg_7H?H5rNt5uipZ(Z5>iu`Y z4==KT3U;r0o`@lG~9gCjc(ct7QBtW{`D%g z*Yv4TKW{xaVNqvBGJ9y8vG&W3i4BMXV~0 z>${5lvv!4ZVBDRb*aI@j4#*^g!iAx|Nc zTuitXk$0zMA|i1^G9e5jhR*gZG8KKXwrMe1n^&W|xdmyNwCBFB2Vm4YrCyS|@bHQZd0E31@MY$A5B;1(}^#wZ}B-Y^IwAOr_| z1ELK22TmT2GQKp4OhxK6C6l|3SOi@%K(!9&kB8>2LX8YS5e`C zKmWc6Uz+hZjIEuj6If3A>?)*vhSKV%{lkH^dreO8?J@0qn`ys({nSqKX@vxU&x)qo z(@HkEQW}b<(V6Si?@f}R2E~oxxavw$s>HNQ2y=&wQxY$e2&1hjjkweo{YWO5x6R)R z>%KKo1Rjdeoy5TkL1IkdThk98S&2pSUd9EBnsLmydYrRIA1r9kU_o;PzrN&Oxaj*= z;o=|sMdgwo{uMv@@s;@LPbh!J&whFpe*QDcU+{~c|5ekr5RDw0z*-%h-V-4?Ew505 zsw=25A*M18@f)*|P*k^XvOc1jIHpe74Fh%?fD4}dH12-upFO9yorQ#S@Q}esB~xh1 zHKJL5`dn!b&zE|IE2flSGKhFSj)}FqXnJ`Wr`ZSRHP16`oixI<__piD&JFrPA?C@v zOZC}OQT+!GMz^FHT)Ecmf3`1DSL@c>^QB&t`di&?U8L5o)x3rb8M0mUx3aFQ5q;vd zC=ZqQ=wB+U+E(HE*RDr*x_cu(sd4wm_88xHG=kF4?wNPbMq#%^9)0X7{QVy{;_Zb? z@xn{9v9@kJ&N*Z%Ix=~D9 zJf`yaqmN?d%>7Il!V_L0=J$VaA&xx!P!0dj>#r+brR+sM_qlWNPBe~7$i#K?`JZrxr zDPq=736HWx=*|6u16u-Ka7|;1P1?bhpTfmCvLUG=t>WeFP592Es}Zd1FVYVwnK-6G zGFb6Jys|L*Ja#{B{p3fGl*5j2mu^GlYG0Tu;!?lb${eJWlsa%GR>l-p*Tc2!Am~uz z*jZju_aoWy0!4y4R|{y$j#|ec1mvkzfnGVG&(jsgvy{?lyhmRE3S~37SUB1 zZsX%QLrDv{r9`{%(1R_=R2+sOdrd)Gdpqjt>xF<;p}nOMsayc5ED0^2UE+H#Wzx@= zMXZpC`22@3W54||Xy`CK@A(1`o{yU>skbP-26Ni8CzMu&Cm8$4dw~u4P7Dl2Q1zGo z*nh^}TDO#3RN6#Ll7GJZh@_LB4Iv4wMg%KU@3_QNKPeI@H#Z6d?AsNboXI7L1gJHa z)CnX%u+J5%mP|t3T7~!wiH^n-ue^Xohp*PSI~}ZcX%|j_`ON6SzkUQ?KjTpBIt+T( zex4Ar7hYSBHLYb>wQLc_jT(ko`_v-40rnQaeP|}~_p^nkVYewqBOcxj&(6OL)1zO&-c@@miKJM<#rkwjRZcZ60{tu)R>u!7;94%IOCs>;x~uvjl=e7z{yW9MQuEfzfT{n*I+MLCtf{l8I4{4yT|+n z`Q?{ij$@BG76S(jL?vIwvIWTUS%j^`VKh7sFEe}aAc-bD{% z+JId!s&><#9l7Z7iyWK5;HtqmW9k_)ohiKBj{37aR(Sl#q9?JkV;Md_;|orxEyF{P zJc*ZHcnP~tpN_x$>CYHDZVXo5I5nJ&4C2dlVO6y6I1c?MxhWz${#M!@u-K<(A^AKVOOR z@-m#k?a4mg6PPQ51ux_@^q;yI!*N%uW4Fid!6w8Q_P{teM=HvGD7*yc<$@)S+``B$ zjg)9KfU>@Elvl=)?C3;}+m9uTGi1v|nomed*nnIF#Uq0{l*=S19jwRt&K9g_YQ#IM z*P^34g}2{afceWepuCJ*DS5$>gd{KC{pZx*ExU*@T+KaVZT|yc`K8cyz|j>tUAtx} z%`YdDos85l2a=c&&Z_b%3`#fg1BXI5&BTCaAQwV58A8jzk$7tE5^#58nWQiCAVj5o z!(uAE(mufYv-#09c^Ms4Gl6T_fncuozcJP3=;#<5i4%OYVA3={6R}uW2V6PTuBbJX z7WXchy~V^kEyrfUXjV?8zPJi4=LIqnP9`yWLnbKhnG}-UozgDl5+)~;FKLr(0-bG5 zNF_QEm2~?^zwcKa$AG$ORLaFR#~TK*3Y{=CHMi;ofeYfgda6IG<;G$x@=p(3qu{JU zy&b#pc1>?UxBZ>pdxf&B)RmJRCrERWFX{J7-|U?2%EIIvEbD$7%SF~E-c(}BXH0t{ zrd;V`I_=VK>l5u*+trGut|qMMXu-jb zuD*E?R&?~2em4NIngK%iM`6MIAK}OW-^1xMzNF89ZrC79*U6t^?P~Jp zxR?5QK{q>*=5>q2lLI2%`Og>2@hyGXASyF;n7Z$tn2#6m{bxUkHSNot)V4o5Iy!VaImu~v$h-u} zwh>J$JmyL%i7AgsdUyk?Bin(oeaD)1$(X)0d+lu9?#noq=-M<|gRQ#a$ZhG&ds|`k z=kuTh^PmK(tv@8$E-{^U8wtF}ijXy12@^ zm3Z;lr|_}UK8A@C$Kvu|{{mn7$`^6YK~r$ulM7|64&kS#AB2jC%!xTD3qsC}UFWUu zBV2k3x5Xai9KHWQ^2}}HTSH8_rTACB{5cLh=n%)n$9nfgwHQYoFFIPscv+2%LK1|1JZJ#NXY~t%NI8>j$9}xysH$+b5bZ5 zx)8UK3OTKwj&z_N8-$#8%H%y4D@Xl+!7@ot;ohfS!p%2bi}vI~m z?8PuHZkP|aXdzvKT9~xSuqU1((lDlWLI}zPJQm5Ls-g-5Q%%U%)X1bz{%eIIcTf^gsVp7ap3tor4}l ze+;)7BLAFtCZ5d3t5~2{1$@k!aebK+R0(HD8lS?2Wgf)|v$t&9~UZJ1)AUWmK zj(X{;w(7&9f*6=1^DD7AI`#;rr+zjDe>^IM6UGU@Bc&|oZ1)mywUpNr5>Ap$k_^6q zm)m#wTy>7w>-tmmSc zl2f@31X>WT45PhyJmqzjOGhsaXMmf5LRJ4WavATUR9-ns;#sz+h3F#B@ z_}%N!mCRx7hE`XX9`*B})U7l;C%zgave_Ms;H~Rtm19wf>_OYfF5>vW$<-5?HX?LY>tN}wShq=$1u4!E(*O8^#4=pkE zg1a)<51D7t_d>T)to|9#jUv^3+B8(`w;#%8&P4gFS*Y1>UsTW92eo_8K+RtJqHdpA zs5@{L1|4w-8je03!;U!;!;d`*Bai~`wusM~dt)(^|aawXTS z*>3t%QW<_m5Qqdhj;eKwWTg<)>x7_o$-L9+&Xdd9YvR>1U)}VI_@-pc=+XH14cFuH z%PzweKlw3!e(5E6@`fw%>;revxF<9R=;n5^Xs_gx*K{7w<)>m&ws+G;SKo9)z|2j z^Pa-^vSY-#592xU#L*ZGVBL%}?XH{a`0gVAT`5?K-PA5&VQjvqQz1-3R2wC1 zF588qOd1l>K3&qX32{ryfRU8RLsuwM!t$6C)^^>|K@kAyi{ahw4Dd~?Kh{TD0++kpNs_3IS@tlz3Q~(J%H_B_v zkZx{7v@D3I%*VOn6O{7;I#5eH%5gZ57sAR(92Z`Nkaes@Yik?gWo244P8PVGUsoR- zy}Z3oY-@N}6YO=5 z{hf8eEroC9>M*xnCStXDj3hx9-QydY(KnI7P$BD$Z+7Cj=hh+Ayg}-w3F+>3L{pr! z3CUym#7st7fy!>IS(A{y7C_(H3=SLkRUA3^8yM5DC!+nMx+=rxKe=M#C0||?UyC;u z3wzA^Wm+r?S2jsLS@#sKP}L8p5Yi@Ps~Dg+93pc43blohZILmin=5e{1QPsqvxLtE z^ivlkr%Z<{yd<^V-K)^rxK=0C%u8}E(#L*QhUiJhQn7wsh!6j{@cPs4?MK#&I^Xxw z65Km`4I10J@Wa2~fhp-qeD$C)+P=I~7~@NXM4}NsugPcK3pyCk?i{Nj|Kv}v4LcF6 z=SV0b*Eb=jfv}89{3^E)HyMZ8Gi_*0uf>McIy4J0ZA|E5L^6l^ zUHan6ITzun756!*Za?r@Q|ice;j_!EQ?KxP!SkQjhE~y!H>%9d0n?Uy)a{|^(2dua z`K#yY+k2TNUp!O_ex8Zx(Vuy5E7-qP|5ig332xu@!dnj8{}@NNRy)G;&I)hdSh3em z8;6o@?KJv3H|(|*A?Xhp>8xBm-CEcc)ULF7=994XK{GDrOy1cYu{HSEsVC#R|My+| z`nSI-lIt)18m0{Gg9~qc5@-JD9-Q%~yNl#gSKaHRuyb(8p@*ThL$2kHoN?w^j?eoC zk39CItKTcH%`x95-9mi!bLVROnL@mMyti=4sU3J|@T60d|MgEj-IG$?teC@1iub@{ zHLz}8Q~vQ{7b7|4+(rgc6(y)Lxt0qZKRV78Bo31N97Hf2L|JVGYKHVjMcp7oYh>an zv+q99T9gkOfV#bpMq=9OC?`4XTZ2TO2=aaFao5AoV$mv@Q0c~C^K6lKrOKAQ7{*=o z{eX)XN|waryhX+wsSD{Ixv*}n4yD_X7LwX315{Y5X0L|P;#NXVIY=c^$jPA8$mf=` z?MTW5A|ZoAm(*u6CzC=UNeLM?x}|N>`uPJ7$>EXd0DA0NHziKgZ595rX;LRO1T^i+ zraLI7~C{ z)4T-fFYZf_D3|}@Zz__D$^ZBZ$->oR zTcj#hjYLvNrP#Mt`1a@ZUF-46s#j#Jm3rmmh<}cq!rQz(<-e`+(LKiCmaiUz`_4O| zSLrF9FTVUQNP(OZ*26i}V{3IR*5A6j2b&VF)$1;zh9s&#Yl<5Qf?Tcig2jQB7eaoL zgck$eA>{;;x>S^x3yH0e3wMQ(od7ygb;yPi=#mRc{fLp+_nW`Rq|>fO^N}ws;H;~>$;bp3n%Ed ziAj+{7@dqJYRa+R9C6%THe(}gi4cr0cGsD973;`5l})Zhq`h~U3g4WbQXp9 z{3%~q#y2O|$NON{(fu*^)qf(@+KfIGaea|bJRFd|E`6G6bAlujpln(uK3O5HiB2qA z^ftzg9-%K8%Vf<9EI4^EechD5psWZ{a%{p`G43?g>OJ;^Q_xTA)Ug*yZ|>VqbbD0J zy!66LOi4<)WtS_a`VG@uwGvZv-O1}VJQB~0)FqFTfuz4KQYprO}HzjmK2ec z(v)CY&wOj;`w1+IZcXMEeYxIpBAsl_p=~L!n{cnMjt9OpA&zg&sKLp*4#r^zHQ5KlX2GB4LI?nT1?w3hJNuX{ZtSMYA)432$L=c~WoiaP^nZ-Q|L2n=jL}d0HK}20g{2n-y+BrpXr?BGZkEcnIgs=!2to z8HDGTrE$WDJZ6n9$1ROH{B3an7hd=^{NM*)QThJ&zpUnW&i^dV`_4Hk-#+g%u6*m; zpEmhBDyV%YL(V9)=i1PkYe9RqO|D(Mrb%6712PuLoFOG-Pb969QF~3_YSay`#hSNQ zBC#Zm?@aq0ru3Qaq`3W{H`b+&*zY2l!rPnqY$>lBeIkQ!)`ZXFlnH06%o=d0_7&c& znp{8GnfI72>F+cyL`$GW&ked;)7rDqtP)qQMluiPy{#abRQ;>VT-_CSKrABjd(m<}bH6*oEGS&ndRrRKrBw+BoeX3;L! z>aBr&PJL3}Ntiiwrn*r-d+nffrxG$I6i=gl`0%mqaL+0ZHDj>M`qYpR9* z8fG(oPIwisyZpRRUrpB>bJEH;4{{QoNpmI6TokxXgLmQR&ezE+ISp1SIc;~z={l69 zS7PkgAsARS7U^{%)FeAlSrbAb@7X1|U^lHas56Pi%Skkeuf z3)r|MAIu-?*p$VZGFK-#jfRkvI(Yi^S8#n|2!2+!7k*bc4S%bigzMsC@Ic)pplS$G zNtp);LCq;S70CzDkxJv`fy43rRSo#YJ5%w+x&82&m(w`+)pA_&VivD1Sb}o2iE!fT z5D>!l5i9D}vzUHTD91MaiqaL6R>#!(5j)ALadRfh)Z3cxD*9(cj+u_J7awal$wylv zAmlXBtlt$1V#=>PJ`V6AyZu#JE98@+<80N)~^wA8bn-(DaomD zR1-%g=zLa{FI8In=3Kn~@{5L?*4D`6UC1d{y)|t|F`K77w5ACE@z}z;yCVNe-7GYo zh>36NX=Cx$olgABWXEjNvqXc)2>GD! zB}gQq`gUIV@#Q++71M5hd|xJ@`EI$MNqFI}N|p$>Kfh0e<>N$|&t%5SR-t7V7@v2q;1A4OZWxKBETDBXcd+RZm{a zB^>Kp!!wMSH8nLl3FXT&x;neCaKS>%e|rhup1T|i7A?o}Wy^KDZf#{8`%JFE$4{xj zX&>*8GtV4?Lk}1%<4ZpbO|%2^UqMTAi>~^ToCeCI?nqM8-P+dPeBJU1=;jscR#YD2 z>|&$v{5f`lFJ%fQ+mKGC^u<(X&lro-_a2F}_N>6X^}wGOcVKm5HPV@sjCtKi$^@H2 zyT+Ga5!|GCWh%~#@apqk3DKUHekJ`>SMRvfhvyR?{SgwHmH7ha3~3pQ(p({xYh?dn z^@x^*vE-F^Ff1_+KichT467Wi?@}O9>M5VC6_PbRFUtNGNmi+zT!rVggV%tS$#=9a zN%AP;`j3}u_dxv|)r8uK+GlwkX5ZoGWAZTxEB%I&jmY)cc|M*(a>s8h^Eq$k$-H~g zX-kA#>s9}{I^9N0Aqj4u_coTj{5+Pw{<_Mt*IvVtS6{{AS6;!QmtV#^FTI3?FTRKc zFT8-apMM^2KKpEsGXI%p(6V^3URO!pS&p*)l9%MkynE7VOC`k52}ytGO7i>NTlOP? zrcR@4N8{LW$7=s!d+6Bc*lDilSS91CxwiP?i!a+xLZ_c`=8uLB9i|_d9X)!CT&PL< z3M7!jlnw>Xc;p?HN`|mrQ9P76prcJ(@==JL`DW57G;Uar?(Qy(A2-h2edgBEa2W0F z9ayz`rA{b1yE-v`{5W)UB;_I}bSIcVvyf9x8F!RVJ&{AYs}<{)%)_9815jUEE$T?+P#wAWP@kT#xn+OS#jBq!O0OqaNe zbOf_#jRnzf$#Xb3-;B?max6OYVWe^))5n;vr$V*vUGaDjp2HHK?F8oP(MNQ%6Ch4B z0wNa0dTv@2wtf|~n|$t8~=PaKKXc0|OD@eLI+@wHDfjvg=puF9m4 zku=izAgTvU!GljM#(=(k(XXx^v3R+VupFWla&Cp1H7tqgyxDVc!#^*_M~*rf{Rh{h zZ@<2hg$(E-+%IS9-sEXa@3BCvwtT9RI(opimGW@qijxq+hEuUgxo({NTKjt=HMNzP zvu+;#`sS6`bI&oDSTzwN%En@J`Dip$jlh8DaP%n~gxc6ZR8{svU34(|XNDmjj-x%> ztlM}~QlEU&Yo{G0)s2YVN`4!#+FaSn6e3&P%!}$E5%+j8Ivk^#V%F5 zfR7_CXl$+UbPPY`Td_TsGm%a6N3sM{BYU4?en32yRkWi;*P3OlhB}D37ClU`U_c zZ0<}W*-?hoLYnHLt!U`qjOxmA)Yh8kgZQR!HAOFK$5mZ(MtI=ql7x<0bdz8_S6Cih z>6G)Mv9VDn{OptE<>hD?+TaoaqQ1Ufu3YezuB z@>%5CnlOeAk7NELS7XY4`(fT2uVYYsrJQH{j7(ggxef8A5w9DpQ%ANGS{?!4{Ht{! zHQ=_FobQ3WA-*pPDVQ~DmYi2|4u>PUa!ZWrAIHprS;R(-#iwpxiTLvQxZ<$skV~>u zQK2rqx_QSvhVdR-eYlI@86g>C$BxyPE(N3I1-&*ywgorM|070B86kZqtvAsq_MH@# zn3|Q-G-72@3>@AMiMB2*o4pvv4f-@bG4|_-$vGU7>r&XcHf>LIwzs09qC)GfG1Z9n zV6zaVfSe0m>ek-fjsfu@s4F*bl4T#^4UCF#1;+K2IggMuZh>9dv=T3Lydd)(nTzlf zG9tDg*<)Tq>bm=5T%U3Jwp-pz>C?Brrn|N1Xm4@#Ppn+7`SHBzTD%mgrAv`mz6PDE zm!NCKGITpqWM972Jx(oJiNw<7NG@A}?6M_DFB3OOBht}$@Zp&-W8j=_oJPt-clIe-Y;h(bHvUt05uo)1%o zOm$-W@Zn>7AasV1(}tnLv2eixj2b-}eETX-I$gn$F-Qk24)P2w?%NB+DRHnfcb}L? zHk+17#0LE+^SH5N^rD!S$utK;e!FqiDj}z_sFK%-6DOiWCOMI41)61|*x21ii7B`B zjI6CdIyM+@E?R|1WsQ`U7nHOT)0Bis2uW>Ehfsk|tX;7Lqel)!!$9XE#yX&=X1!qh zRmV;Q8`)bFX$Pr)q!aong7SC_6Uq~qKX*BDRm1qE2c)HMBxKS^V&Bmz6FniOygO|s z1{omHg+QWHh-n&KohigKLDXcTI5_+|zVW%k(432)g_Ad#M3w1a>trpU9#$8xed9Lh zwNELa8%8onpyzWxSox%nm~rWu*kXR;MoyFP%~FTae(9=;u~ zy?h@=$mF_z-(4|yy!8See)D;iN9MkW zhvq+z2i|!Gr;Irci!<}}+Qb!8u9Dhsmkt&}dd*8WV9v@pn74W!=C7HLx7NLdx7WXo zg&P)Pank}UYJD3^+7>D?eQ3WHT`hY*6f9rIFqcN$E4y@}c$2||eE;GF_a%q{|btfft z>06;J!l61LpE5yjPs=1eiSBeQmaSy^jTqLyQ;8|bj(vvGf-kHiyaZ<>qADPXqdUvO z^OiS8T3cK722*2Gqpr+w#gy)A*RIu<8qtmAwx1f{_aYgFx(pgL5JQI!72?_#Rh3nG zW0W`OI7TKrl8AN4M7yjCgX_w%Zs9Aas_lmiKcgYwjz3!luB2MM`Tt$v6piI!96i?^ zvaS$+9ieh&Yxzqry@Z)FXXqG?pb##}m%4`XDVd;$aQXf7aQC_{{NodQVNgJ>@j{%b zo7K--*Mwe^cs{CW;I)^M({MEI`0RL)oDQ2f9EtXnAq&#BB&AABm6V$2OY8dgLH*!5 ztXsSW9g92gm0f;{=>rcH-G!8j{*)botc;Ua`5FvFQh9dWMhxwT;Uc5QRO6ku*P>yM z&tvqc;i#$WhrBbX)$~mfHxr(a&N*WyP64#EwCW^Z2l%4%$<{-0F4lERa^G6ya$%I0 zM}?$r{iI*4P#jas^ZD|_sZm@B6J z`}fy!_U+qO2`b$Z-TY2#+;v~|{4IzIvB)NcTy)5FF=n=F+UJLBL){oKVINe~)NB4P z&7O-1)Am8U-$-;x*_bc4aPzr3UQ>zEafLdQ07M|BQ0r3DUWyLl@1I|DH ze7$Bf{gtg*{OyVP*wC59UJZS5(bYHO)YFg0S7r`IWjKwWUv{0oftp}=N(Q}uWAdBd z`jo3TO>P;!{PN3j)KN!a;J|^1S8n;+Ft-*TyK`6Ub?kI>H6@hD@v#fDVk*~azT8NT zhmLNLYia=Ry!ti-WbCFT8*; z6DI4ffNcTwU-;%6OrJg-^X|SIsa4C6YE9`2m`p!0eaylVX7*#(o-uFa4NDKUZasnS z$-#p$?ZgxD{PWLm7yT`$<3C>hI}RRmD8~2ioj_jn_(j?$cz%wo8i|u9o~&_8NvWL+ z(Ej-Hr?9kTF}||@*PT>+`0%m4;H;bu!-9niF>3S}@OxoADJdKf^@1YTAont)mcm78 z^U?E#DX-4*Px8@=f##b>TWc%UtzCmDQzq+{US1IRY)ETc8&<94w%!Pm$pj`%+C{fD zWz*g0+fRt-+Y7|bxA?{|wr@3-HU-eemAvwh5GNr}&Wb6?X_9Z7OLn6w9>eODt1)6& z5Mvs4p;n>~3vH%DtcM=4HP!HbgOCS>w=Bxax#$r=oG(TwkD+#842|<&Mtiyexta>( zThc;2We`hqI~8BB!@Jc&QWGhZrP@%LYT*)xBooB=STjC*z%UG{t3tVu{&+Zqiija) z>9kC&oO))J)j+j=Y>g6{_~`fNw@h1N>GM=z8nO&@5yB{Q`sA}bwhCL&Hu(R2am#D z6Z4p{`$&;d*mKelOrJailScJLL%%W%tf@n?r4zNg9D=@;GO-q78qk+funkJu!GY1C zXEFZ@&chScWo%^UnDltcFUpqAT}VI; zb?O*LM-ED$^Um)@9a~3IbZjYwg@jXi36oSN^Vys8X-i%iZOtm9f|3f#-<(aodWBNQ zRy8teDLa4Ss$eF88?MV#-!;Q1BW@>*^2oEp=LNYr^68h%%uFGnXisoYwr|&7rn6(@ z5Akl;utEIdWe`S=K)7<3|4!-cd&zFRQJlZ9geDXnpF{~wk}08S3yNvdj62{}R9ad} z#iiwx8W~Mn7ydy}$xVr3nh7z@ui#EPCkrEBZor=zMa2=Fen9fzI{HFtLmd>_Kh#fi zr~gF*ju;^AWF_Z4E{tf*?{nz2iEC;8+EPkOZAnib*Njr*SAJ~-+AJmry9^Qur4D3wf-!K@ohX>*>6(mwMG@PRviEo@qVh zytJg0QktddRO~*G{^9~`5*aS*PO}%xBfdGQhUNyqntku_Irm zf)X=JNpUf)U%!?zw{NE&J-Q25lC^#Tfs~V*OWT;VVk0Dw*6!VV$oj}yCZ36jO(>&z zI&ECDk_xl8QV`ZJL^qX@rQn(}t~fCg7=hN6D^JcJcPtBQB>vbWAcg- zDn!T$@lG_uT^+}ZKXhnpOrQ&+`O9e^$5xsj=Xv^828%}mCs^SKCLjvV+$G_(xgXqI| zpQ5%IL_IpCP)aOzvySAn2T>G1Gx70p6dN1E63rctP};IRmjavhp`_RZ3gFJBjNY2O zK{%sw+90UANO|WDmM+6mbn=Cq!p(%H^KXg))@;T*Asxbg0XC!xRFO6qudIEB`nTvy zt4kJBL2ZTX$ZLoxMnKwzccf+8meCCv2Oc?uC5PP3XkFZKb}& zOF<9_6NWh&vjM_&pp7a`_zrG}BBxC7!=mGMd6!t<%eE`{Zq3`2)GCEa3o4j2fSlsx zXcfgL#8O7bmb7*K7TWaJM!Kl&opey|>z=0HjZP_@>Gw51Q+{a?wTx@-5KiR599QP8 zq;_%b=!CW>IPRw1_Z8@mUpbNcNHug`-wSjsdya(*7SQ%>+Z!w?e61}k{;BY^h61h< zOs&8Vpoo|~Mh7_8_6-rEuTaMVHJk`YDBf7-2PZob)X%nLdtw9s2=op7cCr&!0%^moBDttJl)HjoWB5 zccQkf-^3lFH59sZ0(FQgrGMXiHI)~kyN_urGUTV=PAZGPywxjpz5hMJKM=R2NgoWT zY}FA5CZ*gofs~e32T~yuAGV;FnrbR2$*1FvX-C~FvMDK-J5^P+YDyJ%&Zr9CG|VO9 z#yv5l;B)D#FTSMgtfkbmdl0oukD}lL)*fv&&5X0wOP)! z5nwkdi~R_cy6F(^3h>Do5Yy}mwIeS&otP4esh;S-9LT`4Us4?=9Z`@eTtnO=urCV_ z7kiwS^7D@)?wiVjD!%WssiYuB$Pb9orcIk@)uPojZ{A#*`Nz++WWgL-w`wW1ORb>G z&u&VO-JMRKeAtX$emS0Ada@Ore0-8xBgt_}T>v<@iJ$vIyBVmvN0gOt5V+^jp2&U3 zKqndJrt=9ijv$;M1PKWVGSX!_sQg4wC|+1rm2$4DBz?@ug=peDq@4YhRmrsvD9a-% z&84kdxg%dh)W2;@S~ufc=B`B)&7>C7dK(IpU&#@k3qN9j>*4`6uEF|$P80S42#%!= z)eGpqgG1Z3hcJl_N)P;f);xq}2Th90>ANQ4>gQh8-<+2jW7U z`vLE}08Vx7k^`Wj?onom6yI)GX57*VxM?j?nLDkKqOU2xi9%4iZ!v0)K%9o6P7s$s9Nd6{ubnU0T`m*e^?hYkF5&P`r=|YAU27V+7w#?HJjSR%WlH>s#NheH>Uoy>B3O zvlcuDp?pWdjOQ1Ek-zn8R|~;kvt|vIF4+j6eY zF~W*zwET2YTAOn202a!q2}Vvq5J7^?i-R52$DVsi!An;g#SZ_RH!s1TPky7Zn{bmR zGTIM9Q?zCQC8oAwJ$4UJ*BH}xG37WUNPYGK<$!g1K}_n?l2Rx#C6Sh_+CZs2j-b%w zw(>&Ggby)hFYMrcuaifeb_0w;VJ`-ZoT^N7y&V=R-!5*Nl1{B!Wl(HFqD(1OQ2AD2 zu<$?PFljPc?lgLeN!gi^({}CJ$w)DX`>tRI+1)8Htv9h{G8JVPbDhO)QrEWJMiH(4 zeI>P_o^)g9N4ZXGBI`>rUGwikXhbBf0L4H$zge|Hri{l%#!_i6UTPJ{4&NwST!ZYI zY$`7;N(yL2-f~)0v5?9`^5y=+TGL>R*vmUybrFKgqA5Nzl@4v$pJHNSxPP>a znrF0g^13Hw>ju)lcJ)e0e|Sa)8Oq)sC~+wPvXj2<(Q)-Z2C zIBxjn#grfL?DKDM9T!Z^nyC?McUl%MTuQIK`MzI&21bAUgei{RHts`rx)l{c8aauBO__3BsfdxRE zFTVH!z52?l+<{pp8z6z0&iZpU{qpN?G-c|~w1_Ln1q&BR3t$Pigv$ znM_`b>6Ft?rCV;lm9D=28Y-O8~YL?KPQc}~YY3r8Ms(EW_ozjMqxIwK6EThV* zGAb%6;0g#IvqtA!C9<9zFhJs5s8`XgRexyv1Dw1`RF? z`uY4+^AGND9EsL#$)$)^hf#Dew$BHFz=vosNWs~S4nxKp-# z4MwKS^KG7C1Cvio@5Roe z*o73+dN;0FI6F1ev1?PMTft)d56L{#8Cel;_M=(|Q5(U1of*Tg>bpgm;0^We12m z{|LwA-=xbqM?@MPI~O_Se#7pN(>=krtKX*h=1qjmwCmi4^0V`3^|V!VVzW!>)Ql@B zG&oGshkNYrfGIJoe+}m}u3fX1T4l7NxUe{?&ISppqT+yJxd!Ed<+Pz}11&9HN~=m1 z(faDuR1r`@fuZVN4PkPMqml5UcuLvWQiv%wqFTIYF{P)cQ*_MU+mOngemo0Ef19># zD6Ca0+P-+XJey{%v`JT372jiACxE0HJNE`j!ByC#EQrGR9xCUXG4#Y!si{eS+TKmS zKeUK%$s{n2=5Lxy%d=K-UnYVQ!sDdwlC`MSo}*d+YupxXT}o5e{z65S1vI?lanw1r zvkrC75W>%AEVeObV5)9RhUH48Ixq*$c1`irQv3o#Ff#oY!QxJDf+qG@2Z4`X-vOP14X3v=~c}Yo0rXR*k z5Hrf~i?2pg$M$WhcdzcWapPvG|8BYID)Hw_OaWZOrAt@Rjn`dH#~*jJ=*{_S0sY3r z^3X%->NgaK8)d#P%6o6%*%#iRmMxm^@-++i@yBts{RbS*1n);WdiXIE6cVZ*OeQ6m z?xWv+DX4}?emy@81gbmedm1`pl*W=P0j|NM5}Pt*GIw~^aK|NIq^PKf3R&=QVohvG zNwIt|JvTRpAH3Bno!s~i959du4jf1~-h2~f=4Ml3QX&-;7jiVHNV%)ddBT)ke1HId zsB{8DYN?{4iYmBs8Nwa(U>1OzYJJ=hl&hx{>M0MeK-9^O!rhfpZ4e|tbT_n_BRBB} zVlvNCx@Y7>TAD+&ttOrVBI7AFsEFE?FQrG$ z>rd_4w4tKHVku{^F1b#KN5~eZ2S)=$=sFefxun`<52H#u?iF~Nr)Y8JqPg73O zG77BX&Iyx!l$BZst&V}!QQS$6qD9Lq>Fo3WNBI@C^!&RIQ$Xe->XQ~sVKLlMh~a?I zF$=~TAr%)s`Gar#vXP-P#S5k(MwPxO;L2&ti~lm^AxBa%i&2N>DRv zPV@5fW%OJcd#?b@HLMTyM7B4SV zESj?MM_M>!llF1o08c;QzOT)5VD5YAu<7fF^JkuTl)7~3LQ9q`k)3W41g6L0^D7YO zf}DcXg@=d9^x3kqa=tZ#rEXundKJrRI`q)~)TiG-83{sJn$BT;aHrA0q~9D29D5hw z-{ivpdT8??h#Mm(Tc>?OVWlNZGWprBE*H1Z8Ya(7oM9K8TS$?82T@>2IR#Y~(&E*d zsn6gOsHRC%Dx_#3NHsyKUBM2*CfQEO1WY~ zDRaG$N9+TDBc>wb2!Wdc!o%|qJG8T?vt<+sFSVQm)dkj@w(ihbM%H$9hgH?e>>e(g zIDk4G*^Lqs6KMV7HB_>$oUZEd0A<8>;`FOs)xG;Je=o8!GbwBPR_feYZGN<9 zE6k*A1zV}IrjlADwxE-HoT@|EJJ^y_Lfdjns8`!0TC`vRlbSv><}dGE-cRV=jB@kx zi;mW<@BB$x;4mov`*M`9-E$q$s4B(yzns0oY zx0=hTsx*hHOR?s%EMwF;K0ZOFM#)PkQ8VSC;xlLa8!Bi1@09w`?dNnlz4PhxP4=fkMnONT3ImeG)5$4ZC6{Y)WzWl)Em!MT!deGbm+9`-Wg z-c!mZE+0VBz~KCQQ&^fdsN{WO639XEj1&ss}Os?+I`cK@T;uy`S+=)^ZhTo)5i6( zWCzxKD%^^J@s3StcZ^PZ;fMApM&+ZIDkrC2{(<@^ig$)-0;xK3NDq8)!Nla_SO& z$5REji$f&`WzpSP+2e(n=w3|0M-4O{8V)Q8!ql*e6Z8e={N@ootpWPH#+1tTakRm|n^q0c;8p z5`y(6nrw1KVIpX?gT0^(%Ilh)v)0^%2VtTf2nkr*hh?{l-V6BVV0o<@z5{`KL4+)Hjp~CVSnzUd8O`5-fiZ?B#r!O5u z8BG&uTXhUyCsm%(iDQq>uDk-aKw$V$38@SA2NzMpQS0OWfFJP%zdCr;Z{>sDw|AIRMb*MrBcS4R5^02*sV8! zDydm|OZxnauV~iX1vF^LQPi#tIt_8M%Wq9Z8J9PAJk7K=zIN*Qk&H>YA=m&ZBs_{G zl5p!|-IhVUIddGe0b$}GzX)Dk54>aoIo-N#8#PN!)z33F#ZYLebqpgJnh0eW+d&k7JL$HcG zLw?{+Kf-jwomZIMaXDr_sPBkkc|(wF3S*`!!VToEXy*GA)ucJiTeOUN96FeSliO2O zNDKvWM;G-Z+M_aV#^mLk`vKckxRdWms-zwHKs>nrP}VT}=E;G!0zs{+#n7A%gUiPu z&kY2w5vG2^AI!S~({tDzT>jHQiVBUPBb%O1$G5mpUILgA)5Z)uE8DhgqN>UY?htYZ znMr+7aUpHZ+Cq5+x!h?hrz+emTslGFffODUM)7g+)GRTLVxr>s`6!@u>(+6N>2GYdfRCAqJ6F|{TVrkawxlB&GX$_E# z98G-A@ghD3ZucciR`5Nvp3c!^28098@QC5w1pLE~zMw8$Ita;lo=HZt)D*{$8>@w6 zeyY!iju>>96V~+Uv;D@^r*{u}lSvB5A;LFdoO;S}Oio*P<;9(LEEzH8Y$2k`j|pSk zgvoUMwUj&iinyW5$%G6v#w||)3 z_ldbbaJ^8TZ8KVl9>Si(MA(#}J6_)~c7&h{FTBw6ozpgLr2&@C0h2z}u%X$Kg9B+J z`NzAd*WgaDFMR!bLE9rP2pTx_A85%;JlR~Lm zWF8%Rcy9_x%Ait;pb*wY`KxenZP|>tI7~!?I8C(50H~Oq_{F5ooV4SJ@L-RBglX(? z!1dH__+e*P_zLb*aR*$5BX&Am>9BFf2h+;sQ#joDGxw^>giqjpVIpzE+fH`i#pq}d zrgsHXP#BkCR0KuDaECtzpTgiHBr1|ZBEl#zG@J=hHMQ^5iTd^HONm_B#c@X=GCZ2X zBBIz&JcUKYP-tWng|URoF;d*ZqLf5LMN@b*6Vot!VgYH89Bc6$8Vr<+HlkcG1s`RH znGYZyC`&xEfRtY&0PaVm#Fg@$;-By>Q@o2gAF0U5%n~#HvsZkR8l5uHlt$VD7i_3OzlmG zPo(tb>D<<|k@a#Qrub$k{FgIn1^2GX^i3p+Q$!aYgKAo7J z-i*4mO7N1(Qm#uk=TK=@AypNXQ})Jf6vlnos3!4T7peL&lAm3Sji_`VOJv}S755BUn?^P6tGijEpONXpU| z?tCC$2JnlvR7OE(&6ewkxM$3qEq;3R=qe+b$Vcy9>V-ri_ox2gYl01~Kw|Ux`9hpC z*zVL*j(5U$>lK%j2>C>wr%e5wI(BL&>7PG;G4(&R54CRHN(K*BtzJtf9zR^d$jQ!g zg*}JC7`u5%88F+;HFjxpYG7Z%7N+R%M3zC#7^5QQDLc#92{3I@Pkf4 z5H~;}(&?3{kbE8}i!(rIl|R{iO^)ikj_B|q2wSEaA_6q7{Le08@8t)&>R%ul{Nt4$ zh;f6G9JOCL@~?650^Bg|RjnIx^c>;x({_?}5q%DKs2Fz<6{p({;m8s2I^x>Hz@05F zL)F3H_)MPx{%~N=Ql_kn5d_$xa|U~mHSFk@(XIm}CML<$9+~p0!;vE!aEBocUTK%` zm97-N{F=z&=E;i(2oLv(Dl1by>b`OLSCOmua4KTrQc&UZk$*foun=cBNU~sud_!;d zphETp47lx7I>f9Jq~emYVl$2`QvRZdmosX!4|H;3qGM!pglHz4nCXD)sLIVdJSA$j z0SBg!+8+0TxEn8QMv{C0I}t}uoeSW{Ibp~-ER>}(E7TYMeg`MQNn!(KeCuCm%<3^T zcFkCtw0;at-87CSXO5N8(kVqh($6{LS?6aC7x!qx#a~?eTjUxUv;Gt41D-Frb}VWn zTs;@2KB%fvYejKx1i&XFuz?cpO&l@Oj8Qv`M8eKj+=Ry*8v>*ckaX)j$iGgrW9I_S z-FBiU1|=$uoIn0UK9E1;Gq0#jK7kPw-kl;^52UJyWU2`a6+((pbm&yns(fR#6_EBu zr$yq_aTu8N8+*}m>8tk56$T5g0bbggYhfVzoYn>jW=r7>uSw5-5F~YX<*lK=QAP~b zmvTMGE5=;EY*mP!AQKZ?K%J170D3qSDdFU*5cO3JHg%{I&y@jMr6)-ma4 zsVpg{b@Nuzwk7K+gzJ#Fm{^Joi=g<(Sc(mfq^!kjyuwOsl1K{|E%mZ!nD!+f`SYHCxjw7T8D|6!aE zxs#X>PiL}b>;W9yx^+aUiNS3@ea4^EqzOM0?1XR8oANgzBo4aps{Oz$&<5isfV&ZG z1;e5J`qG9Cn<$gXEN0jA>D|*y$5-Ekhl6p$D78Cn!;cmqoIcZZ^N-ckNb}mMOTdY zQJVTF&gk2#qdu3sYC9;&L5?t~b6>2Q zQSMq-$1m1!mp`qibrG*2qvD5;k}h+u{j2byXLLP~bGWNhWe^YA&gH@69Y+JC$`kg^ zL^wGSOKsIrm6fwodC&AnauA$PB5;c_%*HHzh!*csq&xRAW z+g$`!_;LG}gUd~eM@i1bO5h34xGSSlz(E_upfvtIF+fTh`q!*QYnnfJ!w#ici#8mp zx)&QN?l}IoKU@( zXiMDW6mXjjB)tes!}vE4SGmWKV6jkUw8OQbIl8Y=w(f9?m0ghxhF(`ISZwnHcC(fbhUKkx_| zG~{Rzm|+Ju=s?$B7=Nd@)8E~s|Hxq?FvG4fr~mJk@X#P?l@jBe&zLobwr|@?mD}@Z z)8e%hhx#QsNxsu-bPCH#D6gcD$>b`>4l;1yq4e8t(`oi!OboRhMy<>_fMa4}BF&w* zP)7fZ9t4CjDk_R%;$r0-JK6$no%#eYW~Ae%$-heY^~KeuU29ssb{%cn!sLX{SFKq` zD^{rdU_CbKr4_50eDnFrm20T195Ybr#swI2Qc4n&o@Gv$Mld1>GG@vlGdo8{bOE=X z5x}24$}%-Ig?cloLzr0iIpL?NjyvGi_a}h+{P`E(aKbeCp3e7xTL%K59L)L5nX{=W z=hs{-07rZk;m7fl{OTcm%yPhb<>oEY9UZ`!cXZw)FO%MW>( z;>R5lbioA|JdoDB1+84QTBcgz4WuDJXt(`!3IJ&sab%G<Lt1?}R7*<;eE@gQ&z^h>bEU9dqUlW8-nDm1)5;Jq_uX0Pv3={PG_x zb^OQ-{$%Z?Qc>;#xZ|JQA{2O#qZlL}BMJ!9=qWf( z0*`~Yy@C#&J0uwO;7(+4Fei%@{pdWQXmr?za|cXFCa)9fTCa zoqv!9gpZ>K$btGrILNCiBc+62=tIZz8zAWbIh9=iIX-N*1aj{XZ0PFvBoOUSj&Ra; zI4D~{Tk;V)@}vGG9!zb(rXR?wxVwDr8tVG<*r+t9UsYyuZ^M9pEr2-jiLyfptI;O; z><{e3gDA;S&H*{VLZ54Ub!zMYbxj%$rR?^CYl*VU%U2sBDMG_>XeCcMy5s#jVD1hJ zfpdLu52#rc^74`4ex}^_lw)Q{d!Y5*Fn-M^U3?4OkSC`e@B!{~zZZ(F)k{VN#4ThQ z(dql#oj$qRIvnHfz?_PTQPN`Ic4J6-)f+kD+DMMRfKH7pCBgi8?MDUV1=!VBu7L8T zJ-Pg%+}v>Tt;-DY!EEf!xdUxYURD2wzX0*`0i4yp{d-pE%#aG|a#EDaB>eSyTG&F>c9(JTm4_$~Ur9HaJ zw9W!1i(h>Cz34#VVq>V^A-!nYA2aF4AAb_NRxOxgesiIoFg4;Rx^Yv|SkFqInX zl}|bG7$=Pz=~-F=_H-5qxOc5P_cvK92z*FQMvN8WLty8ZZuk(--K-+lL^d}?m} z`i=C_$6q*UJLjzWcfSr8GiGdUzy1Sg{Dg@#?C9aLhDMPkYyeSDCqr5l-E8uS+LaX} zIM|2?Z_?2k>W0oVf-Ev>$$z-<@X!JJpaDJk*Dxjy35qQEGq!Ssz6l?Hd^ABiL5n}v zkzvB9s4C+JIE+F#KDyyiH z%MPPq5Yb0U^%3QU&XP0Qq5QA`maIF%O9uQ&Tq;_$inHnqhY=>uH{rdH? z6R9CrNQdOfr&Cx55{`KBfy+k6t89>Z4qMFnh-AnSZd#9jBxoG*$0y33f1xJ=BYcQ& zFaIik`ouV^gFrd+kIQ{WQ0nrl;^DGIrG(n=HAEAO=?Y^0i$EA)N=%bIymkO#EH5KY4A-m!t~0& zhQ#FwqRzROzH{(CH!y93$-AT#|0sX{GcOm+CugLb*be6~J3zSZH0)!5tXo)E)J67R z%lTPkVj9lv3pOq4-Mfdju`u{? z+)r{3U>fb7VCIb3d=G7)vvxoV8w*tHpc`J#ugky6CW&_S4dh|9q!1#A8 z;D+eLe+?5j7V(F?OTlnB5{8;~2Ov)9mzH6dW7UyU@pDH8iDX@LU_knmfJh=KDj%w| z6Cmk9xSnZ#oN)GEjqAi|U?=e>e#Ia3OveGVvq9U`+)Dc z+FH}eQk`e$s*w!Obwt?-5IbzbtdEIxS5@E#=9JpM}eeOOA zk#p(!1FkXjaR1_-GtZ*|m%0<4)G-KG3+_V@Q{2x6(5)k`1Q=bhWjCzvMBLa_6fdp( z!T5KFDd+A#9go|cPt}3XkzU82>)eQenDr^j#{3CjuLW_{IS2FsaQu0SNAx5_E(cYg zX)>x`00D<#R@9nes)q?GwL#+ zpY9L%@q3_(fj>7Z3jXYOL8i}~E#GMM=hoOnS}&N*FW_oV88D#q0T~M5j*2?hO(PmlZZt7cr{1nBqJYsigl8I9a}EeOLZ@0f)2z>g4jm8pV{Oqh zqy<};BOz>A*YTc{(3x$SarxAr5KKIZujk)lx7>0EY)_ zn>qoRLZ=_z;l56!91UAawS|P zNu^DRvhx+=$CC$!HXpVL>jlrf z;1YKs;ueznL(Qge{J3;*Zo+hji+coho2jb+Ck`X-xZKdz(7{VmyllhBsT+=e`Bxrb zXO3QiKi9cdckW|JH`}Xc$WvB;u`_#yV#SJ&By?*-k?AQE7#=F;HQXNnl3O;X4*mO}VXfoG%0E{O z{JAwmu#4{l4?RJhJ9nU7y?Xf7X>8)@1!(B@mB9vmBENFV&7lZCEcysR#~F)*@wtej zhaXK-r%vGx0!A7Y!2+=Y@eu-vb3V#B6Ci|*uoUUwHWZC1I@R1sk;aq%K~zi2%B0f) zzv%E{S}8{I(7f^~lhOdn&e|^D_(@MzbI+lp!cd)sv(7q;R<2wjA1RlSN4ER#fA6B- zfBQ|sk!hVQ=&(!LaLx{x@*5QyDGffz4~U!)QsjnpQHUU^a?XuD!r&jt4+4-g1kHcQ zD}1UQhuH_8C&h=;%{SjnW5uwh0ONW?DWaHA#@U{~&NuKEWs-T%!^RFE|8K3~^7XbRt~5 zY(UsBt7{_{N5!R#8f=nFg#4M#r&3TR{MG{r2;q6eTV37rl15H@ITN^z8#hu)QXF;Y z(2+7)wv0@jR)p)I9?Gm8(|L zi6HOnGbx!pkBG}{`+X$xN(%3m8q^H+v7RHeT#btN4dFB zgzS#z3ii?57U2F$O^R1K3_QEg!F^`#HPkC_zWF9i{Ar@pw|D>VZrSCtu&_}4se8u< zY$f+NUSM$?h;QP=iS*=?Ptq%|yh0B=@BqE{(PtD99wD1?APfly$w&QxQAK`sup|IL zJ`J&xdKvC`;e(99oA&EY3(QEvyYIeBbLY;b?c2AjaP%{YG@(9*4(yZ`Bj zIx?8XjUOlN4bq1;Rno=&}JV~-ssYlr>0HAD{W--qtM@6J66V}FZkO&!2e9l5=7 z)bQgpCulgequ8-ok<%E;&(9Omm(eOilTQ#J?u;;5K&M!pbLWCPB3NUI&Wwb@VSwBq zSd0Xz#+J#OH1+|~*n?0CIpr|mj>XK1z`~Cjp^1))q7fs8)9*9pP()<75HxhA6l%G$ z*(_n;J3O+>A4gbGR<87n8bhT=Phn$(vU^k%lT#)Uh`+3~R7R!Hlp}xeD};fMAPA;> zM0B`PR_+mkKt)cWx-Gky%P&^SQFZ((se;K!Wo5aT;TyyY1Qi1ERa(mAi_1}wQ+(sK zLJ>W7LwZ6&F+zsO5vL+SNCVPi@`qzqR<0}-zvb3jxMMh$<7WcIafOA4N%^Df(XndT zvISjo@x`3X46S0ok&}@Y}Vzb;y~~y161zC#UQ7Zd_O31ijR(a$f+7BM*5&D zYe-pCnz-Z1X+@ms9O*?Ip6gt}#2p(HB_<}&?RVTkKTVp**AU;i!|tG18;6$}rF`VL zV2Arj@(tpq;(@3RqY4`bWpw{4pxmUh3|q;sSc;$wy+k|tgSa9>5&q}u~{P zuZ7KcX0o%g7A;yxeVoPjAMWF{^fZ}{+oVYor>^t|_1q|83WbnHm7GPCHYBL@0)+n4g+ zf8RzIUUV64+Fl@1&UK=3JBd4Qn>TLs(r<{o|IS-9>XVQBy6uYK`-f?%sj@q!KlcM! zumQ~Nx7|SZ-+L#8hlbIVDNMYKJK)mYB?0`|H&hJ#+56i0ih(~j2;k4Yp#u1`-wg@o zzEX6{rqsGe7r*XSto##&d$?#IbtCD(_uLyGe9|Ct0}oPw&Tvstk!s}GD>~00bRbx8 zOG-+hN+uK-Sq+Z}<4!{%nM_MsjX9x;NAM%0D7&_+Y zFku8Pg42iiuzOWeQ6YDfVufg-(-adEA)|H8nx#^1PLAXqY0AyXmN=xNAV(Au(k{vL zK%b*CU^;tvV~tJ>@_}?Aj212Mk?LmB0mO%Su>c zADyZfUU;59{^(;GI8b#+WQ3fFRO{BQB_H@U6UZ_IaU(DIuzSmNRff1Wv9U3d52PtR zK9UN!9EI=R>~ju9?Bt` zuLB4iKIjZm+`L(mTzBkl7Z)EbqY5BwcnN@uBiBr>g3m9Pq0_0BbN+XqvjNvov`si# z#7=(w1HP0MX!Bj2~^NS=TG`7&}B9~;NTw zQBF}@E_hBrZgaA;Bn`M`D7XClT=r8&$$SsvIm*q=kr@sc)kZnvnL}D+rh+r_v!m4S zB2Y$%07iB2#$JqSx3QBnOqwu;uDbRnDVufc)@j>+F7Tob_a^EE)JwR}lai9;{%Xqi z5wLCBHpdQtA3X1PVH6n|NiEY-#4q$fauEi|T5>`RVL1kLQNLh@1?pXla;mmNJwtf0 zWS%cy81e=^(*^-}K0&~$D45!J?k*dcVFyKAU!)Vy8OSQks5|kD0Hu}uToiJCT#NL;XS;Xl}?rWY9>X;RAsKaey}*F>-g_dFRrk zpC(c`cV61HPN(_v=hAi8UP~R?wPOO2B2z1}GBfFi@4u%nJ|9KrvVLps*fej^T*5F@ zXYai8-_$fdirTkIqZ3Xzo|03NIT5w=6NmkuyZ%F$UUrH2MdyCSiWPKt|337e|NMvA zwr#5#drmJ#r_d=v<1FNqi5Q5a>@>?Ae~`GRo_dlJqQa?T#}0Jozwh7;QabnSGwDgr?|=aV>FTSlrVro$fNr?qdLf-4 zir8`*X#o+MH+LSjYu{cvYv@3s(`QBs5YL-$y-97Fr%>CLDN=Umh#`G*=P#i%&p3ld zjrxpe>ZM`{uiMcq5LqnmHONk&Gu zY}rERo_nrLoy*D1qYX^lF1q+aA;6bkb_I>(xUahM3huNVA)~UZR;?29+>Y>61@Kajdn}s$~nlw{D`2?fLm*qCa86 z1Y|_wcTY=na6 z>f5u6lt((>kHDjkK1vBO;dE%99x}rG%rno>RhM2wUyb^hI=5?01-aX4()claPlr<5 zR_WBTS&9%O%=R#((wR=n*QBfzvjh}*GtZwF*b4UIN8hv1$5I5Och1adQupI!CG^IR zA5RZI^f0~p>Z@Yjnwdvs%uSzu{$;wG>+hFddP$yz?4oKRsULp$A=iaB$W&pBz+!~= z{rBIe#~*)OrVao4>#st{G5QEnT3%L8OP4O?I{IyXejlQDxZWMb?b-bK^QCRP=l(|| zoR?pInI3%TL7FmkisakWDGu}lO34E_|`Ocm_n{K)B8hYl*N97*w-le^~6wS)c zVskrMvUIW78~yzuXP$j7oq5^`@?z6%f70>8XwK|e)US6JdicS69J}u-Lj4 z57Q}Mdg(=4ylfeb`tmy=jpv?w4%Jqb&o#p?68$-MM3%^i-<&_ENqR6X5~IHu9Y$wJ`cn|~QwQi&sC1$82{Y*FB zaHHh&v(G-2&eNt%8>ytKmfn5uT{`vD(}WD=F|nTg=L{Nrj~iWdB(a{!bRtcM5u?-JeEki*_`(ace9cBGuBfHAM~mx$q&kj^AA#d`4yMb8*jW$Q>ILod+++|uah-?=tvKhFX!5Br(nHWRz*lga2Mbn3=IpV zAAa~=-b&*I#HW1yl9H08yz!C(B&o2tkluOk1A5{4=cr}+-soEZ0RQw!L_t)G=5*o- z$Idh3L}{-=%r;<~eS7VRE3reV;=x5*ZX0CHA*6 zSpo4XEUl84MWaWLk^A+BAAX><8@JKcty}5ZYp<0TAgFIHz2s8Kdur2EI_e5qqW7BM?Q@+XfS7lLzB`hhsBKR4hXWs1)=_3YJ?f@{_68#ejcC!f}>TTidN@Qhqr;BzL}-Fh7&_wc2cUP|A7 z`I(HEFIcjYI(P0O_QxD^jOgwUTyptU^w^WnQRj9o=-e|;(Y8cC{5XmF9MX?w&0S3Q zKJbWRw<)tgWaf-NXfwBiz?LoC4mEEf_K!UFH2vQb&(O0kzDm<(&7)Xu<8}wLX8lEJ zX{loF+N~q4Sg~5n25=ubWU#FHI;3xJ8aHl|b|G4|daX=nhuf*AoFLygG=LlY-E#9a zT%RnW@e?M|4cA{Gy4PNNsgOMM3wrhJt_U%su&{`>Zp)-r&QJ zMp2I*-RP<-F4i`C4|q-&FquTW=bd|o5LE-bRNA_2o4Eb^j+^NB-)GRK%}gR)SiXD} z*Zbeml~-Qu=>72hIMKuR9Nlhr-Fb`lr7&&UOxnWr&E0q3#(f`ke^^*pGz>c+r~X<= z)loo$h!Hb9_-JI&2!=;s4IvW=KF6pMI;D`8UVKqD6Kax}KtqNdO9Ku&j5ch^l8znh zF`B8!>3^wd)21@z@QyofX9D&CZQ7bCjmgco+(g(_7NfCOU3H~QGexHcYg{j3@|cm) zN;cuh;|{pfD02gynwqLe1Op9rWjWp?vm5&bImL8dthGT02V|^gpWbxJ$tQ6~Ws?vh zqC3A=I{2OZh1ApR;Cg2WN|HyfkR=Fd4nd%F2`}svvWS$8;gs=)hf?C_gi; z3y@K0tc~QfqXU65d4UN9J~)igi9;lv17lom*M*bDwrw@GZ8vFy#J;;^EOw zg7|B<#IAl8{kz@BYVNO?5M#Imch zM@VrSiAFrU_>2Zkd8$#<^1`^%UyP+OiFUe~SJ>Nk1d@E2RazJs8~fp8XgV9y*xP&n zyaDkFaIc=j6?i8jDQH5vDhwR+<#(_?tP)!@oX*?Lr-~Yzt20pv{%eX!NTeO{ngz!fiZk!GAfqWcVy$qz(kYe}0 z55rPHcR{#;Nrw8usA2J}6DC+K=r;BXsyx3q=G8Z&XinMJTO6M)W)Yt=00LiSl9eVb*SS<|?nciN zOB=_ofDUubf9bbKh%Hn3qs{hN$QM{7ln1%OZ9dQ8S=VVfIeqr0Vi{kd$Vr=PjP!Xa z23Hn=#W{xbLKxi?q%hnotvKMIMPaMr*d-2+Z^7Sj{{Xi#0QEV8f4_M5o?s>j^1Zyc zJPc@I7Xp(5jgJ7vL}0TVyDaAyMFRlLvpl|dRvL+-4q@r)EW@!B`RNIPFV-gp-Q@C9 z2J2QZDeAmVIjExTU6L&8KCXu>`IGu9uQa)_xU40BCi?=b*WTEfjeOeCQ?t>Z^hhPd zvB)|OUmS*=$@C^fg~y|qnSr^8@^{_#C`B02{#BIROv=4|t*J|7F1i55QEh&bEFBaH zni2!d$bg($fI;wY4MY@#qPux)2eUdsC;U^>dIY~-YRz#k)2NCz^fOIHswBHX3>3~Y zSSQPXky-OU7woBm+<%@iJ)P!N%DK5L?(lt1D$2_Bf8pMBzoR)x=faUH0xa5ml&q%d zRum#@6fB@X1mXqPeysJBm)f8bW$}iGZEKLdXt3SHHi1p1_XoQ^pjB>g-x5uE-jP>pF zBOMFe1zrp9v^-XN8@^HfX>j*_-@RC7tq7`Ydn)^)d)bzYQzYsZ@jg?IEeo6;9&~!& zA|neAEXL?ql4Y*9uE5lh9&i@ime9TS@Y@c7!9=}T`=|x~zKv}MFtB}z<=-DkT@tCw zxb_qFFh@-#YK_+|SYl0Va({{&`rmWI87fyb-;U!+8ce49YLtve!8LaZrug(cCntD9 z1sQo@&v%AM9n(dpql(zCT)Hh$2v_L1w8KvZet2W{g@5 z#vd7g2k_q_ZGWv{-)|U&4sf9@9dxWR`%aJh(&>T(6!Osg%-=Hl4RP~Bt;-o@y^tSsLsn1i-q^z zqRNqd`r#D%O5g;~@fM{|hL-4GOkc>pl(u-cV3U!sIMC`xkrm_10^%}lR1VVvWbbW+ zKQS|E=x>9lafOBUY*d8~LFt_jqev1a6nKVzFBeK3c75${5A5%*=?wX((GM-CT?4z7 zqbw(1<|szHqcCI#UeOs|ezSN)vOyh5wvHTt zVSf_P&{Ch&w+>ltk;hNTrNhxMQQ<%bjTcOjlX5(%li>hR6b(19=*tz9z{ApR zanE3s!6J*k_1FWk&t=CWy$FlJ23YiMno6QFY}z?Hi^rUUziMX^XW^F%BVQu9;V|Bf zSw9K`iyN(&SVj=NOC>zxnfgq~=b|$Z8Tzmh?UySca#z4xVpLp(pM<$mNM#0lz|O zC|tFKxG%%aBr0cOUQ6$l>Y7*jypzZD^-p>f8iXNAb&Tf;i)9^p>*)!rQb zlt@5g>b4aU%KndV5h`!S=sRu`TK6L{n}>k|F~bd6adbsHn^D`@*=L`JWy>YKv7C4_ z@4BGIV)8O=(>PxYDmMHMNb8{vtii>DKVvodKo2*%x_L)o`I?}JyFhQybSQ3@V_U^a zjQ$6Xmikv|h;_eR=DQ0)N6wbf123DSoFu9weEGcMq`>~OzqatHbmlx;Lh{dqUO8Um z&fI*39cWVLWtiBQFF=b+K*N=S(_$*kdZ!tjE)Zkg1v@4B-prHqd&uuKUh9rvM$oad zQaPS%m`JLcjLi81%F96QF~4&FiKbntcSQ}fFdQYPGnZhF2i(y!(Rt=c(idV*W0UyO zO-)S0##KICSr(xbWDS&l;Ap7DzYKER)u|`8Liu-pGnumP8^;oYB5$shY`yw|Qi6a zkc>*gm(J35B(w|#(S2lVWrT8nx~M8MX5OEkXFVTl+rq-ca>&D|jbT5pO0Oz(8P#V8 zOXJ-OWt0#=?j4bWAttJN73w0@;c-oaH^;rGCrQL>m)dSW#XxSC42|h9%rJ@^;JhxT zn*^)G2^-BiNZ2F%3A2&uk8Sf|m#0-qC2N!YK$*yi$$942`9>lU`GPxIWn#Jm|6pmP zv=OWFEC`d)^WJd9>>2e(F2gvp9hzbS$n|#fUqz7>Z8S9IlU5Z(UhJ=@HFL!JAQPq6 zfjj-J>43=Tyg)F`ROxl%gMq zlHd7xyWL$>AKg#gxBQ;75Ru)^XQTgP~^3Sn804 za>{YYEo(l%>*2^CCwZxIN-}*k5u{z|^-Lt0b1qa1=Le~$1FgEQuIoimV}VMJfChG1 zED1wGG+_d{PfRvruNK@F2R$2lK`pGank_4&8@X8V%(G;(GXJJk z14oOof}C8cAC(&VbpnaNhzuXVzbQ#k6$uC0_IjfSn3Jc*k@scAVO}T8MR59V+tLzd z;(uymoi)uG;(|=VxI+ZfhDdxVb6g*y-9{NKrx&VhCX!l58{N*Fhi0af9O`aOIj{`f z2B(+f5~2&nYMMjFZrNh?Wj*%@xaQPUf&j(=ldZVrC7m#NvC0l2M-usj1=b z!&pm|VdiKqw?~a}aWe!*pzK!`VT zh?dma?twK7zqS4GHDY31fp8nm7&3`Y(be1cF0&bv0NO8Mpv{0+`#g+^fPC_3=%}Hx4mUB#JSgYph-R`oam}bA^&h|S$fxcuG?rw zLuHH4(02dOb`*|h;3V@^wa>@l-4iUG_G^agJVHQu;NR1SjZKUE)+-}DwGz)YJW^uu zQy3p3Q%&JjIX>VCE@(XERo9lnmLBL=cL;ziaeDuejIX-xdsnR5`4(}5gm{#0npl){ z*)D0%clm4acS+l2OXSPrIR$Ig0*Cjna@5oum)Oxt`p*Ihqqd){p%#NNlGGc7nIajV zm&+?r@@*UnQ`w^T8>0Eiqimd5Fy%02>aa(Tmvd8OxgmSFoUYVX+L>czKKPPO8|s&s zGr_)7?`~86Xfyt3LK4PF?DMZ6uo8Wmi=eZp^1%z@7_v*c-eewcVs+;Qt%a(q-2A#b$#T@tsK(N5a8Q+mLrZN|=WLnV5m8mLQDD|JAMOwic!QROvtGqv zS2dJ0e~Q}8sc01zXe_`pB$2m1X6`>9ub(Um=xCkpLt9g%%XJZWzgp)lj8q-JJ6c}F zLES>QjiO2{Ty^Nog?%`!@bL5ibU(n2u}GFt*u$!(t{6tc0kYkWtEf`@!)rVI&`KZF z3jMOxrw%klO7OA+f9@Wj)>}?F{4u!yp|y#-4zwXuON&iV*w$7XM$ija|LPMBO{vSG z9CWH@V)05T6Fh{iqC3~{=ZNg83S6#nHWKB#sqh7awGZ=LH{biMcY=Ky9^jyzHuv;s z%S+ZQI%K2=PF9amaDG#*H#^5-JpfnF|9W7~$N2NYvVt)cEmx28bF4G+bYx@qVw}#L zN7Ds4O8lh!H=zPPoenWkK5wYRONQ`_YuE@p)>o`ZADQB!sxL`@?R8mMzv6z@mP-`9 z37S^~-&JWp(Ksc=9s+yka)8G^+bS2P<1 zZ4T`^?9thCXhtRN{&0@xURAqjQAD zK^!&T7U7&Tg?dRB;h(#?Y{HCZ!>#?E9!Ncg`pe;Ng09HfitLhT_ei|E-9yq}#V;UH zWvh`^+s5#&Gi&2WgIvo;tWZAA;hkrUxjf#?1isu} zQvK@#U*;fAkZ5-{74nk!S}R-Vc#u&)Z6}ZDd%Cg^EUhr@#9$W% zLllySoamY|F(2HFbP;M!?KImAoQ{+w6iSzT=nSth(Gg1;uM%Alq`zCC5*S3AqO#Q2 zMX-%kI1a%dMtTSNECdlrmBaO5dxIvJo#jTUM6AqjQiKUXLfG9O?`3odj%t^$cZ1<4 zE=DMxE>;%Ms*WpY7n3OQ(*rNJrP8@!t&uNblUMHDfBKc_^ASM`}Ig+E9q$nYt$#gNaDp6GT<8ByXpMu}JRH^_cNf-$uk zf;{e_@3ZEL`&er3J>DRAj09At}OBucRiF^%mF8+P8uk zE(>i%I>WZm^iSjhR^v0#kV=x4&|;C|+^v<)KPTakdZD%!*To3`d=flrk;k3fc7Ts` zY}USo?%oKqyi+3F-VBRJg`7=vb?aob`IPe}CI){!Nbo#pMcW%32>({35zf1f`In_y zKrE>xHse0bE%-NuADN5I&F*ATwksT><0{HXDhdl9aWTpvdbhsAAgb){RB9+lJR$|} zA+o(lB6Y^~FP8JW_##NMd&U@24cypc+)DLp6y<}S&O5pr^u)J$6*{AW5L<6GOG6^f ze9*cL@4q(^m!A1Y0w|=j?WtnfNq7EFrJs{%fpXGn3_nagrH;E8sXl!h4|+>Y{h>iK zY^@fh#9fu#s+go96lg`a$KUTd+Oy>i<&5bP)0(;-7Pd1yMV2d$MK>AWRtHmn8O4%t zf{l)+f|uY`s{CGPH;)0nhU+q!o$9)Qnw_{;B0p5$G4q}0{-Ro*q`!ysQklE!1B(Dr zu@8aH(|=^Yl+KXX==0EGxyNbwBy$hUj40cN74@mCwcML4e9`md6CoDV%snYCdpVOF zKy&2JgC6u+Nj*wx?7=)iHSse8a#k?I6{#IQ2+{kLHp*=ZHD_O@9Ga_}JFOnYRjzj+ z)U#gx0eK`JQ14=AEq|QP6;}TG6Pe?DRWB>nJ;~LSXI^!i))gF5=3Q6%&Uq^>^4fdr zUH{@VKV3vD3>qcD_o%e&;b-P*?e}nSVVYZ8Jfk?0&0HH=sfTkK@7I&N|!K@C`i>MvxR!z z-yMdr-bRNRKMH1sbeDDtO%!4hzgh1Y6;M^R&#hiTuEpWkvW(6n4XzWPA|R8|Na^jQNp#I?1F+l_Wg zz-!$)%s2=8YV@LW1N`3^8vcMJY{%$RNA$m>;8)PaDk_GBMTCW4yT+%fC|t!MAkY0U4xHc3jn>t0an-iJAVBJP3i zPfEO|7&1zKl--dKd=IxZuJ67@R0X;_3tMTX=2rt1bLnSn%`xbP_OR7Fcohwr?bV%| z8w~TY0OcjQqPSGboHdsGTIDZJ&~+$Va-aCnyuL-C6pH}mZW{M*13LiWZ z5_I3{xAWfFl_V32;*8`?%Lu3U!te=s&gi{4iLr>3tG;s;6(tf=Z+=gSNE(5K2cct% z@ESv2CD!_lFo}$V*XnKPl$MA-_&j4p@p;kl;05q+52wnG*!)-qc45hxmz-epP`Y_H zYLV0m(s&}>*xKUOXyd4<1H7}y7 zf>y=Rc#W<5$UreJH4$A^e(xKrvmdY@6v8((XA|zrf6S3cxV`e*_hktoiT^)kEFlrp3U1UOna~O zAK1-hSn(vMfs3-d`H3XmK>xgJ&ri46szBs+>sL)z;i7?$N*=e1moUd$(AM*gWv#p) zay&jqRI4W-)6b-v`86dxY1Wt-@V;-^`W7>mu@*M_gs}Uc9l_$ysFbF`*)yVrj?qs9 z(I$!ZC;p$>=nSG&zp2`qi9X6h`$?=p9|GukH@|)9NIYi$USa5nsquOC{@!+D`A)C z+$GKB@VXr~G(UEUW^M}At6qO-Kb0H6R{q85Un!m=!J{PN@Ir42w%t!Lytt{WtzGI8 z>*C-lz_H(K&jla^D&gVbsTyh$Wx2i??Vq!Ft%<*yo2$>i>^Gd$CpOeX>^5Ua=J2@9 z=}tB2O<)_wWs(MHlVu9H#~eMWM6Y8g;YUGH)m&g`??zbvgx!ZWXjBW$Tfrsc!(5DWV zv-WS{mYi>kraF^VrHT2^@Cn~{RW-j=4ATa^Q7J!3!4WzYBak@^sdTXwNxCiuUM7#i zK##lex@qr2p|?C&&Hvi|W@C9oVIM_gY<%*0Ho_4hMwmeYwchR1^OT+} zI@mJrO*E6s8dFO`+ibtZ+3;_(O0-N2#YG?8N`#i3Kz zYi`^A99)o2J=3DPXDT@?Ceh764kH#X7+7N;y;qz3(hrh}z=9@-_SgT#3e7w*R)Hjkt?j=6n=^!ApnT}C)Rxz-6g8)HnB{oMoG8%>i`Eq2FUnAD`lOtS{Wa>ap>-!0>k)5--4-C&T-uM! zexLs%EV}EJt5Z{181mO)S)wn2kg-kk=S~W(*EbsJN>VW)HYP!uPgQXEzJ}^oLQh{* zzb#B_8T!jY!J!s2RX2xRbiO)7!?|0xJ)9ri08Qxy0(-tEi2sIz`!M9C-J@5mk%$ub z_(2%P_XMBEi+kwusQEGD1@&p)KM#^$9l^)k-QYqUE%<0Kl zVAO53W3JM#5B_Vn!Dx<18l&n2Q*=hK1c8ue)pjz<)Qt5vWG?LG@6YPi69wH)KZeDE z?A$G<%(qjnlZD3EC-)OsB&66bmHl-hBL;I zBnL|C((P26@57gxCe6ll&S9}ALYJMV9_&<|X?cMw6cM5-={v<3KIFl$r@ZCI{g(kx z49a;T>({rd^La;u-!GT;8TuVNz?lB;?}?bD86n6fgqQ@o#gMG<$nvtfU$QKtgkig` zD%grV!QO|l2?HC_Brb?M5W`uP5g_6`8Ki!!FqAx~ZVaj8QKp(=x;(EK5wAn#Ybfzm zCKS$(5&AsbY@$M=we_H^F0XfSLSN``41VxX3_Ym-+0|n9eodr$t9A zmQL&>PN`cA6Kx$Gi}uI51Pi-utFHOaZO3eO&jeLtydT2k$Ux0ZwNgu<|R@ahS#w$lV8Is>&C=gPD?j>rathmDskPw+jAA z*m=qJEv!iNF=xck^>B7OG?MS|(9k13txdFN|Iu<2eOVs}_3Gk)tCaJ{g#JTky_yzM z26;S$;Vyb||Mo`dbJ1dHy%tt6-==CfI(~pEu0|iv_W&L9)A1xCcB=R7lMY_=eH{Mt zUSwwFavYV%t#q|`p;S73uw-z*i4Q|*j*PTP(;eH&FbTR}GNY13P&tN-r$1DA5yv80 zQBnUYTody@FL7N(ejOOVg`)x_+nHI6g9;?gV{9?7l;?lULYh#f$vTGZ`<^F;POIXTIo3FKz2$PrpcP4R{8he9^PgB`DUXe)J@Ttes;M5Xvzl(oK)hk;-Thi>6-q-;3xjG$3#b zmV$G9*KJiUJ1>pv`kFEw+Xrsrw*o&FId7VoAjD6Xs!Pxfk-_O#ko~dT6<`QnNe|zL zGkM-kkFxaLo!z~xH&}dg?tVg6>BTC;GW{r)jvZZoT5kEmYW=p^!hw_5nmj0*B@%{P8a_soBuqRcl$ zTr!~)Sm*Tel90o*km8dBl#0TaQI5Jv`ySAt47(r_22n5WA$=_K-2cYKeS#+wd-~|S zMa6g;lI@U9@Qa-kKE-D5%X^+~VwY6PhLyql)CCW9A+y0n= zf1Zpql{6s`K|Eu)K@6!X@&GFGoKMPaGOxFoC=9#~MHHW&-C%vY`T#DZO_ zn{`18H6NEaxoT4Ncjs}mgq)gpS5;A!P`JB-U#xA@b(}tfsKaZW>j*>vz&ZW)2VS1* z+1d-N*Q?DM1t25L^;mA=y9|jvj!Q}Wq0-0-C~A@Dgn11EfBd~4T;s1N$uUhJ+{2lq z5EkTjh{ao8$kvh49xtwvzgo_*K0`#mNzXf&m65!g-FNCWqE~rPgXWFh5T6kN-M4AocHH* zS%`m{V)Cr#0v6}g`M)WrBiG&Li%{-Q8AMWaHDcq3bwJrv=)dCLjnL(dzOal#+hmUK zrQFtA+!N|pe9C>k@V%U={QB#7f>(AH(Bd+11^_NQiKb1Dw)Qyx?Pt6vUCl4>X_4Lq zv0iItXk88xjE4uBOBIFfK>{WVNHT)gE%=2O!mVm^cNT6v1BdKdgM*qSn%@kh5D=XI zC;~rggLMW3Dn~@J3==bu6GeQks~=oBCOfzsrS`D zp)AJ>c~S9}FITt1x9je{psA?pds9pY(Z#VN`gj-+ z6fL;ZP`iX>^mlWw#I}6I7*Acyin^qP`pZ-&Nx5v|&+%d(^?#X{6}u0j73)Fb0JFBn z|C~5Ixi#nYlP}Z-N)q9p<=JY8{<{e+L$|1VU?VHlKiR3Ybu47S3QVnN!N+)zjS&a@ zzju*})y*qlF)YZ}V_-}FNf~e-X%mk}EH;rnNHF(8927dd>hm@iH z!JiGh_rFSTK}Zs!L~}v(K(%lML?RPV1_Tg_uGEFLWsSF9kEbLes>9|-76fh;j#U?y z<@)LFMb=@Nx027^F5_)RFXNHt$db7h_QMHpK7m-C!in6_Vc+n{4f-3qj0D8IrfCyi z#b>!*hUD*_iqN9oU&-PNO%wQkmVyN&Nw3OCeYHz}WpH#nmu8V9M<@I%dz*fL%!RYQ znVO?M1BANj1`FS2gfEtM_X@x_Su;1x)ywskbF(Fi1D81;9a9KcKIHk9Io`N{be`zX zUt4hD{!M{Pih*1EHOaW|MPUDRq%}!I^Cz_R57D~3E-RRhyIDows^0a*qm@R%_eLXr zeYXn&3Dlc(WXi?W3~B@aXKAk6nt=xXdQd>7Ks?y>bz;Zk4S_D2Wbgb@q~LMGTjPvE zRrH$PU-W>^=X5>M3IVIKEYBKzxT;PsDY2W83{??PQ-uPABiV8vAXLT*Cr>IdT(qgaH!aBtW;Tr z-`uRB^x9N5mMDk{eov6f(9;cla@Db&)`8r5IK{coJyY0`0hr#E?c4sHM&Vu8t@&Wi z;+bu+%%$FkdmXE3|2cTv>`C3Zefb&9FaTV!)b%nbC}E|J%jdXJ2%~Jw0pB4@+OE|b z`mR{hxsO9uT(CG12QMKuTFZ~#`LR~BNx?CJTy%~8%tDwlmyg~Ujao0DAg}T>X||YF zncmeGcirjz-mTAlQQbmCgxNIYwI3^ShKDwv{EG(v`g)st5%cPwqXQzx{F=_UibJIVK$B`Lbf|v-8&WxLfB^QvEbI{II9fcsVfHL@isEwk5SX@_ePd5aOHO4s8m-i`c?4xgD>nplRK+EifS)|PoLo6JMh}vA(9`?8@A@>B##&TGG_Tp1MA&kxXw3!e+# zK-JiwuAkL@SN11s%#u;ogERit=TCK9+mSjABD)ra`S9mO#%xsaOR57~09R|KG@@_5 z=u6-^MRu*8v4eI;NUP^1%i;3!^6cX;Ruv_20DZyTlvi|AzCC37-Lb)H&Y%=|cYq3l z@-?sR;y34LOhtbv9NIzWxd}xBtH^7y$8~Luae0#Qsr zTnw^!)zGigDaEnhR_+E2eJ~ZO`6)-hy|BETzRL{t_9>p!>8_4$cJv1m$@=Z2py3;l z+wtsIIp*n3f8W;Q(yTqITkXq}fF6jC0|DXNv$+O``-HKo;^MHEhjS(p>Ch~Pciwlt z7b1U|S#daY!^@2hv~u?>WsR(vUUS>^pH zq~%F)adkcVNmRYidHTr~ebeVvlF;i33fW*^aKufUgv z3}l(>qr?;KY`VVk@9rO79>2h%p(}q%taL-hi1{}QS`v4+_j=Z#mp8}Nzwr*wi#hY* z2+TnYHAAF``DjEdlc4|P5BZ-^9(6ix4&Pml^_iaNlm9RXjmWo*7+0q$B$Mf1VU$l=*!3#Y=!S&ik(Tg~RDe9f&j)VrMn1%f4v+-mwNfekYJG`HJfHOmjF>C~XsyBRc&4 zI2q|T0e9ZyvwIme*K49$OZzKM;ikTVjWy+GoWCZ#w#)~Y?(3Z0i^ZKABJo`y_K$^l zkynrGhi$S8?lOEKG5`C^wu=(r-x{wIO*}OU6w98DoFof;E3kh=QxUpX0=$7W)DFmY z1&K{m$RZ|e6WJrgrri+syC~>Gw$+^x0uA;Q#wPV;j-6zOaerDZwfg(}<@oTGCx(Ze z&L}Pb@z%veD*6TIR9B%sFmZcejIeMdQ!)Cr9 z!GL1hF8!kd-oJLV^KJKQgt-x9yp17Kq>`6*6U9RBZXKbPB^(c(>nVYJPWl*?kV|a;5L!UvUjk_>Ino`!87zIKI3WEtkfuB&kfp z=1jD$1#8=z1aHr9*6ZJ`FP2XTvZ)z8F9N4?2)xS;Ns#ApQQj7f<*B9rQp8T%W>K1WkCqUCq{NgoEO#6F=mI_ zPK8WjwZ9iA@EFx$Q^iR8ev5$@g@EDj+k)+n)YRF2hAzd9Hg2Z8)ttuvxSBD-o&Jmz z@chymH8KMj(RP3PE%XG>^3=%0gq(%nAxRYGuhSpCZ#Ec^^YHxaeDR1o19f#>dG=cy z*R>5#eEuQ8TO4=Ve6sxvx!@^ij=WVz^3~=G~Qysi?##lyg?@RqK-;Ff^Tm>Zna!U zBm6M@{t|ao=3G<(FuFMeTH3U`0)%O3X!wndNaiLXT*9n-F09*Gg+H)KJa?>L&bnb1 zTr%BrAmC}Hi{&xj+0UBKnX({?hYF4?k!k%I$zcDZa!fs$SLK+k$MFsh+06~PmLFkD#ZPf z9xW&F;DD}EzmrcQJ!_6%cSuRmI0D?qm^X<@EycxV&b&-a7$P!FY=v-?-^L#ahppY* z;?De#IGBl0>)H-dSjc5?ei03R3kyu8|6+CaPcluF z^HUG`?>hX|aId?Qlya0jxC)B4v{O<5h{3$l#lWCikJk+!Bh7bjF}VLQxL7``Bfn!< z{Kl>nrXJ;^NX7rTB#nR4kM^pu!TXelpo+PseDAKIBvAycJ&Nu?p=46u0v1~?nhWD= zsulTUv+$eX19tdu?&|$pKTKhQ`sIt$N=4bsX-)b4Ot-INSG6)}K9%?Le%f3%|3~(e zmX7wBDm5I=%mec&!yhw}dmCNJB3af#8Xa$Jo;Mnb((*{kqN{iF`yUaZ1nCd2y@0b3 z87)>gRHu3l-#l@+;<7=%U7sz8z-+d;jhC%gQ!6fafp`DkB5Uc0Nf-|G+!BE=uV2|6 zVfxbp%(xuetm)2>fELJXQ+<07_G~5MxUN*l(C=8<=VD;7;q+n~B#D}Yfrmvq4qL7? z9wB#OJ(!Lg*Z2$1(COzc8q)guoFAHIw)aEJB(^?0{K!aIHp`s7=*J73KtMnG5Q-Gc z!{WMAtkOsL`T_HOpum1JmP#S#q|jnUsqYV4N$S9IRu%Le2NKS`cF#xDyXhj;VWiN( zpn&%mL2Kb+Ez6gK$ZMA_qsmM6AyQR>WBCL@9&Q&XYV5fl!3KweBYe!~zNI|iEKyUv z`}l^$g6nUmt(g}H>Y>XG=&2iOosUpCb&uQx37sMP`+B&%nfNn|T0CwYU*X?qt7%Kg zq7o=*1ia?>c%DmCWt>qE6W_v*->YzX5H|9)K?zovYlhQZiZo#HRKb}?E#qrHZB|u z9WwttYoD9z!zX^P-~{0VFIr!FKEv(bwxzsU8k>Nh>OWKgz$C+XoXioNyPXnMRTa7} z_WNlESlec;`-dYH>gm>12=%W1%z398njREUy+y8v)rC4;ZumEg*vlVgyR!JdoE&Q1`fS)T&MA5M1 ziT(%LL32!WiBInHzhP4k57b7hXd@&>;KSmH!}SA@l%Z=MLUihfK-(J z{!KYLGFiHmj?c)-S~MI59}|<1%+S8X24`%y))1YXoU->?4ii3*nwBO@Kych(J?DXl zfKm_^20c2(YUFb8(vCo<79Z>*nfyBr3@J+zhEI$(%E3n;H=>7wwZOQn-u$~gb!XR< zPdR)(72#vS{#jz9)&h$fWzIHSZ;Vg{c9xEcK#qiLV2w=aV z8$PfhVS170lQOscGy4Lin08=>tp0%1?Ns@rA}ZD;Y0gAZ#S=#2426GP+QhN$W2;p2 z>48m-!3%349r6Ct<*ck<8FoK{ExU0rAh&}GK~&$X)J@@=dUxFErl*3|h@7}Hz(L!Q z25H~MJpDT=c)ES_%3mTuI(vqnLV*~j?G0}N2p|-tAc#r)8(d6G%1>V+x$BZqJs@;= zY#rS91bhlg*p9gHNxIEFzS}<4B`2x+DZuSVHuUOE>_;o7No2HVx%6m?!VAX{@cS zc-dp|oAdmz%vNu2qJtC|!s#Sq?tss&k zIaG@y4kDS9ESP2I>!O%){UDc>S8uA>Ss`+7bQ;98EdP!Mj~Z?-BP(330dDIsooyY_ z_h?aQ?BRV?iE(EGQMNBJJQMIg?X^v8jDb%btMSOO0W<)(8R{SGT$u0e?JZ>C5;ma> z&9M_tF#0xUi-K_vqUE=tBplvD2vZ<7n)3KPUU1EiWPudB6?e`a0~a`*rX8Lt@dPcf zgEnoA390F&Amp^_gAmYfmcOIkkG+Sw_ZwE;oVz)A{_BVpr7b%HG`m!1l2%wGhCEI} z7)%JF31aiCmq|FwZ#w8<;3B5gy`pdf>L3U}q5^#O{W>M%JjveP9mfcoGT?haqa2azYID)1ul`H(JJtZ<^Im?LMwC&-VyAF2D12|t zKwpi9AIJX{_~fYpc~qyB_%v9x9Y(P?hqk0E!?ZsI0d8!LlM(V^tMmHY5c8OqW+}@R zH&f?wj88=_Ylwu)pI(F;p^|~=iK(-gqXDRzfcf1ZL}a#!@oyZaZ*TCW{myhMBt(qj zlt2+fb0s-%fdnR8h&`n#aZ*cWufQ6pSC&GI%)!t`lll*YP7gRRO$Pd+x%qM8u^=`W z%e{GRIl}F{k1g8X2XrlT%(zok9mXg_enL+0R*%+v4_<=d8@|}oQ7oCM+KxJotp8T( zaZ#NoT=W%9$w}VV2E+e-BN=Exm;bN2o+}VxH^IAE`HZ}>&0hI^Tmsp)A+Gtu(`^_< zP&JZ`LRDatA^7?i>wAQnh<;79B<_UaQe@p)8Cs-PXz)#n(A1`a&it64T zWg~c)9fFjyerj~cB6xzHPoyL%EI1SR z`Fo3Cm1HytnuVe>q|@TRFJ2dI^DrIVY&A=1F_niVNJgF#qxelR13Td7&tMDf|NUkP zh>mMY(F?3?_P3(vIF}tm{Dxfiml!D4F29}qBc!VFr2@jOFG1=EA1%WL-H~zf4*$AB zn(BuPvaY`8RfjQqkir#RKCxf@ae~>?(&-tKN8X^;AD2+0(Lxoncy|#`3wE6Ouhao= zKCD-gM#EPCn{tiI`_}Tk!f@^C(4oY6IAJTp;)EaHD}2|z*Cc;pQq#!Oi?CBeN4V8} zeNDijBd70t6D3EC*1mVuPc!@MX)Iq+iv$@mH6_PnarP2z1MFVum+$Vx)~^}+*R1}% zKJZ}*yxbLfIyHyO#ZyNG6gp5{{M~JDF&yA^l~y$O@-$gaYC^h9-yvU0nMR zA_GrwX6_&kN0qs!NuLfTc2BO0q*lAP_NDC_RXPgqAxs}I!OI0!!eZlt8(OJ|eL1XJ zCjWbugan^t5=r$1t)|IeE`~<9OrD(V?dzHV9c0bjE$bZMtfkm(~8SJ+EXkiDl*GasoC-7%LW+rhz|l z269a-%?2c02@{~AA-K5$tA(B|96e*Kx(Yh`E0mU+=5gZ*{+mey^r~-p7z6$N)9zaO zgXdbQf0w!6IP7Ve^;=V`JKs#~O^uzeAPozwe%IR1iu40$DpevLhf=u9k3=eszjn5lGORnqtDN*rt}%ZmgqsvNr}nwp_=q9)IV!l@t7rY<;qljFog10dtNgz$D;^)% z#i@d{!@?uyXz+51?6DIBEz)^(w7oz-enS2;62XQNQsLGUPGHS|ava_5aM;g- zxO{t3c@@6e&Jjh5g+e1w>x)1sV(0=F*#B44^6&xx8;1-)>(elQZ;AMiFjmFvd>wnUCbn(n^ecmS>t9yTE%rBCf^z@1m-%k5H8fbH&Qq() zD36UX0nwP8<>lq+BT9l95^o!DdC?m$C|TuNQw{<=vBKioR%}&UheiHvJemgTRrZf8 z$yrY_Wx1!j`4MUQMYiD#%a{p zwrw@GZQFL6#&*)!YHVALZ8Wy6lXv(3JooJp2eabhY5e~aQ#RVkU2}K*Hbk76ivV?+^1jbj1JV)WQN;3Y6Jl> zrl~v*3Crai%ubY$UG5Lcx7J%yXpqx~*ZOag~5T%F-l0H4BUKn-C=# z)%TPtU733G4>3I+H^;LL|25Nwy$2`m&Zmv{Q0`9O$zFjgL9@DtEMUgZrHivAAL*%$vL5nH$ zSy*SVgzL*S``ju$URY*&28KK!0Ve9IadSUDG4?wZPlpZf^`~KQP|$R4|LYu<92&w5 z1T!FG_IUiIi&0+SSd-^$y6di2qG0c3ca!B2N?-d;z^*NB?CeZ8ox_d-fAGN~+o?|W z-QQ*})O9}@QyS|E{(B~f+lN5UvG_F|nwO4mx%XzhW zsj8__KiKc>?ZG;+gD~lI>D)1(5vPSV0Wp_4D~u|3@rmCwzn=s~4}AW9Zmo(HyeCm} zk!iKM#kjr&g%%7DJj$!9$1H;#AD2xw7_yE0Q^j_rsOjQ*yAl~BaB8+nB!0{b4jx4O zK2`gD>|F6lBA{syVCrst!X-6QA*O1)qySa()2^z= zO_z3LY2-PKiMav9M|r;<8MyUW42=7}xH7#I{%aqiu$;GZINx^;^;!TuGua*B5tl## z)%3=CqpyWJ&Gz$oBG5EcRLD0xE(fwF3zdnB>OGb;#U~-5p*FZkK;`5DJ$pmw4?s}v zO_=k8@Xa;>{HJbO5kF^|Amj=fMjR+42FzFx7?ROaQ%j9&a%!ra2UwGh4Ce$)-t(4Q z&piE@8fo!3WG~q4CGJH7WWDE_HhNqQqVhAWcCqj)k??sM3bq1rj-#5iHJ`xmOdlZv zKxZG+HwsfZUxD=vHZ39&WokDBDfyN{E`7e8`>Xo{{^OkL=*S2%KPQtM7R2LlxJpCx zH)~}+dd(WcW{=NJ0ELkCse*gZKF_)Ug4TyYbM5hVs(bEHH{O^O&^ub3^E%9y|M5e( z?tqQ7fIJaiH3e)Q(0qP5IlVkCk?Ia(2pc7~)zH(EDHtx5OJKUM>&Op$!JpOXTW+FP z;h5zc8e;`HUOWV$9lqX!}2B>AZJ*cJ^aTGCjy-lv%Q4ukH zXK1^^gM))hh{h5C-N_ubRcW@SBc3m%UPfE5jKjDS_YxEjX(HJ#8$#k+%ka72`#%Xr1ta}>e^9#3)`jXx9UIq94 zeI!Es%l)~WFtO3y%HjIO3D<-d=!u(%= z3SMp1`5$70CVW#k*}$eNdoJmz;{GovY?)3gx#!t)1%17zr~3E)$e-|PYHF*dPD~_Z zEg*%Yf6||tZ?}r=8P!FP(0I;m)>-f4K>)FIur~}Rrz{K1f0d5+^)@GxC;)T)zvzH4 za%jDfchA+v{YO(B5O~&brG1|Y_v|Ossy(|SgnvEg{TD;z_JIk@!^@mEF#PwWC=2bi zMzl@R*2pI+CZOM4HLW=rk{+(^J&MS9mhk`1+n4XuLtG+;?!K%4Kc5i(!CU>&No9&J z(8>#;vTXIa^Fsa!13^rv@_n-GzY7dH`Mk|r(wjL>^m_9z2;9m2`J69lXZIb$P5*P5 z5{W?^^Ue|O^~0fptmcXC=?lVG&KcjEUScQq;t$6E#n_MxtK-p)0Jiw|2>3oZxuQ1V za4gMVaf`08%buLTQwM9IDiOD@+AT?u+<7d->Tns5(8Pk=5Cs4}E^t`VIgU`TQm#q< zI|E+OCn=}*V+`T3$?b>J>tnxzu<_|1D}Hx91+4|$A^oV?aC5KYpzW#ux#8L#R%e{t zO%kAK2KcNg%oT;5N{EaAXcBhxXV;U$sn_VlTloy(=6v*Vl&?Cb*0I`j%o+KWXUj5qr5 z@26s}|G7fG(qbYzYu~H5xf>k&T&}zyU~D!+w$@9QBrf`q!4R_k4h#(3Yhi@MPf9D5q@kuy=DVN`VwwR~zZ$MMWGpnHAF_(z zLdrp7KPt;Pz#f1sh^_*39rv`C5v*P<>W_f^s-TT07+6E$v>FLLq{~L#50mxzqcBG< z3PjS;2})bklC>%U*q-=z8^K;W3V{}0C&E4Be~AgB8O^_`nd%xEG8XwE=MRmBm5C9U zUz`I*y2KuBxbcqEQ`l27P9`*U& zRi7wEp#3Pkw@IyDy_|-kgs7^GAo-v#PRtJt{OGI7 zFezV@Iyg~xBT?`-G_7GdE@3QUXGH#~)&Surw{x|1={R>vUkuQ-bTvBp|5-e$;#Dr} zbBB8s9mYKbDmgj3TWYDj^T z8GS!_8SNUH6qkp0X`ZQAxyAp*Z$Ug^(2}HHp{?+H$u|EUw`ul(UMuO>ud&s}2Ddq$ z{Tbk=YfK2HVkb;;o$}SRsJuL)u8xJ8hvr-How~ZZvaK!E{{EqouWL=5OsR=AJ&ii? z57`&fMTCz(v&f6R^9Hb~N{Wg^_a?Ho5W&GA(!8WWsaZdN-n;6~gleei?BZ>Yg#E@? zroPej;GvmUvrk$<-kqLC4kaSx3u07B%Ci6<9&qH(^w{jFvM+>WI)@4Ygg45fqW!zR zF~YgUO06B}9-h281^(6QE`xYPm`H)#xoKppH5RQM7OLSA2aL+Rn;Yrw7lIjr2V$JI zgS!M7yn#=81X)M(2znh}A_K&2hxCz#*;FN#&KzcK@(%mXvUhZU6*DU!0Y#fia)?>3sZ zl=Y3sm*iySpONe!Y1HGyRW-lKKU0wwzUaarf3Qi(<^qMf^e)he4;;Kn9gOp6A;yJy zR#}|V1`$=j+t@Y?vzZ>U#d2^^X=6gZ34|cvRk(~1KvYCbY<)`}1PK3Lp`20Hjg7uYOKv%CHs0WNy^i}K2uXA z8tS2#)pf$3=IjR4$7c4VQ17*N`vzclkM>j)N~#4uWY^B{4P6h?3ZOZ0X4~CPF^I)d z_59KI(bU6qegB~IlGVM!6?DDD#PEYe{T`;E!>GkiWLrf*m+{a?KOZ+2abBV9R+|c1 z;Zs#e65BpQe%oyk2sYG`U=qg_`Bth@5~HfFE~?XPn>U{6`*JeI2#|H`P3ttt3*xPD zYH*$hwADl;H|9Krsf=>65=9dI(tZM zHWuZv2iwZkSo}}NfkX)C`|J&VuN)B(U-B~7@uYG{mLoFo&;IYS9H-*(nVhub2+MKz zoHkh&wCQ~)18AUkE~<0gMwwV1#ew|a=V`;tICX}KrJUwFP2i7Vu+dVJX4VH!A1oW3 z6i~kEdhEHL7T>dZEIN=JY3BW0XoGZ_`wpI82cBNv@*M+Eot0Y)SGOnAo~Se8t@^}c zbg=u>9%ED0?o=I>wBa$Ox7y(G3B1*E2E6Tj%VWkO$G_0-$Vtw08k*;k-jB#yxE&C0Ie>e|9!W|*)uz%bhS0^Gg(i{4(+=?4+TJvsRx z8Uca0SmC7n2|4VXcXkgTJduIoZ zII0x>Ivl41b}(I?6&1g+6tTtPtG}x?Uy9pXWQFn_{20cwETMjkC1P zVp3H%2*Y}z?pM?-i9ewMbnX9cK8Rd%<&55 z=5G!EcRTm2nnH&>1AkHhgFoZc`77}1OSH>a)DT&?m^W|{R-oB?8s9CZMtQ$9HYYrO z(9yfw-deTb5)N-@_hqL2Mo0FaHyrQnK@Dz%^8Tbnx-^o0nJ{SElkl_`23``3HNXPYLy{hObbi>Hc zhszrzPPgHNNZ=XPq_%Ccx6<g&&ran6~Vu zk^A9bGv4}f1tWi#itqdJCDoKU8rDvB!ue(TIpV{CUz7Pg4bN%j?cFbExpcBWx6S_V zJSQ_n_?0^C;_apJ>a6FFz`Epmu0*{5{(vSM4+@ght~KV4#`14C`{X+whQj7{f>v%=*Wx@V9T6E* zg!ZsT#-P5~qOO`WM~Wo)4Hi#5v4slf{+Mb$t-?SUkZRfSRBplRZxPTFYi(`)mKGdT zj^}ye^$a$TvuaIIpTS{Q+}vtA#eE1qIyHvsb3PUUp!(ooG14Ca&NzjOnSofX`;pZ{ zbC+`mVKKP->rR@r#v6!cXDtRNL6p4g(l8g|v!u8j7NaG`?qul6L{6I{qx6N4W1KaA z3|j6@j%rZm+vIp@sHvUExLc{SJa4SDO%7om>JQMix&HEnhJ+|%dra;a*IbkZjl$nr z9Y^r3wzMX3*wUEH>WR}Xp=l{{}ue`)DVw{j-CHsAW8ae+!boz z3&JKgl{~ENk1e!fJ&eFDK9SH8^hja!YVkYMX_5dDKvvh5czrt5nibDl`A#$ouI8+BxF5(Gj|KV8rC$ z;oKEapB@{lPT28%xjC)=Cn#M6xL^ft23+bbl2iO32k5=BI0C+0cAFhq;zBwun?nB3 z_yS?(Q@`XgezDn4j29mqPaFq)yfflEOB#$C=j&@KOXc`IU{7Rl#%}uV%C$YD+myDn z#N9;Dl!@J9pkZQCGAawpo886!_OR-o?_QRQu;EgWl}}8_V7jgnTU$@$HZ5h~){i};S^WzC3Kh1`1iTiHlRCGBQ&1O&c@)F^SYLdrju zR`&86ljh>$Hf?}T|3zFys{}-j*9kNB9~RHsbELg6rOoWlS4q6nrK%zc(4`b5Qd%+Z zTiWix8Pp9b3bxke%TlAw()2B3=RustfYS_l>YPFSN7AkRh7U|H)T+mkBz z&80ZXb0-@Rw<2uZd7X%U0hY`6+oV6P8~2=%{4hYfkCj{BirSeqc6qviS^^fan4YGV z)}UK*`4rPWhUnCp_-3aLCt%^h@Xr0t3G9R9!Awq_e*F*lnOT8*2W}U%ss9PIS68-{twXA%I{RUra*m51V1fh*p;^c9svI(vp-W$s8~I z&%B~6Fx)ou0spA?6(oW>^dZWuM1uf?m6;6eFIKAze}0smnoYngPD7mlO(BNA%aX$H z&VB_*S+^*DLHLyQ*as`E0M5B6X_1r;P3)Zo|Ubn%JF8A*UrH_|X>PpWcvw!3dED8#lAh4=En; zFf=4dBstan)+VsV{{}cwM8Tv_dZ#{A?%`#5##J5HAC5_qt&gKAMcw#;?vacw!fbTE zb+GPO4y1B{5yd!WydTnCU-Fhi8}sa4iDcF22b}VsD+>zI;DU=(AgtKZePZt1ZOX`W zZhznUSYWvS>~%3)lp$~%f-T2hSCYYS9{pP3meGU=bRI^<4Gj#84v8hJC9^a>UVr$E z*v#Lq&FpsGxLy}&SYjeEiM41{3$W}w57{uzF%M_u>UC^0(xE;AMhc3}1pG%~q@mME ze*|Hr2)vUlq^~ZFm&W2?vnkvxp#gfr%v>%})l}Nv57m6P9+n7R`}Sbt`~vD9IlYms zfbhg>W(SFOt#2!zg(dGK*SYJ<&h3=h%jMr*2}K}9V`jHCxveVA1&_&4DEt%Z507$3 zizsg3K5^P&yW_R-C@ocPeuDKsX)=a4-B>Ks?AkMIkJMdN+WDI%F5NioX2A zMAZ&EW<&;NX>7b1Jq@P$bUIw$cN@~~ztqHk$%%=xFWmd;>rt!EqrWWhB<$9j(D*+i zSD`BKM1UT~s2w97+Qn+47Y50#sjcO*=AP5h9y}KNTG)}Ie=Rn z5gsqbNj=1)oN1zpSzt|phrExp6<`r+qk8(2*C36L~9O-E7VbVpm{KGYY=@x2qkUk&(%`w+gFyet7>^gk;AV6dc>W|F(v z*5rike!7{Z?|BUgB*Dy`(-ndTpOezi#=^_;T;*0ERqE-CoshozRd)Y4KhROSNE?8HhB?&(f=YO?Yz zruc&K>2;ENl%0<+6VSCUZ7EE+fv?eTimR);X;sOPz~wZXD__X?5E6Nla{CHpKLWD&l8sWo31=%n1L+R%CY1vVSWo=stQ&N`c>*}2aS2gthZ`s3}g zpLngHYpA4FZQunUKMqOR8$!5_rA*w%xL;7w#ZANR1|+#v^*B*x4!B`${q$if@|YS` zWN!aXL{S3db}q&&XZl*vFbHHPW>ty^aPJ3GT_?Q`m6%FcgD>Z%#Ql07LCk1`1z|fG z4$*~diNnge3GcW#SV2hRmSFrBN;jQFpy`0@VmdKYTJzoP%?sD+%0&&Y9KDh zXEhg7Gz#@JG2S^|Hc=?#+{BYQ&J_1$8U9~<7M z14d~p0)~gj$ML-Hlab2i8)?aS2$%GHeqcInp!D?znrZwgEp?2Dj!BxC5BZcqG@;cZ z-eqU~>DxwRxRtJLVN+S8Aw^~Pc$x(MTJs!-4`Gh~GlJfB{i4mzvP0TkL%u=4yIOIb z(a+d=M#a;t^4~N^OVlPnQL-^9DM?lWkvC=s^#SyV!d!{To2Kuy(6~ATl&|Z#le(=Y zFfiJomd3t0stJtnib4qte~P`Dvi)v=+a#>(c5um` z7pb2KJ6~Te+F||g-(mBA4;G^z5uOEBXtqy8rh((Hu@$snQ55^%bq+uujd+4oEyh3Z z!}<}19n<}xL?@D#x-tIiAVQW~QxoTXe?p!?ijB5suJq6pJa~^K``f6~=hEve0=-+fmK!e!0BLrriJi^i!PTi5$c+D=gG=+T z>}h31Y5wRcQ8_G3zSk|L@<$gxHSgBF-z2`_PLRRzqg6eS@p6|{4^=T$4RT*$Cg~R` zt*cAOFX*F6d2f**@_;}dF#F9p_mKHbS~@I`!Jk9?CiL%Lp%=G9fB7Y)ebGLqBPnM2`D5q9LNHmf_%749h#mw@1kn*OF4d4&h!46O@NI^i6 zCvvmRke9eS70vpU_A+-(`TDv2Mo#troaw*+kO0+geqL5#u$jkfls@N0zJDVlAEtn$ z?*q+{75V>tYoy*!)=JC_&3T9rWi`7`m0LCO3F%~twytbY)Q{8=($dsPuzJ$QUvkdZ zMn-9AEI|qENi*faO)IZY_p!fR$CZBG|N1Ys|KC4iB7eo?e}Dc~T1TPSMIY`kv(3u5 zd|_~&UFuQlR;y+qU4^%-pYu)Z_%|t(__ivkMALjbM_nQuYSoqg*aQ2**H7*ys!GRY zLpNjJ!G2gpT0i`pLWh8as55x7P?85<`Jy?Di;643%v_6xfl=&{y@yvykBd#yS(Qc> zecwA{{JEHtG^d9!U^2eo|GBI|K?L?>>(F<6;^`@hT7(}W@-m~fasi(bJBcWqiR=iR zdfwpCzFfQ*OwRY_*?=SS$I0Ub$Bq7Sj$`UoZG`tnV}@|`936DK6MCKP2^k?uu`Q9R z?tvJA*6fXi<%ZeX>W5y|d$FIbkTfwHTKj zDAP9B0L3;q#fneBJj(;v(J3@=2ng{G^MAr9To~OTjDj`tN+T*@gQ~1zLI}?%yCa?; z;mT0snU>XJWEq4X@RYi;E*E+$wmC=zGJy*8ADFZ2pPr7>66a)uMo6XrY*jw0r=JBw z2ZL!k!o_uQJxqo?Hbo5#1uN)apM>4=@EfIuKM4+6@!E4cS7TG<$Gr{PpfpU>Egc!K z&~36v5$nLrW$~qw>}uI({_gf~PzeVIs?M{9gaQ-AAeFcx*Zw?i{^65y z>97O7M-QdpeV7g8xxx3JYdM*oe9*_oZ_u>mHogX<3)D5;k{FK?uRpa?bv)XAsqkb?@(&pyTv2xJtu>+SWb(3{k&dF9o=ch!aqz!G`q%b_Y-pD0O3 zEcnBzaZ3i?(A(6VQ%&&wno0Xz;1VennV)YfK%IZD_kWy`?%Sglk6<$oKF!*DS>xgruZx-=;Go07f*gK9}WO5?8WANkAM zanBy3{P;)EAMxST=D*NO33CB`a8*?>@LNHH)zaU%xtbcs+EQ4=T|`d8Uzy&kkN7~F z>E1#MEv?8meidx=6LP9ErB)({sXRpAjxmPL)h}4}!;>YSX>C-U?ph?{^rhk4RJ50d z2t^|UWGRPHn__hO<)%Bw{+Osg_f(71 zL9)Rma!{tX)^&JfA?(w-#^C2ASlrL|t&|XEH?T8|Z;32DOPhjfw{lH4B|Plk@f`Ef zJLgv>GkLv@7qjtOCOb159AI^LpS;~f=38~&k3Gr1luWNF8McRv!m+boAUvMs6iQ2dxn4R<%gwaq%ATpE2}sxqx22D0wcLQCAvz5 zq}-8NqNp#3I_Tg8ZRP8TCt17 zvL206Xr}r?`DL&%Q1WQezm5#%ti0txEhw2Q{cNI#C3bJ~zYfClR>XJSCKCJv|^}D#x z-3YkI;>|jjZASTnZ(alTR?$+5aU8zWa307+Z!4c{N6+(E*<8%JzoppL`-D3th_CLU z{qaIY;7Spy3*$SUTVDQk7ii={D)W)QMP6s$A+HIyINf=fS@vdsg@w|tQ*XFz+pXj7 zuCA1`=q9Ca--^3o#aHnE{J@VJVuU5G!^0Yeo=MzB-GEXe7v>q>n3|g;qBl783{{k( zAv?5y-+TT<8Fz6N|2^Xr>q+N69!W4Lbf_pG^7kQ$y*?WuV^qkEp!VPuiIWam0OWY0)6NL z`zNOhVLs0HBv;bo8nD&KMg5jfbTX%`Cu!LoM6*LDWvF0HU|Fx(s}?5vTbip;IVcpY z5$4+lpGDo*Q3Sm{f8R;!OPWegsi5tvQlThlEtA^H8?^a0;~BH~tA+HX*rua6&u!(-k z@EVEZ)@63!)%N-UJ|FVyt~mcQamr>1X6zsveaQVToa-WDIc5WWm&U1uiH@X){rjkl zhabD3`M#SdpZ3i@YZ?8q*9E=VwX#u1gOFQzgQzuTst6I~iicCbw){J#PHG{oi4177 z>+*Qeq4+O+VL9kxnHQ6P_DX21dF@*p9vF{{L}9(-zD1o$_#C}PfKE))mdmhf(;I#f zHZT&!om4pM?Oh%GA1a_*90%(iaJy_SdOZ!g9oGa#AVg;GwUHo&ykfD=(#sIC`>Te^ zHv9FroAqRXL{UlD+?`enl*Zq~7|=ToFa|?S#nIY|c_aa`&yT-eePc~nAv5sm6Gtr0 z(i5as91=ctF{z^L%Q?)eu|ZN+JW1r}#9~0ByMY?`+#R`S@&hH;+2sf?pkvYHM1DpX z5Q(mCWI##ENNZ&*hbQ|{l8Maz*;k!&R1c|{8(FVIJxi643~zBR;MBH#mK-+5LRi9f z$wA!83YSVBXQa(6auaUZ_j&LvygxOoI=FdMwk(5Wzjht^tN*gozuO}iI+WVcq3Sz( z-Sqw5QhUL-r;X%1xt{ct?tHKa@(-Uq^m|srn`Q_9^PYoVzyP0f;LL4_9hVvGZ;ypQ zj5pVAuPHN;hP@S@5Bw}cJy#1AR|$XkE|Jv@rZ4?WQFh{Md2}C)ERc9ed^5+eB?ku- zC_W_e83`}CG`ulYI>U%$?C2$qvlHRHuEVoi-Y6}M6jtqbYMDF^_8W?o5j5AggUL8X zY|NOO=T^v079g}Dsag!9KYZkjD84lEI-NpW#qp5Hcaz0h1Y{qVyaZjS2z-pVB&`@_I? zjH1Q_>%V7S_#Uq!3>kmd%jLY9l;0y$?n9PP6iCfqSNhHtPRcKJ!PA?Hq10B58(iQO zaf>-qdcD_=J`{Y-lK=+3Q%>$Dm_!)rNfNt1u8cBj7e?B~M|oYMSTu65*dICW@(6k! zL45obZK0o?&d48TK8a-EkH@~4cX`odOpkB6#a2^DyOV0XfjVnkCwEyAZS)!A`{B8A zNltSzzF-9b^wml1#m=tJNf)7iq!tpz?^df&j?2dd?8H%LjNAza7Q0Qs=fTrUo<0r< z@Y`Qj_MM)a6C|BhWGS+vZdrytU&YKZDsn?)#c=(mqNlx$BK_-ymVh`J@MS!+`}sS z6yY|=h*L;uX#*|E%JCWGx8-sYGiCbZe?>d|vaFFk{jP3?vYfo3{PD#^CQoqp?lPxa zhq+12xzgfVJJ$TSWmLGLopnkIHJ-4`h(SU6_4+Q1tIoum@AFuEI8x z(~di8;4;|Hvggyn!7neFFKycB4PWN4Zf6a-oyEd1??y4fvha~p_1m`z;HO z$^AT4u{fO44E*WzwJp&gyR#qk9eN_qTHaeFHi~)RpDb33{Tw~ z%{U?a*7U@BZu)JM*vl#Bx|6zEKYNp^a%pAmZa?RA9&#*|+#bc9!>n72r=;^0L+GXI zXrsNEQgKDt#J4)`XszUv+#ibLPaM|J(WI!sey`StvH0Jhc443+ds*sPM{mOF-3i#~ z={0guOG%lWH)nr5h`V%_AGZ3CvbL@gS5!L)RqJ;uYH5}2M-F$QM2F3ztC)Fa71QCX z9u&>RLWUS=1r|_7p+<{iBS@7YVaoFk(be}{erIBk7*Ru$Nvi}?Iky@T%XT+iJE)oU z^VGW*5hGi}(Po3EZl&146Wf zNgy@iCYE>9h~7a!Ex&@HDA}a@sE?a?C;p9`u&w@mn}}fz;UKr!))Rk}Jrix0^}XXu z>pr`rASIfL^M<;r>TVUU{jg5G{*tTag}4mJ^O(r{3yJp zx{i5Gw@#k-yy3S*EJ1Y8$D?{1&8(5hAq{a>B21lF*rwak2EZV&a2!wVjv5+DlYh=f zHnSLV3*l4hpHxkZnAJtmK6{(qIBj^&k9I1g#6XE33Ose?3-6yq;}tlwG?(#}A2Y$; zAwj18)>u$#CFze7tMXTLT{>Gf(P;&?U`An#(#mRBZHJ{I=2PVB`ZN4>39fx#P4CYc zg&?ZAFTW*kziR5J1_kgvA-%mm2kcI0IT-Ippr>&;<)?(!yrKD>EthAA&LLJNB|b}m zHAd0j@8U~vCD0n@T)audODUz%=W{YLVm3CqJpsORPD@!H#qxkXil)G2FV+k?5yyI1%z{B3)Dl&9_!D^g66ZmbO z_YSq`xg#%&`N4R&Lztbv!k_m%E@2t;5#?^KyO%(Ko|**n=|uAtz*#eTj!4F$THUjN1P7hM=T$3hFs;=&Fnc`>kIkc5Tzl^` zyGDdK(u>>G60fC_$I~Sy+y1obr)zDqsAltkAYA)r+M#IdXt2*OKF8MS6TlA#(|ya1 zGYU^Yw`vJS;LVf)^gN(~#cc}%IQ~=~lBCv0SO)Re{;|n8|8g3()b629m#V>m-t9fP z8QL_b>^@}jWSU^_?^6>TU;p^nhWOULgsr>6i@W)6!*^HZ(2!|(#au*n&HRenYmws@ zvc8VDcX(*BSfRDrYZNLo80%iqfg&3tdm@?DQqL+8KRSuaD{;nM=9s*zs`4#J5sw)q z>vXAlc3^)hajx~f0b5RQ zx=wXLbi<;gVB^NZLeZ%N+Glf#IyJ?*Dk>W8!C3#y2uaSE9%n(~dkNvuc-3>yIsq~T zcY&;0KJNly-eP@;Urnuo6#dIz>Cyy|_V>*|N>H2o7rXEBUi{ZXvSMoNF>kY}P8ZLI zyL~bYVtyuH9zo~+<5|20RRJiWUt^a9C6HDGm^rFHgEqYoEbGz>DHpL00O`^GHn-Eb zEc_Xc(A3h=HgkuF>NSl#npYlW8as@B@4#iupSGU|auBMPI2z0s&mQ0T31O!UZFRmn z6J)ln(F!W8u`~%s*Fr!c;)TWStqs`dt*SIt=EXfpd>i?5z?Zz;y91Wl;#xorbEkKS>g5s^j2m{6bQfI^FRRH z*1-lV6}6t}tFn;$f zy^%`kbY4C1x$V-RC6t25(_il7-xCaa%og8K<>8V76y+d1e;guPNDvGs+ zd8SBwSaGK%EK%P>a6_`iYRR}JDqNf3*IADLQt`mW!BNe{#6&l`-WgoBYu;dTyX<6g zJ7J58zYLx8u+kpZ9T$6WJ7KvseR-2#CdT+N%17%nPc7gEAX%JH35WUR|6?sc5U` zeZA4co@@{cltt}hbYFwt;T%VdBn;2euAS+fUTih1RKf=Ly~9TvF~lURK2%*KXRXEc zvOGr{2UaM;O%V%sFw%f?Qj?@FRZt@EXL~(#AI-I6E@C7bp6ItrWy~q~ zbt+D1wt6Gjx4t9Zoh~6cO!>n<@?XW3F4~TNoSBfBxMA_Ra;aA^3{_XRf-wqwfPro= zF&%q;yh>-cdhSMRdA?l_*Bb9j^W9zbd)_ZB)c|Jq+r7|)eLs=-qm~8(EUdP?WpJl> z-hPKYuQ{~qiFwgs3>QizHe@+U&IodHI9vaNeH(c0FdVbgxn0Y6049;=ye)1Et}&m$ z8Bf25df2pKM2|z0L$lu@+eN({Q(X7(QH12AzY~oI=Oaf=_UB`M0z|Pjpo#b=X2f#|MEDwB#&KL*zg7L+-7l4=fmC|j$Mi&hP0Ho zM+AibBFoEZIsmmmPpLk>>w!c~@~olNHlFikwWax;fRD$3c-pL03Bq?u(Ce(sNX&uZ z=G*fstS{i0#%w;$b*|8Tm4kUbQV<*7BEOUEb2*eR7U`<(lG7DjT2Xp4czgl)GO}NE z+%j;#B8$gjM_Oe6`Y}x41CAtk6Be=}(}f8)X#l#>pkl10}=ai)wS z;MXnTnDlijPI)dX$?p9wEHcx)^{GN%Cu;4Y1^%*wQ{vGjUki)HG)x}M-Pl>iXlH&I zt79?8^Nbk9z@Z%Lr4L2IXkcWf%K`q4zNqBh847%`Ot*a^kFJC3mi$X1mx_COP+$jL zn1HAVU3l}BH|j9qBl$ch#r1jsC^A3*1Oa+p?yj-dgB6d#`B{?fuf3YpEZQKqfHDhB z=#Tc{ePe~vw(GPj$0?Fd5QWE#AtsjWc}4g!z{;B44>0c{h($sTm&1BVA`JRBJhmcJ z2ko|Z$Vr@Eb8{LT6y8py);&J9iY7cUi;5DKMwEEyHQ3qL@QjXcl0EMmSDrxFC4aja zr=%lQVDq}^Bl5t0LK`ifale!fEX4>S0;G_kIyD<7(29l8Vfe1nbjhbBy#V;G_YKtR zpY`&h_Wl?I-bYHZYZii8>2EU(y#zjI;V7iy`9M(=V#QijjZ<3U41IoKVYfuE9nRwY$TkyD z3D#_JL=gbIBi?Q_G1+uNZzJ+tJ$uUNy! zW>z|jOzt-36ovyK;qT->ru-jVbOB>$uA{#{Q6?rAS;$0#lsjtYJO<(o20lOs+IU3A z-ESwqv6u{z>s(xFZCBv@C?4`<7<%P-6?zLk(7>qt!WV27cOX$hw?2B2oHknz%Z>_Q zc44Z19-h%3psB}K%sCawlcG4xrxe7Er7$kZA1~MLI^MG{8NLOofF8*K0TYecgfA+-P#8~xj8$K|<2@fY z9&5UM`DGHC07X%m_q|aMVtj2_Ui&wQOs@m2meUI#MXLN)LBJ?vun zj1Y%_S2p0-NsK*|wrIoqK+BU=3K-?=3U}FGf6j7Fzxs^CM`Y9;EyLKU8vN+O*b%h4 zs?9(3S2Enl7M{TOZ}pSm^S{V_}3O;YI&2fe@6)%ch3U$ndul5lkwvSJ28Xq-n6?x&AOoLDlHFmX!q z?wfPhYZ2pa0s}g z9*J+V$JA@>km^IgW5Y6YmamX#A|?%aSgKMCR0X+?C{LS{cP-AYhU2(23FeoGW-MozY@q)SOf2fBN&yB_A2~+3d?DTr> zVF(Hg#$s~J4f!}KKoXm0NR(d{^Sn8hK$)~oh*3eO`Au{8tUwvYb#M1KSGeW8Y0Y)7 zKA;=)az>^Q2M?>1$-y?HhGp;=y0smx@;htH(&bk9js1J36pr1y3OArUTs9pnVUQoobPG8)Pj0`Y02a+jd|H*ivRx2 zBfBn=L3=>nE+)(*;tw;4E_~7Y?oe#%E-W0@3R&soRC(rqLPf%CEUb9+1bl} z&Tg-WLZvE_gsGPs8!0J=_?I;BCWkHmw#v$~{{C3L2%GBnXt@2+6YJwIp=v!y*gW8g z6!Iy)!+E*6%}MMG-x|clo&X8?qR#@~PE6T`B%dQABkz33biQU1yA|WUBF;jf^To??Qm#?M?*SksZ5ver{o1~bi4k5Mtw(>)6 z=HP?W)h@-a7nw-4UBzG;20r-y?-{3xI$L22Hjy=BRqdy@<&mij{eWR)jq3_rr~OLt zz@642&3O7dhw}|7*THhZbcq2N0FI5Yn61fD=nR6{2a8%jAsK3!RoW_a=Mv0A3ae6m zkA3_Btw@A^H@_y?$|`Twg&wu>{yGGFP{zF8pe$S6cy1Lz`laah-SF&>cI0wRpgYmn zcSs$M`i5TD5A)oO6xz z3rmW&=0-uX-Nz!I3JQXX*BBWYXYV#l_R5+M!=;%Ul^6Z12Hb`-^2-PG46wV?0{<6?i_!+W`8&g`q9(EKlP}9>#b&Xn zZ1qur)L?44PUZ@%;ZDLyUM zeIlIIdQ?K$oy8SwJwpm5=6Ffsbs_+~?ACX5OiUU*#UYcff+@`(g{2N66U^E|*K zTGG9Jw5cNE?Wi2bKlg0iR`8$KmDE?nwhQgi79n$8?x%(2gx|e9YPcM|>-!VNxm0k7 zxR~X_SGaY4viR1V3J4icx=aE_Cq+%j!SgTHVSK-I-aM`>;CG^Ur`PzkqdcxjHamIvHimsdxeSXxSYDuRfu4H9!qWGK!^XItHg zUJ}JeYcapRL9aZQloz>4m*jy<|5k9GmH^Nwkeb2X0LY6I&haB|j~qnm4NPZbN z=C(%HNn5s1IElT1J%-D8h7`;`ZTn`P^A;T$dMNi<#* ztuVYChiiT6)${^#IsDZR@9>^lpOZ?Z$U5M);G6+Rg}POyk}wZNhj_N->vpmzR2 zXrfm8v)2=MiI&oD$`IU*jR=A6lPsSKeYk!L_rBv4D7V6*U!U)?9KxDu{n`IL-5>a> z06I``{SFP@x(miz`9cQtPwndeB zVNrGdClA+2JlNHg-b@e5+Nz9)-?jG0ktq$Q?T9A?3h-pf0!Evqc%hbb{c&SmYejHw zI^`sKsz2AJtBiu-hP$*E|>72 z{C4f{hDcPHbs6nHZB3yxRb7gK4@wr?hTio;HHCmUN2K0Ja-t_+Ba+JxeBNFk8m3c$?G zip+~dWIVHxfzfUPQjh{-+wS$I%n9I>D}kgoyWHVTaS>gm%PARL8Qf9UeDvF_e}}x^ zr&vDxBd-ds`+|AI@_2bgM4%8|Uqv|66?_plM?4G)$r!>$Z$PqNxmOdHyk2p)J^%#8 z>7z-snKQ$cy~F{uiYiX}swHZ_Jg?KJE;S+$kar9cv?05}9fb3) z_lNT|bUGowCdTvLWpL^J4&1rDOOs6np}M+qlko^nhHu^=##CHSwVnWO3|3md(oI%~ zHnWrU_9#Tcsf_9AV#3^79}e@wqj#)2@2M1_v9n4XQ?5ju!Z^+w}O z&1x0|u%qSLPNeI?}6M&;JuQ zBZK^KjG8QcNALO7mAIj(--^h6=lbNO7>@P3s#5;13o0uN#ehOe0EtH+TsJX%C&QDd ze&r;x2K#tzBVx5H!|S;{(Ec0kudhj*xQp)ZNAmTN$^J&ZBp9 zHRa_qkBM{pHqX=EUtTt?7H1}ag|{x$gJ&+cu<7Kvn|RFBNaIV?AVecik9Tkhnn{}r z^l^0sg*@l`^D}!&LR@$sMm-XC?jsU%g~zR#=d-T1CF2_uyr18SRV91va>HHhL=v~Q zt1HcCa18p^giK1x<21ep(3g})uMa+O?+xroSLe)=1?Jr0Cjn_hmiH=+N||;!c>|#K z)U@_ab(N6Mr2zE*A6l?eLqpL!8!wl)*&HU&{5uiQOt=A0sfp#$F`Bc_a zSr{9ys-Ivh{FqZJt+w!+%Jlcm0#%*#L))ciFZw5R^RIjz&>)e9AQvTF#I7CDd857k zl8Z+9#-48N3~gNW(qq;56D??}C72FdT*;m=s)UfklbPN4r-WV03#hROx4SRr7#Dq4 z2Z8@kKm_}Vkut@=&ZwwBp2$Of3p85GB%EWP?x5|@4>pVa8p|COwl!Ww(s-#;NA(t! z*7Gcu%ax=7yNXZI$xn?ZPevAW=%%Jk_>$U8W*ZGv&YxTUhNCHB1hxYNTUxIr1#)vJ z(kd9*bgB*L|O*)UkLGoMiqoIbzqLjI+Ow599<#A7B zI+WJL&8n{|$?@ZB>T#*SVZ(l^kxy+<7k0CWf>L_0W_LgWq)w@YX>ztbkpFbUac@D0 z`bmqhiJcE>0mAso*8lMnq9q!w39Zbn*OYu8`|+Le{l>7e-hG$(5@xf<>tBbNHO&kG zH|~~58+Wty50m36I>r;>ftb>rUr=b@u0+i;*^G14#ehYmJ%R>rJRs)P-PdAL{DR4| zs7-Z4(>{Msp(j2kOe3-^9Er)3(#JujMc^GThmN>kc5E8UsJ6hSATOA3-u|T|6swE1 z?TtY|&+(i@Z*UsDQ!uFhr;C2_g@G3jMn^dC4jp;Dl@-U|{p8~O_>Fb1(&^}i_S69+ zJVao6B14&xo8=;e;KbtTATE&0KxYQ04oGfyBAc&_LCsDj$RNu3Zp3ymYj;bIM|U(W zE)$dU^KvB0MkKa8jz&i{_lfT<61Y?_K4JWat}HkrZPJA-OY<_;p`|9bi{7eiMVoKC z7bsOOlQ&r7iS4W%e9%!^$${(G13Tyu`|D6XzUEa+eK&Lr!|hz6Ora6ywuQUi0=L0X zxhJ7m309ewleu*%s~~-v%qZZ|iUrNu=`Bv9f5Xm)>vEoqT`p^P_-S%uxN}JhX|`bV zm@&VHt$wqMaq*)m1RB$02NcJtf{Nau`nhyPalV+3WTB5=to8A7rx0HW_`AbmZzV|d z?M>P3l0UHGMWIUK@KPS3wyvV2 z`s7L*I?85VsjX$DZWKhFzjd}Tk;-L+!DPvdI@op7y}yRg70{)n4$|bwunmfl*Bj;0 z(>{sgE+Jt0XKP}t=J7$@$v^MI_U&iR%8j9@Z?`%R6)V@DF3DXhF$cLo0)Y07F7x=| z&#+Ydln|{KD;!L9jN;&C7}ivoudFo(5cz}>eF#RKC?Y=~dVM*#J*L7Kcw(UFcC8~y zes0W^zI*;Ueh2*aGK!1th6aD~nGj1QUE<6)H346gc)ZZCjm9uKIpTl?jsJ`{H~mvy zZKyvFx|lcB0LTF(G`MrPUztyFW9sUqNW40qMG9qZJ(a~Y=9@QYq)Fx%g71BOWxAjN zju#(|?g6PKtZ=*aVw5L!PGQzzO_d135UrfLlfsQlREZGc87GxFOReP`&gKXV^<<8h zmimG>x2M~4&HpCKz`30^o=|}Q*;#{=L0mrvIQdt#nEsHZ%jB!fDZ|ooz!lnNoA!Wy zjSl4uo53`~S3yX2Gw0!1*m<3N!^)5qI5Do?#9r}dxuyVXJr2i|POQ~)=9m3OmN2wB zep#B@vTTCFI)7h;@|wSe-z)$6CPQh7g6Wx+DE~O@!7V3&$8R=d%}-zb(OW}8Hm8WSf%8&~7y5bZ)x+ zuk8U@f6q?WEG^u-$gS=jkogZ}#J{hGm9f)G4tlvQp23%}Y4hkUD*l*q-pZ5idrT6$ zZEh%HpJQ61SEci!X_6zpo-~VF@i#@Jb6@d}xWN5VA1~jbjaJUmAt%n_2l9&i4EZt@ zMWX-IV~>0=(0>p9SkvGCZ>jg+pAGv;R?jHn$VC*O6;ig1kCAhsSJfmgv=E;6JD-)$ zJcyCYkAkXWYQidf$N+a%j`dM)ATKA3AtSlL5GBgZ)g~3x&;!;mL2W~hny@amx&1N5g9*{TA@D>UqebkF~( z(gEk{A+SIb52EuEcnfp}t;~5`-=y)6kE)Ye&P~Ao_aO(R7I7Nr4OgD^in;i5=Grz| zu;UBc1!4k0QnMaZ$BlT5SfbpGvlYd8JpW2PhfQ53t~A>J?zIKyM7DA_&Fo+n%hsZ% z15V+eTKmrljLcx}v{-^CX*uR^#;bgsWmSW}>#g}{kGm&KZNBNyme$9yw7FU(>(M_u zw2T@sm7>_Yy5H7+{?8r)7b;!K$w`^9Xwkwtqr5v*1U*RP&o#uF$#TVh;llN@D3GUq ztHNsVCVNp)^vwH9A4hYJ(UB8M%*i81?VsH3p9!$771%0{|4QU@k4bx`w&#!D75gT` z`LWUIIUZ$|Z*^{?@Pqm4$5ux1nCGVv2KQ0;8{5kt|6YV1RNpp3Uqu-QIs1W0tu`k6 zqVQLqDP1b)5L4G4*IrU$ZUfuAObwOxwL4n*I5Rc=lX@#=q5&8N@R>{a!HU_#RKY75r-C7Hw1 zb4ga%VRhXh1zAZEPsTbjvwjZi>NwsBHK%A8D7z-isb6-keselozA%D03{G^Ecg+Pm zP=E&q2R#!;<&^A2>eaJyt-`MUZ}H*6Gza@ZHGO9nnp~-Q@iHgdPurLG^$lEG^hN;w zXl!h(0AXfFzj1mqk6uops4L2=US~;@=SJsavQH5QQMj$6I2s~-$NjOTrhi0IfJG|F zdXFn|I-V6NkrjFFM&s_sakBA|yy{jK+a^QPM|!q81Og05mpIC~_J3N~p@%{Y>0iND zfB&n-yC9@6&d+4hZinjYAIQ)vP4Ezd-Y+* z(9;NLHf;2wDu?vPy{Y>)OagBw{_ue>M|bSE7eSQ+p=$USe9-^T%IxW;7jBjc)!62J zUHE7hEY2y7MhOPk{(G5$jylrO{KUng>_bxJdWHS3H}PF3&*J4i-s03=mb`AoL5?H zLDZTL3`(>>Z>4uyLzMy3Vx@pGWe)>kTDB z(2e&3J2q{t+Bdy0GcRJbUV+@~`k*POG@-^&g?0!>p!D9K`+xFNm^-e>y6H%2#1r6q z-9`*46YvuVLSwbH@W#5R91mpt)hcB)*!l6Qr_NAGhq5bb()E0MJ=whMR9oX6_>>=> z8^hvx=dg^{1Ylw0Hrjv@R5!pVnkh@5dC!A1ShMPJF6)>AK!bX6c%dgi_r*6jIJlD#ue$y94gzg*V<#=x5wbC(K}br} zeDD#2CS9N>3#V-&M9-tiJ8|fY&7RF$pD<4BCGjRSPPO&#fqeh`*9vw`<e&~UF*O1+f|t!w@cvY^ZFFYqZdEq~5LuZLWJAfJ-*^qd zj3h*$cbd zEkhNhgzPGQvBQe}%5Fau^U`6iBHpwEEAuFkJQGk=$vDCU&kti|0$+2|g@`Ym%`o`C zcVL{|#ML#lI+9xcwr%ocTMkZ{LILJfO^jBi39V8@PY>BKfbP|r1W)TJKNEtcHghT! zz>r4NLN&^GX8JB_``L}^+iy26ULWa-2qFjYxMlMc8y>d>H_kG&{KgG>Zp$WK@IOdk zhkY(G#e3ri@yQ0!(9rTN`gF$GV8yL3OPIRrPld(uu;B{B0xjeZ{)LMB>s=_*$loqZ zj@~9uj)Y8(lFLX^)c?~j&oqM_7ldrbP({-3>>S#oNHU%#i^l;h&{j+Sa~ z*1E9O8oo1{iKH5V_hs{v<+W;X?ul$Fjwd?D^tvhm4JN*`wa13T{C!VV>)dJCds!+> zc;O$2$01&cR;A1`xAt|VIEnK0ATv+%G)S+6;CulQ-h3+zUKr zQ#AkeCOOpOPDaH9l8<~2X0|E>Ff%;Q&_`NN*xozuUUacK zW;`y)(kF64cjcIx{{gT{$yO|Bhrdc^nhkGTa5F3676WFje~$;RC!UH%CXaKdi*btf zC{`nrCJp3jOnAAqp)sG2K}#6EJuaRt@KID-lvS}+{JYTOhgeD^)*qW9SXU%J)%g6q zUIpmYx1x0l>2kf9jNoaDW1-yWk^2M8C4R`M3nk>hkCMQeyaKdyxM)E;E!W}TTkSdr zM0^5*$(%GmoWZNOrp+n(n!%Kdu&3>w#20PFTQ%b2Gcb*5%2Qn26yZGm@~)U`HBJ z9f`E=26I`fU2DQ4-GR%f&@&go78Y~VU_g^O%qYiX*p4Cfnsv|2>|w4HF`(Mvt}I1^ zz?aOfTf&--NOaBpc&KN;yv>)@Kr>x-S$(9JFGugQ8?E9wYRTA&wMIW@ZbSE_M{vi$HcGt9T z(vB;xcK*xj5l!nqKxMOTF;+)^(ygB1bE)%Ub(U$XW^n#?pjGu($z}Y*jsHbWCUvtA zIcDU|<8Dku3K-(%)>a7WB41q7a5r4o+AC1mghgzVg2it4ONm9GRPUQUtMIJs{1=pl zaed{Q;pA7V@4Euft_>{lkOaVajy72A=iJIjGZ6wV?Q!l#E#wgb`P0?8LRpgNG729F zwcq>i(=c}0U{cG@z`L;qw0^*+tTV>N`mCh?jqre9cODFgW^}F=Ed?24_Bd-<`rk)n z&ekS^J|DMqT9%zGDiHs^7g2C1zY6$_s3=~#B;}UQ$cT_}8&dl|hUi*+kD9u%F#sBlsp3iyQ^AkZs zi3=%IQ?lvY9Cgf8U`=3|_d>S#;3@qCZKqT1CTjbgk!ee3L9`rmcJC(-6hbcfVU{{7 zUX2tZ%bU86J=ewRdB=2|!l#k=^ciXNYHpR)55h4Q*W}}bKSZn0QO~tGqr=+WFgZQq zP;gyg?qH>1($&sio}(WIzN)BTWwB&DBlQ=$9fc;u-X!&Sq$ploclEd3ahz)N4(l_O z?DX2m4yg`^=deHs9w$xB5`UT!6KSf7kJ{4X`OWr}&`+#1T7=g+wj7hPVU(lhqpS@{a$4@ibqUDR7uI3}fd12)Rx?&n6WSmc6r^v7uwqj}0Ey zR7^y8AD@yG@b%)HL5A~0=_PoiP+8L4@% zN=sj{Pgv}4H#YNFo6ng38yD3HKHrXdpL8NKe~Oa$gcGuU?ETCu@OYuLI{UBpYoeNR z)r<{%2B*j?$sm~7ONrzQ>hF2iyi>l#jrV@o6!7FON=`|kCu5<|SDe7?z_qsc0dlm) zxsId(M4Y5wo2qq6SRe`K9}-+A2_TrqyBPJOGBP0Yj7xe`(*OVV3h-nQ5LZ;~fA zYY-Bm1dB)A{+wj-a@B96^;*o=P{OyMVSh$7=t43`u&W2d7Ql9rV+<>f&!$R|p<92c zBfK6MjbBTD2Z%{e^s@-+-UZO=R8yqY1UkAlSF8xWPtjwDq5g(Yzd`7;O%9BI{r6(d z>Db&I0Yj#NkodwW%o~7ogglP@YnkJJk&n9g}d@GFcpGoPKE0}=70zPw-g({&wID>zUwaUug&uRbwT z0WW#1fk%9ZkbcP#_qB{cE?IRx}MCnvEHD@xdEB`(E-UZ%|c#d$3$z)|NH7 z``HI=8$flm;*t!x>UNuBR^=#oqH@Hgvn?$slbdA=B$Ezbk6|a7kbUv&C|XZzC;s4g z;WXJ$vC`JX%Zr)+zdH=1)wmFFdr+=nwXe;;Ttj5h{4Z*aWZ6oj>ZR{ z<<`7YomDnZ1oT_clVy{|LIUHzz%t3|g?Fj9-;SRu1)Cp_{ogy?H78Qn#Pv;KPdW7q zBE+X)%6>&mDhk6K!!}XgRzp)a%%O%+c60vif3H>$9B=-0MDm0&R>>F`iC0R$E(Ipo$(^ed7?@DPW&%0@V^ z)vRfULU@5xgA19z^GbS{II$O=G!FC3OPeAavX0pm5INcJn873V5^6VE@a>ASZemeT z{THEBqG1*9?P9P0omdZ5H56KiBnnvx#I$JpkQZs*n&*x;ob}Ew2Z3gYfy1uK9Nw$ICDVvev{fg-1RSQ1-0wSSV}MiPi4^l%VB zDu+T_;8Vlvu39!72u}*g4x9jGCcMJZ3NG$<0t;a-0`ig7GO@X%#>XR+QAU@ta7IV3 zB)Ij+YU}q_XXB=U`}A%o`&3U~i#T5e7SP1SslA>xOhW$Om(^(7(O!0OTMn-iV=twZ}R&<#?#2w9fp z$7>&(4j$7t^?j}c{*@bF^;k?Navcan&CAKX&WAZSQtd}hBR&(=B^@r$Eyka;gbUp5 zUbr%8)X*>{{@$r?G&D>FylK-n?WPN7P}9V5u-=H^v&RwuDsLO~*K_MQ4l~REa(r(9 z5E{;dRBbdo;hDZs_o3)vv7O(dIB4?InfgZTssHVd8FJ(?az3q@X`IS2fch^OZ(pkC(qStRBLQ($9+ zFFChVDo~S8a>G4|*FdqS!8lA&AfD2bU3Q?uW4Gr_>C;(5rn9w{)BIKgcp(?&xL<=} zvG2mffZ4UjerCtCFC{hAUQ;3yQCk9&qoXT!kOmQPD~zy=Kfr8dh0SSG^Vk*C&=Btm zgKXl?4T&6|w1z+bkh~ok9&*bzjD~w3HSU-#esthH7dPIYX-1skdDzBZbh%wETaB-g z`Rx?~utOSm(lP{ydA(kuKEt9)JI6jlO3rbaI`8eb*QRGzO}38q?365|XYOaJWY`{? zCyw`y(fEEoH=j~1*$pxt-Wex9%sMQd?}t`8E!aP|;N-Tp8!UF#wQ*hg)4rl2(RT~z zdhRVF)%}PWAvUHK8Riw^Ec(>I{{gcSznDRcMkSQQ%FzU*9)mLCJO)1t1t-1UY zjkO+g;H&cFVU>x@B`NZnsu95GaGA8v@0Icoev1>kDvKJW)o}Q388+7~9yJ5;M^A-b z*Qwy@y#Nvtl6+g+%U+KydKcSm@4Pg+FV9|nH@h2hCq5+UL3+Xgd)(}DOc>&}O{-6D zGp$#@qUWo-90Ym87t=PPomvAg@ccmM6Hc+Pq@5w2?c1A~qg$)rx0h8y=FB>rwQp{p z{#pyhh5J?G&S_5dsO1(8=-5at<|uv1dHa5$r>;kSw(FFAI+*4372`2C~L5y;t#C~i6plTi(AB>nli{WQ!veW8cnqyvXwf~o;D*bt9}h6F$()y1Z#b)u`a z*a$pbCAdctA^L2fPF%9HFX~yi3%}?mki|-CxyIgpm#K9f7RE~Gb%XA*8|7W(J>H~9 zSh3nh#&`Tjb|P{%aI83P|CtosD}b0s8^OTv8@2%EFCLq*PbE67Z#b7+Fs&Na#gu2K z3f@iajM37#dWTu!EwcBQd&cB*m`q$%9Bv4R({_<1CJ_(HIEV%179P7@J>oLz{9b*y zs&BYUHdm$qBHkFA74GWCyK4Zz3MjV|!5`PU&?-HkQa>c`MYG%=FTHyPfb#W5qqjjh z|Mef%Ucww#`P>!H*=09kU7kG}zMD0lo6Q(Gg}OEjNXC<3w2ogqJ3YoU&_dm6PiKx0 zR%A*i8SLALKOe67(^y=KD<-pVNIs*(R}0=A_X}P9m835BuZxn-dt5NxNz(+#;RIi; zTn_4kmyTmHd;p|tEtFdd|r%(xXi8xwXzWzbw06>Ps6aGOHcmB_$6G}q;?`<7gDd%msraD!;Ml*S4e z>|Ln?J}lV%s0q+a-yyJ)y01i4C%n`4f7k6{l_2=5H3#}W&KL`9Q=2e&J_6KY(@WD=GQ z1?=Og_3NvuUUCCz@i>O==>`^0IL^NmL4fhUJ6(+1cHK&{Hm#})O?N-^<2`B+<^?8U zKJFe=pSCzWrF%cE0(lkjpCD>)Z35qlP1V)0PigabZr4X)090CV4#-7Mq0C2PR!V6t1C*mj-P=Y;j`stUsUq(>XQ=*@cQW}tISp*#Ib0J^8KE#UKP_@ z73dor?&(z=iK7=ym1?9NDt|uD$Xj}3`OzmYBlr+N{vF-QGENUv&n%_p|8q&&E3KG8-DMh$)& zJd~h&SAM*}$|sl(;WdtS)!{wnGtAk!^I;!7yZ&iE!cP*x_YmnlwGiRBdn57WUy;gW z9d8JLK-;WmbLk(;j+!>EYJP6U_o5!X-S;$LX}ce}0W=-uh)&}SB9w$=@B$2vM=Yw_ z!K>1q>i#Kk?ftSguJIeqaGErGX!zljk8&Or2yTO;0Pq7>n3gdIg921hk#vG)v zF<)%^fyqrB?lcUN;W%g>h*m+#D?!QUguGa#6q z_A)m&2SAeUYfY=#5VY1~6B{EJ=ekj8cT*?ojm@B|C0_GI0-cQ(|Jzh5D6uFVR6R^9 zVWTHZ^%+n;-Up#K85{5HvL|C1y9LO@e(Y@S_R(AO1o_la1GM&U7Zcy0e(ylUG)wah zw&8(dXXI|qRE`PUaKYt-3tBhYMA~=Uo{8B>Tgi2!0&1TQXF`oLrm@V;%ubiiM>n3W z8eUw6*-lMyticAE#2p>ObgiseIlS3A7`StDyVDj6p!7= zqIks3*p^&aXg}P>VF)oGEXuVFOvCL$h?SC-$4(ZKW82Y^Hn&#Rb50em*e5HkOzCDSDwfoiH=~=BXpdjR)_}MbqX^E+ElP&c!r`q z0su1CqQ;x9U9g2!LL|S=R;@N47sd zyD*v_^}4giwzlxmalQPOhBLUI-Wg{q;q%)jP>DrT><707-1i5)8lq0lOr_}uxuIL} zmH7UkwQ24Cm?x~@p-Fz;(K?GiKVLMQk2Kp1me!l8Aq~0O@8})ORnn2smRYym;#iI< ziy&KQ()KteTN~ueNQ0e3_Jb^QC?X2)4?+S+Twfb*ZP73s6U8SH9{T`3xZ;;zp3@It8`Q z;`FQssu+tAHsdqcS1hFwdFBK*ULQ3-s-P-}OYCpsw61D$LtyU(@+%~rA zGeZ1h?np%SR{InfZ2RRklqrIiLA%xZz%A z8VU1y<6B4#o|oRJmf@avrRk#=u{UT8oW$EJf(3G1i-DMZD*`7q&`Yo&p7*FwR50~ZMUBRLmdVP^XJXL2)_AB-}>QNusJcbfZM!lbu zHh_fAyB9z>4`KqzF#*h%@K{ALl~Jok0%0kD#51(q`_R1U``Dk(6<|sw>C;Z=@%lgT ze^6)`x_^2-+Ai7Ze*48!;Y}(fB|VRoC09;pDXvnYMQbVay48+cg6f8@=ns1x_`yUX zfcI*sS&u4zy+My)w^o68;^-C@OTRmj_O-dqjqusw$koEG3ecln0?N0O83c;PPJ86|ReOVk zscIGeHb>S(2+yO^U#n%w-Kf5Evm5P z3dQF34tcpMagq7H{5REz7Lix@(!mwaUhdx^{RR};?Ohb6AWrvVxB(5)u*Wgl1h z!@XXEo3&OqJ>(E*KJJ5I zCqj$ZI^GlMC)*eqraNZKZq<^ni^FNy5|iHvHR^P!r+eg*s6NgxE|NEn+_r51Vnr{* z?vulFCC{tQpH98a`2xPTj)|VfF}@`}x2uYxf8X2b7ZMf7seirfB!gNcpZ84%_(UewYinS4wi2zP2* zL@wSL5hnGxQWun2ZJE>h?I>Vpu_I<#57KNk9&U#|_>}Z`uY@0OTyiK*ypWxpp7<*ISznoqraod@xo>tX0D_=Zg^0>7;I%Oo7 zDKIhY4f`EyTG2Ha&Vc(}Pat&XItC?Yv9eHbx$I172QwbM@hV#j7y_KlN&5bGa2p_4 z^5|;1mux}`7MBfvXTbX*icy!He3nU(>;h&Ie{z=f7cZj3ZR-5qj)o^^*wEJc9(dRp*&ow*{>{XA#V@|5U;je!dS?E}t{)*< zoC+q;eR=h)5$TC;?>4*QY#smp*kj*BNG04MSA>SD>H{`9o?JJJ-jKY<3p3#B%o z(f&lDb>cH=a|E#9GfkVbRIPCAvL|S>zWnHgO6w?rA)|0FGOBsB%?qx(laEZ{5;kst zq%jwzysjWASuFV*tUN-$wOz!FNm%@oM_I^M6=-dD4$0tA{ykiMe3Ye$wgsG8EAIXz zR4>zR`Ae%bu+K1oF_=m!i!3`Y2?oMZih@=uV25Wr;MH+M(Z3>Q5PehVa`sV3<&bpG z;cTGk+a=jLPibk}*puT7=E#?=EXs~Bz5iMm7MU$c*drZ+DOiFeuAAtuoT|9%1_KTF zQat9y_F_WhIk6#je_GVR!A3|jl3$?aWdL}lPA21JBHU~N#vq##?|1pfuGwBzLI6e1 zcJ$m5Q}C&Z@c z#jQHxMbPIgT`TsxJ};dj;@c>SGy5(waF>p;*ig_^{3fkHEAF-u!g&(C(|Z~fM^>zP z)l)h#+tjpS)e#X8vF9yH3bi~fn6f-o3;x;;vp^aRRuLF~`|71lbLau;FfKeaoA7;

60h?V9 zmmC}u+Z9U;1}%~UgJ;qjD=zu$QW`1r+DM*=#aN{Mlb2}U8IaAwu-+&u^$Do~FQXpoml&&*!hpkVx*WC2 zw~9O1IObRIch}zZ6QtxFIl*`zvg8nqQ_pNHEiKX6tx?udobf&`vOW)mc$|!f$J?#I z5O-m|D4cXt?|H?aXAj>JrMR#wU?Uf;=idc%@V1Yqlbna_>IHC}(?^yUtw&p$;yeq{ zO1%X==wqsC2-(v!h`ZQz7DmsFZduVQogWH zr`!P_=!YzLq!&AwhiEbdf*P20iC$?J&JYNpz}eS5pfNaYaksps3&iLqQbvzA_WCL4i{5U{@NMl3)Ikt@Sec%miKNDIL~Xn>)p-BfkwJ60x_Rg2~#V z(<7qK&G&7+GczDWG)4X>FMNN>N8w!lN#9H35QBjdF;M9_=7~vJdQU*-OiKDA&zH{p z4TLK`3MU>bX)*_M#&rIvez{TPL&T|?kRx~F=f1Bi=7G(iM zVHq7AbkmmnvegY(j!;9<)daREo&5b3e5=_F=J4mw3zxG;48qoD7c8S!e%!R(FvQ9R z>TkJ8h?1H)a>#vINMyRW@-Ul(jI8aST+@MP9lifFNP91z#lXfE&AxhR{32RD?|iF` zu(NLM=$laf`!vIJ6zRS^+*FD*Zu1^YnF+L!!Le@hg8{K|l6hTRf|RWr>#pwWh^<>c z3FPXGd?64L@p^*Jh&{`fZy7RrF6&L1y&?Ql(o#8#nJkXBY)BgjCy}3YXuPS(P3|4& z#&D=pXYa&9{yjOo()l}pEgo1wzJ9GZM@lxBJIU=dWTVY7$%2x@-#|0p;zwUG=^ND+ zLJbyV3R&A-ew%GwgLu0ALBFtq$t3^y7K_U;;id0$=L2=`!fVOuc#PAer-U<2ic^R3 zD1APBXz5XizTIfLJDEwB2?%<4lO5z zeEs{DIdEOiIcEQhavT>R@o4$bEcbDT z#1(b{rIh8`w?QwNC<6smhOL_!VTJ`8f^Ktu&x_2sko*jP9WZO-cUWn2 za()7ffxLsQp^c|@+`)cxifj7bN^XQO7bk9baj?CHgHlX=5m%Qj!FJI$tnAoi`>TS7 zV9gZ423yN4c#xYdJT}6LaN6-@{F4Ui@mK&X(bR3DLgRWRzzdgwI^v_M)8$;6cu_w+ zu6WcfK684AstPj+k)9F0zD$PI$_B~GDrQ3XOiHnM-n0;YQ`N!Yy%oVtk@jC_#6z`T zGYM{X1BSFn*aS%kJ#FsKJjXmYuA3#VXgid}4}Npt50<85aX9&lea`U=mL6dJAuss+ zuE5%)+nAE}K(GxBHoP)~!W2ZoOIMOi>qet5vN?7pS~6W)-cyx#uAo?ju^*g}(_lht zCT%YNO(AsP3`4n$SxDOvLI08?kSwUE%5hhfOSxN4c_LCKDK?+r`Ycl-t|l$f-0-lG z)q;T2I9@x7g&iYt6XxMhIHtbW&GWi3Q`&Q zkk)%`2<1MnB7c;mP`@4gwy;?_+t;!DIa~Ap@%C0xajahy=S>2^A-F>V!9BPKhu{vu zA-HSfB)B%g9fE6cOXJdbAh^@GL*p(}x%WRaYu1{19Ul6T>Z<;#zEk_`^V@1eoeaNK zu}c&<2Q}v#TAks)Oa|xV>E0i&)2(TCe&VlZy;<8&-m;u;&aw9QTD)8g?VH~I*D0`@ z`cu>;9slw;T;4JePO>$OF+g{oZ11+oMO-db(WoFmGr^%gNBrek`sq(y6Ft)1n5$$h zKdFTD(P0=jdOjTx0~@s%ohc$L8d2B5M^gH|o}n~2{o(;CITN9SP5wjtE#8p0p$96B zZOU5yt^CQ9*(LH84fc?tX{^C(v!UP@R-c?TFvB-D^BP4$BOXa>+H)~|j{UyBkEiSV zBDE_=Dt)>^eh}8A*?Ki;&l4VMl2IrV*=Pxw-h8ZgmmzE80ee~d3na>&OTLql+++Qn z7qF7;e4&2%BfL|Ck>Mp571bCe3jQQWsJtF9*!X((s>+QKfvpDvxbM{QY+A~Rz1M`l zlt15gDfeAVvdGBrlk9KxHye7p6^CyLmS)6{$n5JXEJIrhS|8fR4YZZmu!@Q(KRcyE zzWf2}`E)gYAT$5h;+=2ScsF2;3nv&(2JLtuEnOmi8e-(|R0&vyBco2Cs7f2Wq z??K4o^Ag`-j_hT)kL>gsp#b&};PYgLmj(Bx@W?N)qPF2BWo_od5el6>RULP4x0j|{ zt8Kd2e|Fm((DT>Zr6Gk7!NSTWO{7%znJnJ7wxemfc?xYS_Qy!xvRWm}i>yWo@n7pu zv0BTfGyakKQYHnZVtly~j|`*EB99p0KNFsyGN!?x#U;3wO@td<23vnf6Bm!(s8onm z4_rq6F$E!%Mjfs_xA^BV^>qi%7#ofGnKXu1P<#L`pE#=I`=2HL+H&L=N#_Z0rD1t& zCi5+yO5*JGJFbzCC%6Y5{SbjE=`4jsxL|o|_8iPYCFRAFjhcu}3s*GvY^m0fl+(MOT z%48s1|BDpqcdN4gb@NLq$XCO*9{OFqFcH6R;`3LdvDB*C--;yj!!wzcA4-tVKEL1Y zVUd9gIVW0EZB9LGjIe(`{z#O(a-Hy;XY!cSD^^>P^A7K1s5K&K0NXXCsQ4tk+iSM~? z^xR$TuNqB6+Wozo-JyNU;^IK2D-ACRF7-_)zVvBrB26a#G%0TD3+J)6 z>(yY~_M(?rR^-Ej-tP3YJIiXthHYo}wj5)Q8KlED78apZ{(I~XhmlbW?qhD8Ky$Ok zt~_#5hdI;-{)_a|9q2%onm?UX#LnjK&dm{1#17F*3B<3wrHeoHuH6FF7mIx{~S}A0Wfz$*zz&51(KPpRXur9z+L@% zNb6GU*5-$)yCc`MIklm(Gf6^Xn<_8cV=@l|z3-A1CGU?KeKEA)^96dN#Md#_ch7t- zsraV^ET|Dbm_F-8KeyjFlGR^3=xC~b(>zeuF<6Q2Sh^36Y_7eGp{lrF{nl^TTgEM? zp+)C>$rca_AR=h&js3j%0SuF<@m}|bL@nM8ZS7}b202lhTi=ZgI^*7wE}dWP=(bEu z)s;mgNlBV&4#rD!HEPKgi4{x)oUgn3LxNpt8k{mTX%Z6lB%fj@zSsuV6D-hI124$yzVZN6r^ zHvTJ0>H2YQ2dKrGACLg-ici>0olC#Yr4X>*aI_-es}Zj34?T!vvM0gilopO!Ada>d zi&uRah!z$WtybTZMIQdCdH`9FUa!`qrOksa_5N14E3P{%IuK9n*BE49H9nN0B_UW> zO;)#m!O&uP!js==54+n(%>whd{cy87+s9VYFx!i?@oi=Qwq^U(-1b}HM6SN-QpMPa zix~K7;$if9v^!sUOrvER^c*%k`uuLi>mbIX$6ygb=@n{x>{Cds?6yxQI4|pk-YmEWRU`e6K6-2*3P0C=RSCtZj3xyLRG&L@Y7&8^} zHW{^6Nyv4Fc-?Vi*rAyV`-+rX0}SVD3iAYOJ<=Lig*2L7a;lQJv5hlS`is}aUe>O! zWvRxaC2QsE59e}kj(I!4+*@iq*x?iLd8*wrpa4s*Ni9)=1S7)Y|tU(wSbz zu_t$=RZ%Ux1|d;6^2b(*k)I-+r|0hB5DcTc2^2nftNi8{D%nqded+1WM~(sToE%@- zvhl-`CKc>O?Q7*>Ca*{x;q76gzTODjlbnEOy@PM-0wgi}$@VTnaUUfl#9?~F=Lx$j zc-jo=^qJkA-N4M{K5xyJJ*raB>OK=|SLAfL3eyhu;Ar=sF8-V2Jxk-QGSkDRXN?hq zS_FXqi^cA?t1>utpCP`+L|k+LW1?(Y@p8jA!$?m{8@zlwdj!>fdKvKaShd)U6#IK* z#6xJ2ah;1rA%!(=H0c7Tkg(e_bx9DJ{HzHQqnV6vvNeS7c@x)PSXZkrNcMPdDHrwu zT(Rk`kxXE68h@!%S41Ht#Zh6f7)(_oz2{zImY9~EqB?vUEGM|Z8__8H=n>k^~ghTAjGiK+m_{nHMn$ zy#_dV!|OJX^&EoY+UE;VO29(;S&K!iwpTd1`9`YNwSdKZxlTxN0Bj-8PcNz4(krha z<)w~uF!QqqE8s*T^ES(|RA&=IDpDPsSF5=FsYjpi>$-+ad?6-3w{~F7Tb;H_tp)h& zi(~b#vqk}k#lG?_dZ2aPbp@eweKUL2kxu%LQXkS6CoKFQ5b37+~_`835U-)BH zW_v9y>^8PB*D+gI2o}Y~<@cL5319WW;B9qDEsI8tUpV?M#*`Lq*~S#^)6&u|^%vLI zx#$(-;<4O;obU9kpHU_Vr_!XK_5A$WI&KiHla(Uf(l_~d^#tVNh;T5bbsB1MhP9_n zrqiV>3>U-AfhtLl^7?qhvS3F5QLL$EgU*Iun^`Zf|Jip}#P>XydiuEe*4ytHhEJGP zm|xC{*(3DWOAX9avHCl2N&Q?3a^CB!&sqd2iO^<^m9urEdSDfqSXj)|xFb~A`t>th zOYJ$m_(7{`i6^3~t2%{QD%q8N!0s{f&jqnYRHp0;#>fp>EpBSI?3lv^qGVR)t|hE; zj-BPgo0Fq09gz;419>STo~=(U8$aKc=jSu}(vv~I4Ev!{jx9MyaR5o|F{jW}aB9)c z)gIf)KGGh0%)WN#LP0ZLmS3llL zyy?1mF;DVb-3AhuSR(x;HRMB%Zlu`r^Ziy*%HGfn=?jc}*w=5($3=^OJuOrn+L-AX zH$#LdfKumc5L5s7h_smpDI)mwOO=bp%q5TG0-nWWZrxcG;DXrhy`)_O&|(f7?~kpb zr^`#W2Fghz3U@E}X-m=gPJb;GB*r<|cZ4Nxtb*2vJEDwrfX&q2K6uf{0Q9Qz?i5jn zQJiacbc5}%1BQJHlOL-5OOr3!eA$InowW}xreXH9I(jy4N# zqlB+cU~yRqQAjzSVlki-SOACzEWAdVdcLwqk~}#N3}Lby)?ACQIGf+!F+D^3DM#h{ zh0mAd3nY>{b&GQ{J?^0mvm4oh4ijA2K6lO!PoaX-kNdDEBM7kaEy(p`>T!z6))K3; zlefyM=Vdi8q18!9W&>qx5v$Cdt1t4aXEj#;NVuFNQQxo1hlQ|PsBwozhv&mr8+HY) zSo)N#B;n$3<8YkQhb9h^t<`S4(WvEo-byzaOF;OyvvSzfUImuQ;o(UUA`*nmJNO(% z+(sqmRkTV|6`bS`SM_DO%jvuJ7;W(d2L`_EUB_rXdI~VP+J9ek7{Hh9bH$&StZ_dX z{>@0=4}$=IcI~I8+{5a6PCkEJXMO2pwNsbN)U4c52$haja_3?>Nt~c(X82@k^1JtY z2R`a`)U{h9gxHgnn7zt$u;5xZjq?IWUtHTL`IBQoO3zqlCz87G$%Cg8I)zkrY`?m@ z^*!RTAI&91zX$m$pP&BLf(WIeRIyZCo4X1IYH)iuC)mDc1l5#QwISj zMvf3c%T1L`wU4fa#>xE+&*aPO$RvpSSJhWTrWTFV=?~f)Pq3$3vM29Z7Hg1$HeiXf zeRATIj?G8~_n2L^ECJ<#?pQqwqf!d1LF8Zp-Nvwy2(7V^bd@2Zq09)@&Yw~F&^YX2 ztj?#gN4!@v3S#tR;@IMq$Jb%Zg)?!nNO`}`yU>zx1g!#Pc~Cip6ZJW zMg7r>kh*+smnotO-8LMo6%enI;HgzZ(~2h|)K=T<`4!fe*o`?n^Te({wJ32(&>^Cy z)or0Xo2K9>?JGe3MaG|YkEb)jmpDaroKhK0n)Lg%s=|dspt}+sAo76h06DeL(A2W_ zDeM*|OZwULR+W>GH{N^RJxAiC3#m?JR)xVdQ{6IS(^u+yC{31?MhKHTvSqT+0@HWUwVuZ=8;{-Y$0eWZr<;{B4=`$treUK!rqd#CRLWjpOOdsbT1 z28$Bw#?fD;H&U+n+$#!QkKoSP?)&fED14`8gxby;pL}1l23aP6778`JuZ2$7+(n<` zbJoEfB9V?c7v}osb@Gb<(VElNmK@u0bVBOuTv@Yqn?7aOdi}R`4X|tXylkH-GB;g~ zi!<@-i=(LSrEm1eSQ7g6dgJ}(I_(7nHA|``V-(7}fz*9#+cM@Sv zh^}K>WbhPL4&jz-LF+rB(NS^nh31mTg*WSpc*URDf8s`}Q*gFb$nuz;zTYP`omioa z0bt7i{PkSUq*TqG7kh4TEyYi~-n`xqS$KWxAW0^3c2AX@6n1%uB6)r<+errOLWX=> zf-tCazaQc)Vp~mR1-2jB{rU){VfYge3^08%rX@RywDy`IgHEaKL&JlGP9=fK{ z=@sWp7*L#mvR=mqfF|3TPqCgeJScf=nEl>>gjSpE&_Gbw)*8wgC^7Igc*On$j-;qUp zH>Ak!LfC$^<}G9dGIu9cg%NYP0nmdxET?(?9n-x?eAyo)9qsF6hupsiuZSqRXFEK< zM@l7IJ`FWA--N-ShCyfVj|}HPl8*W=+aS*ztY2PjCo6|d9IcKB_vm9?1zr3)fP70e zP8LDh*C}=zE|*nVRUyu|9-+fZ=Kds=vO1me6cpJ0c=^DGI)ZrW#zDuQ(;x*s3wsAZ zD?;~onV(skT`jz|jm}9kUG_m7{vTN}$r55wB+#7io_(=^ydtaSP@Q~a-GOU?PougB z4G#$7`rFzQj_R}aBe(9G9qx)x8EI(|ajU1hHMljy$3Df&UcPYZu{C+5!@#VtFXgAH z$6cPlqeys6oYP{&N@Vl9#Dykv!QgE9#P9K=okBSQ+Px9CvhExMeehxh@8!%{%%0<%D@&A*p=kj%~-c%;l8?@~Y4PyB;nOJfVC9 zV%?Nxg)FMWM4$Jtj1gyJGx5O*QYqrdU>+`A_h$0^`&EK@+)F8bf+0|Mc!;>KNFv&( zGl_%#I-O)SFrshg=aEq58nL+CckE3@qb`Q>A^nzvY4%NNyP^7+&S*nrG6EX2-Et zsAuECLP%_*_l8TBF`loy-2bN(&#Htw;krrr#iRD(lw+^?P2?m;e&~V!cV(E5F5%7U zE&~HAYhS9I&yRo(@x6=QKPpD0`R}Hur%OtI$~=qZv%78beUa}U2GB?Sk(#!P_{DUT z?Bcy8;gr_3-Hb|Yi1D7x3wXB4Y|;jr3?(~!>&aOuv4eu}z}g8aE-2}rIhCkTh=4U> ze*8zCGqgL?n}Hgt;}Qc&-_SZq1ZV8G6y{W{M|ROVZMOIUW;Jo|vSr&p)p_v5EmS*jT0BQEIN1{qn8UFuJ9}$B%c~v*wzR zR==nLk`mQ?c^imiXl{vumG1Genf>?Kc0R?8xalZo>s;7QicNx98 z6R}uP-~2@%a;l-@_l`fuDb;=SCf?!0yPfZUobVv50l$?e^L+pydbW;7H7m`JqJy}V zd4E~IzkS5eaSlCTAM-xEaGFXaCqAl2#w*U3!I*q}n^b5EFmYdMXjjf|i1kRDEcF_E zFJY6Y5RwJ72T?xb;$fG|rw)!fDu56XeLq1q$-=MA-{lM>^H# z(utz9#!m@v()OPz-rO9DXHD3FBW_|FSg%~iU!BL~Tqq(PA;;{jwZq(6SzkUI{!8f^ z=U7w$f_=nltuVtUSoCFx9m9h|-wf>_w6*kYVAm{1{(-Zx5k0A-6l zQA&y388-M{L^+*6`TdVCt;_Yw!-i4ndR(!Jy~<-r-GYcIn4*to`_GMOEv_E-3o|y= z$#@JhdxK`7o98(f*Xws(5sRnGlLfE%TK{>_sB$y+;rmv)l`ByV#(#cj{eo~8c^di^ zjDX7)GsCXm8KW8~_JFRpU(WKg+tF6-DCs|(Q9m%_D+lD}XvXA)6k?-d(3zTi~*Ae6w($;+Gl=aP# z=`jdpsU^NPK+#CUYX++ktabP4HqDttYH=^FdF<3L2V8eVdTz}x*F9e>?UvH1{vv!+ ze3bQhf%7qUZEE_KU*F#}TUq|sK>#WzYff`3<@N&PU-o8m)y=L-!1lz7DAl{lK=s6QP6xgz<0`@IyIh`MTOp;>g` zD+3{C$ZR6Vjgu7jimp!d-5os%2^Ddm1lZSLLOd!6HT8l%%N0xd4MjSw_$u)%^iQquvaM<;9rf|443*8W{*$fR2?I0 z(f=U)Z%1~)3^4gVnJJ6aI*|vK?F%F(YMb=_5nC)w0EWQ{WzwVL<1g<%rM`H)zX7wX zC+Yf2t(y0EYEkbHGZxO0gL+}_!%fT1Rax(R#ERB{H_>ZFX#9>Mx|`4yPcpb7DvYlRK>t9tpaBFjvbf!xXfzK481}{0(KXCtx#>f|LjNo(6dhNFzQHB0@=wBglJ+Vq# zwP1|$@amu){>Lz?haf`w-9Dn7+*kO%0&V=AK)KbFtHxS^4@K7_OH9#`WoJw>7m@D3=e$0f%Hgj%^MJw@evRHmWYEoPRk?&-LbIE6(!r2#5uq2^{_0T zAH85#^O7Um!&P7v-@oiKprx6`XRkCE3h&*BS_if$p4cCJ)3cxN@(K;adMp%|4s2{y zjEurE4@>wWBsgJhgNWZ+5x6RSoqFTOx+Z@)c8EJ#I1282*xHaQE{=7wwfpb#d}P-T ztH&M7HD%BGCSx(D)!!8~;=4Hb#Z1aJCHl+`m9^t{bi3m2kojL2cywhaaNn~6KV~$G zm`bKcauSoa>3psEQyfxAiO-HT*Hi%zR+?wDGZJ2wm=3u1O;gu*#s?NNTa+aXb;=bssO&7v2`uw>}@86Y;Znij14YihV z=dk&dQleR@7hOB;TH`$!rt>gw=gYIh-Fi9X>MsjK=np9zT0`=ypU!DdP(N;eFkBn(2?|nG12TiH!IY!bp8|y)J9_98~ojj9J zfnC#cVe%2wRJ`z~?_u|5Y-nfzsB3D}nT;8u>@OrqzCCy|8>xm=Y$M!ly?8vAAks|@ z!G5()(g;jI69Ue(YM7LPQB z*Uvf-ht`;ln?bGLi!zY^5hyq-SAnz>FU5k7mb z13lP6WKv%Afe4L%V(@jUn@Mt5WOEDNe@n8()zM6pJhfqspK1WOUtGYfvlR=W{dk_# z&)!WSU@iG7gVPdxrwBks3^1H__iBVO1L`h0!1b*@qC2?n5eR-W55vkkf_aX zQ2TjS{o5^ni+*^ro`YO}+wFFS<{yA5V~17QerLlCT(7s*&O@5+K}-jbjWOHBNDRe| zp9k0OT&8bUygKm4+N&|kwPtT>7S0BOt~V@2+XqC?WNC5vjy5+I4lQe~)_gNPm*Q;x zLv)RMyQ=^bY~;XToE3>t)Snkn#_qgvdPZB)xEx9eM*T2PKkjX|%I;dt7<$8*l5V%- zAykYE+4m0`jiPu7cuASvEgTe{tKaHx{tjZHYLe0bwu^Eg@r+L)OQ4~rF@|?xi5l(d z=9|eO-$kl*8)8hFXM$k3v(oYZz(V>Ws2iOsY6qMgvmOKi;4Ag*a%^1i;Y6$l<0_B)O=F3@QRQq1;`y+uWI27{Im+0K=|tGC6CF=_Ne}HwlOZLf7d&uUA*#@aRAwmmVn1Dgerh-pFS8lLgOFG9mmxdc!j{Mi@HBfGX7Qp1dw9Hu0yA4}v__oa3Lb0%mW3p`vu zV_tIIc)#Y|@060Un*w;8m8g_*$gJSr9aYZa`?I+Pj-K6Hx5X7}b#+t;q*s2fHgA*? zP3=`VwtdxNensIxsH!rCT092@nDwg(xVhcu+{gT!rnK9^fXr}PTK{p}bHF6*US_VM zv~9DNsY(rd5L-P`IdaDDT9p3rfnoB?!kQBS5YW`#wIhGKw3t54=&peqUgO*RfJJ4|S)2xy_BBXY9AcGk2w z%cJ||bc4fXQ}&CcWpNJ6RwB#*w2Y5L?)JUi(y==jWq$?V*fKhc=USgZMx6iC0>w_I zD_9AJ5vi+mMANnB3{YcWP@F1qd04>#g#`JH4SFKUAs54&PAe_`<5*fnek0I zOJ95;jZSMl$*?w0QSliCWT%+#@?@61BB$w(oQw+BsPEeC#l?ifjZBj;L^u3JO9@GJq7V7OYLU#sUVunH)6}#IG zM^41Y@%4Ikp(}FnY1c8hmx4wFAX85B=-O)^klC%rz}9bSJ?5>MthKHB0;c8 zU_ROfR^MQ-_^dQFP+cWgD-PkM+eHQ1<1f<89-BAX0wse!0ua@5yZ;EYb|ynlUSl^#pr@v zc0|Hi%N~muk9U{yi}lu%Q(0M=t*t_Sm5IPSY{}vK@#X(GLv#LiDw&N<5KHYEPn?pU zRbpnE+_edXyGdmq&2I&KKLlW`JbUsJFzW>E-!b~$t@+Ti8O%D6jPey;SN9Y(IqzI7 zjz;oFjzFUbiewDot(UJKu3}lr#}t<>MTKsG3`^_gE@)Kq#|a>XPGfnw`;*%aXI09> zjb;3CpxYdHrDg#e?>8%}k-O{FE#bXL=(w=8^Z;y;T_Ow<3e4nY^N93FdaQU^HUMcX zgkcokB_zdX6F?>Rx0pMUvFeK^{vAf+)7z)0Gz!Vxv?mc&~bo)_wRcd zk#K^;{YYs(Bu_HL8t6!~`qnxaaIAQ5m>c|4$kd6g4p65pMHEy2L(ctukyCD>PjCY1Ot^|mSHdit9RL%WeJYnIX8 zjl}35zq?Jzz?Bjr?i0B`tTOqJ`4nv*RLTYvkV4bbNjie z@}|6?_<-LQdKl6w=0lZSN1C2-`?N{!GxJ|OTHjS?Z>b59a6I4=!o$ZejZ;D1&=(1&cCXLbe@Qh!tIZ>*16u(Z8IkT)oYCbNW24$wYgLDOsCb8 z15?Cv18#O~2iz#bJNq=}LOw5r*!;0b19y)0zrsMYS z$xHEr(dtUU^DH-Ro#U%YdC0Y-r(qXN|KtwYu$X)rC7=!fC;!J*9;`JVJ{bjqZX)Qi z6RAbaNV<2iO*W-%zJ{WX80mw@2>MhtCW5zY)pUNn)&bb^?--P%8a!TkDn${nh`ZJ$ zrc1OF11Xr(Pb=V8f_@c**)8QMKvCN+A6_^b*%H$Q-UkZb&=y+86MAZ}jlQJG;sTf`xM1&g>%E6NO?IG&d8` z(3k^I7kMh)Zxt2H7st!dfe%FDr>GiO=`q%nM9eaUV=Fg{S=Ku-u%9hj4S6Hk6LYx-F-;IKwL%Z2y&c{Syq6-|W z++E2=yXgNuyOfWFdTc-6}AN=qylo}q*`^ocs1p9%-MO3|-q!0Y@ znw0-1L-+Bc4ZFQ0a-CsT1PJB_kS{RWivf*9#=wAFe1j2N#ERQdo|+^EFd<-j{bC4~ zzzCn!HtWhm1p=+YG|Lan7sI87nd&*e%f5g7TO{XpVdJmJfwD+I3d3aX{CB&+RW8oh ztCfJCSve*Kndedt%LOC{ZLcGsKw9>EqA4?n`q>@0zVV4V1ev3Rq5$Nfrg~x;^lnd9 zjP#zQp4%2*po)65NT%8C-*|hRYNEpfOgP(XgGR|JF?W-_vZFVgPRUs*EHO^{Bz>%L zL+@MjzFNC!Ac=Wa9{X}0uy{I%fzkz)Q?LewjQWZxW7e!#{e1vn(B#kHk3P*e^~Sd! zhDU4bQ-FY2B9TcpPu5=Y$(xo{cu%2Xpmnq7(g%u1t6-Qr`|@#jv-8G&)n5T{ z+?UkHt;l0^e1$Q$oUG@9*GsN`vjjRaWO2L5$uv5aLUglTbd_WmX6=V>TB?PrjFBdi zLI^7E!K+r}2SHw=>D=;@0>B{ug!P~0X>8}Mk=Cw{YkT{_?)~Gg*(t+0YiT?O{fg9I zh*BESn%=#D>CTmUY>ib=b_?AKpZk&@`Gqm7v;SPJmjRRfaw7)Assxc{un{r$c0q)} zumm(1#Y6k8aI*`$UkahKxg}9@RsMsgVWxw8hw(B9p#!aG(2Xbz#uSjkia~PF-{o4E zQ?4Bf;w^`ewzBFNrFD=~v^3J_Af>HAsE>J}@EBOzecSo9C6P2QPO*ak{O7gsH&Kxf zXmB>2puv{IZ&{%1z@;U9Q4PJPi+kJCnZu?B>R1_yRxD-V)9`?Lb2$JyeGypawC*fZ zw*0r)SMF#2%t!eb=WTx_$`&i+8Bl!28=XD$M^n9KvZdInzsM2xlB_Y{1?F9U{b-s!#|EFr(#QZ zvPFb=alu&(9u;$gF4aLtXBIol?&%EZfs+gjd2@rb(LI=?fM~pW%Z`C`@Qq!RmxUF1 znRA#Z*xcFrjkZz>=A@hHcXwHnwE?`gF1H(Dm0m|wyfkK}gYSJ{-h%<`2M1mRz^VAEw|g1|#|2J5}D6?ln`&p(Q78T$*-A%*ZBu&e7gU6W4)T91!C(&~6*Q?4a%Vfn+4 z$pr6~5pzqhk~xqk(Tl`BbZBdPpz0?thy2d;AkK84e8_S{eX!^2T9=Fxgs*}YaaTcO zdpBY?!iWcPCw!iDKU&t>l?}_gNO^>0o_?DMH^Ud$J-$H3zUPZ(fpV}-MvPj?;Qp;d z_%SXob1Pj@@sfcoI4-5fD`HR6K81$m>m^bq?fU0_C;0>hyAH2~J-+Mi;RouTxtdi< zAK*<2uznBXq26D1X^Q3q=NNDhh~Dpc>N}f@X5KGbWL{0b_PsCX=DVCj^}PntAvC7) zlygM<84ZH21oFDDp>N4Tejo}qEWH-I2qr)LLA0PT=VgJ^mOuJb^pQghyYoYB54?y$ zEgAtTZfTqbkw;3V3hGd|?7}=K`hKgoE8DE{4+0{G6t3XVQOpMi*#Y-t7LN3t(U1;| z2)dAI^ zAO#^{Cv83T)*T^0rpv_v`Finq^yC`nq3slu&A&X`;4B<5atP?*QEuHZ1r zQ%@Y*89cMIO$H)ChnIgNr!x=f)7ABpnuz`G@jmT1Xp?!aicK&G5#iD*2$n~F`sbgw z&vKGt8Yeh=FRRbHNBIQD2o2m+KYP|B^eMHFBIXawX~ao&4PWS!j1&v!*1n^6N$u;C zL=M3gG-PG-SPhz#Pis0bZaJSLGwJk35$TblR!G?C^UV|-Zu^y=gg3!T4tPx`M=%@9 zCr4BTvaudL>%MKRfe4r_EqjqSPK#dVem4!v+JQdkcCf}6lYduyG+Zoa0tFS+HN$6< za;bGZl;+*MYL>cMcPa78k3lu19iVRD0q?`gwo>8bp5P^n&@rp{PRFqe#(%!%#V1Pl zIYLkda(=fB|G@W(>c-BEcErqeXg+BbH0bSG5Aw590%$@e8ONisjlVkhdv@jiZ)OGU z%vG!mK_fixEqA%7G(25Or)^VR=x%}z!U(UHrAhCn0ISM8Ag{Gk7fce%=vot}%kQiY zJc6JA)AwPH!gu>(bi-G8*U-p5eXMipjwmk430gm?0>QwrrqAmKdLC!(< zc%jT;!%RBhNhJ}A0LW>hR(@@oIdY%nQfq7L1((rXQcBW3$2DcZ#XCjE%@U60hrBv> zn-Aywk5g5}!*)al-zLsJ9SWP*2TXBrT8>J(H(aALtevmY<@kOe7;;ww+5nN4TP2mH z;~pXF?(4mS0-sHYNPAec>e>W`l)gHYt#UPrEZ()`elP4?S;}Dkt0=^<3cGyP)(g89 zxzot;S+m+3@N17$ftw7F3Q@?*lUCd9eMr=t$;+!i_EOy~r{Y1ZJQMW2ankpi4*|3> zAnxQOrDG|Bf+O?tj*0$ri}YilDaSzbDK0S4f%9C#0+q6LKHU<%jQ#poQmXgE`hz_R z)@ie$Ildn@upi<$xYRxkp#~pbxS4ni$}SXq?NWE91mrO=}YSi93NFXz0fUO8{l1VEef$9f!m zj)M9YK2`WV>niLme$B_6Ck%Rxac0)Y4&*Q-Rv7G2Hf)_SRdv6@5?!(Q%$7s$9z`;~ zfLkDz`F-*G+!EOW6H>@=cwGL&8$B%4X;GLjVLND>pAl^TxoSL%NWhIAQ}p4a{*;)u z7MP|iJE|M==iB_=GleOz`zCADmS`DKN%_cHoh(K%jJk*i0}#HlC4sG?VGy~tkD@HU zFh~X-?3Lu@X$u584-c!hwIlc;p?3jT$?5|oT(>X5=a-zsTy}UAz9*DV*ww~sFNJ_Y ze9m>@sU7W2jO1xm@$*l0U~*WeGVrRjpZ7?U6VC+?8~{09&>D*ux%&gVOzpl56@459 z9($_}hs4uy`O+JM{d(EN?oN;+(c@>^V(k|e^RKap7e48`kig%Cksnjq6M@e}?l#YV zN`D4kfju=DHC*z4+OGRBSy$U;zi7|86xxKf-$mCwso!sa_wKTm26Fmb`|so$uw43*3x-+4 zHPp!a7l&=wOWp>m7zRvn(N08BvfQuI;1O(^R%P`W#~RS)S65drt4@x|s}mZH%&~h& z3bee9|L?zyx9!&Mm$Pf5YB#);PiF2qn}(KDM&&nhl;#(z_hCSr!1phUC|d)H)Y6$k5Usa z&(B$Q2*uyezZyusrRhH4L7`A)o(Ug{Jmb+)Ro$MyQ){?9kgslUMbOkt@>lpz9Wm20 zp)Mxv1VohlgBpJ7Vp}bio(XdnCWo*;(SIWd2o~GkbT18TQN#!Q;#ciWFgdJK9zH1g zdl2B8{*3+qP4DQ;Z2PeQh3GpP`p7G3{Fgmw{2fid z7Q-h2iQ}VDp_I=ll+aH*cG0mz_^AI;fhhYl2=ECKAyN8P15eg0j3!}|+ofB}Y)j>@ zJ5YEo_06M)+f($;gTNidUUr(uaZm&xz?XK5)~DvDqY&{ePeT1T&!egOi! z$0+~KjfgNMT`SNu+rPM_40t#-5NCGRTCzv??`T@~Af;8x+-<23=|Fm7^?Z8BYWCH| zN}yHzH2b?kw+_fX`9}V@+8}m-N*>@ZdW4b?;|%k=-g9gd#Cb3{Ms7Zc(=!a}eY{$7 zbOyo|#?8bs`=T@k4vF(mRt0%L%r%IeU5Yq1O)Z$9lK zJq4OMt0np1GlL)Zq&P0iF@Rs%IEa_*MsOA0mBkrAcignLZz&Tj9!~x^Vw*1rYjuXz z-21oS;!Q7W>I6^(9&tM+o@}R4-{@`n7a4O$lYeudQL-)nq^en~|Fhnc=93l+FiYgh z0iWc*IeBb4Sr~pkl>l_Ne06Q@us_Y8g0VjTUYrP*&M&F7mNaxgT~m3r4m2#POI|X~ zPMJ*ad(ZQj0;3K`=HcDW#I#2am!+^zUmZHuq$_U#9eM=Nw0*VDxfK%IA>L0IU479$R) z=z1gAtDhdD{iE zuKs_BAx@hYtxQqXi|?lA&QD%u-ewq_&fmRKg*`j#|=5LaswCJ4!0m>O-n* zkyw!!9-ro|H}E)kg%c*z<_Fy;KNCMibB?NX{QgGnoucHEPd1VBj8a6{#N z3z%+LX;;Z?es4QCF=%IBl2qd(iEa-= z+)ca;yD$rw(0+1G;_`p)zcbE$s7xj3AWV6^Y(S2!JvyQ)?B7wTqyx%a89sNpZ8>q+ ze>?Wg++3&I6(KQ+rHMakmvO*U4?&g#_KRl7v8aH^Km0)S1_hoJYvXS0|N z!e55DU9_Ne!v{kgv1af)khC$2C?5@|Pi9A$lIi0&AigV^p$o#sQt(HWgYaDLV8iyCh3=1`Ti%tK89T|Od#4DB zn0p^On)I)_F>2h#?<}J#`9E=k{xkhLFJh!Za+15OS$~H6rg3`Kx2?i(Q(x_livAxb z=JSE;dwEf;XV_H(Qao+ju0_>?TACCE#g^)Xn zM|R4*4ucIqy?!~ZT0y*ap5Rs`U9964o@nwkpq~8ena~D26KqGZX;@!2ezioMhRGYr zI81KnRDS{1^h-t?l800vy>9m;Ryc=qYh60x3n~E2T`kK|?jEZoipqI(6RK>kr5t^9 z;8eP|dDZ?nO_J$thuH38N6yG-GhVDrDVkI%=0mRP;Tc38FzdYdXF%mmC|YE$Vn~*y z#~)tpIfUHQAIQc#8RY)FigBjz=?Mg04Nn;eRO1mVeVhm+pHY0r2T{;T5p$O3*herd z8aNKeK>0OVOCx>0Z$&*K$n1(G^U z+z3691aKn$&7@H_Ia*M=I9{Y|^SPEWG^7M9{s72fT8H{L*NNin{Qlh-u+uFrD;L^! zGWZ|Py_t2+9Y6*HU6j$$@`Fx@6M7G(GA%mLygWp9t}m}6_up3LfU15Sbt|H04xA(n z+H(1ywt=UemRHWnZn%9Rx(zjpOjyOU{C|@+9N7_u=ZQZ!GM+4X8j`s?Uk-2l;4|mf zH#oa@&(|2qFgNzIoG>II53$GM9cr#&_!)dT1|NyjW!1LO?iV6V{#j@4-28u3cHYr& zZG9gXHzAd1i7w&MB03qO%oA-S7~F{{Jw^rQ_mY~JUeB&3p2^jVa_00 z?KM=YXk-EcVq-qZ)o@r|Eqn0gbilKN6eM(KZXNAUf~Wi=X~bW}oIob~MQ6PsNuP)h zLKwkjktH4FGw*$m_rYIbvgQW+D||=cZ@ZK(Jj46rcE;s|^d>lfH_}G%p0C+4pogZB zQtMe{ZF5u(no2#%DHVQ``8w#L2#pNS&32Nsw=PKw4nQvIE*&K3{th|HQ~8bjlQ3zo z4c2fT(5Xfss08Z4iWe>D7!9xWJD=rNA;zG*c5RWBH~bunkmnosQ$t>s$mA4cnt}Pqj<^9+L`r*y`yeW(Z%ncRW&lW<{CKt z=$mFd6J1{5l&qOtgPfOBXKPjISd!AiyVqBG&kd+34HZCTA&Z`>o3nVjxYw^_OuD*4 znOfXn@uHuoTvJ}s0Rxi6Hf4eZyqX-p+BrJD+4kuRc1gq$QmM=lpkDNydl%*PIPUGy zo#G|`tE;FI(Y2k9J!h|V+u+=o&gJV=KxX2~@kxD6xiBH;O48ohE+9{p_9RF};YE?g zuOun9?2-YB&C(rtQ zcKjQHZZgX+u{^_rboM50Z4_MY-(_WOaNpdey{dApS4`Tq@5AO1I;_Lu zwvcwjD)5XEBvQFdNVBM2DMipvUl1d?mh2<&{l7Dm5Q8 zBxdPcnVq3@^|{K{StLiIxvD8BQpzG}#G3r(0WPeRXkp=4TsYt zs|K@6SzOkNb*6W-hVJ2_6k%g{roHm^=7mIK zgPX`1Eh~5}_%?Z_%;cyJd~^jM5oA_SQ}wTB^g$CZ*I9&SLLQL^T`A!pbafZ%^lJ=Wob{w;)BmM1 z9OZxipDF_jhV@k=eXzlYN2lc2GPASKJ|pDUj|Jng{N#h?>+k!8iX9E5uMiLsfWiD7 zOH!rw8biN!Uspf8e~ZC*omky6oTU^IAMgoSHT@6_X<+giwQSI?5a+j}>c1WBX_g zPlOI?rZ`cFWXFevzl4S)jd&JJyA3m&;3X`T=~_c+@q?g6Z(pfGW|@jz_1x`ORq3LY-?|qeAB&5xt8B$NzmI9vwVuB~zz{!Po|nZW&?>gAF$n-8 zB0C!X5GasuN?Gib&1E=`Jg-ZSx#+ejU&=5NxV1q_B0I?U{*_U8f^QT{-x7gVJzOa- zpTB>xIFasOVh+(#Z*&az^s};xzKNOoACn$A z11Ofm9I%IQ@oni3o-NJsJ(87;h=~F}Oyd}Tr|_+Blp=xEy{h24X!uSh4SX<}UrClk zWsQq+rc`=d;6Gz&o?O1%aD2jDj&H5hh4G(7M9j_rX_L?Ib^cA5yt`C;&(^1CA!ayK zm?c!c<%@A^6X%yhPcsCXVB}Gya*%BekVk`FSJN%oM?<=5@3s7;x->4ByDPdZY0C>n zhxS{;d(Pi9lj3WH=zYzWX6erTNHgt>qX5Z=-%UO!01!OTWFf)53JK-uXA=}*vK%o$ zyl!al7ZEcJ9DY_4RMN`~4*K2P%CiBLAfAzJ>&IJ9J^WOXE7c-Z8#eT|ZqXjL78mT)}D3*Y`=?O9lTy8W3uYDw=oQAtv0K&CMdBqIVuYXG@H^#4hK0GbD;5Dmj@OY%|Codv6-3`rD{qfTh## z{P3nV)&EqkasIu1xPQ;ENtIOs@3YYDCU+z|*ph$32U#A_*DxEU`pG{MS5R|aIN38S zU~@N}ssfl(2Lcv*(~y~p004pgJNA5m8?K+MRmvpJ9<;RN{hpOAv!vuao6++j>tg|F z+c9WcM;P^b^_9=}S;F29Sk?W;Ffi+^5YAHPlC%2kf{CO~{7nbJ7ouT6oG!!m`0+J> zfcg1QWIpK?G}c%I`QNZIJtHD6);#j(vH{#YBvxlW9gXc}oLvG0TKL0EiEk%rp^4KEmY`m)rp(JYzKFfV^Fc{0CTX3` zZe)p8dbjwGwdsb9kAq94N~wm*we#C}=4{qTg7PlAQ{|RZO4u?w^LK-}`S~2K{Pgte z;tL{83p)S_YrXlwWodru{jkbTD%uKnPA>A}(PE2|yMs7I5pc8bw_(c?7$^ea0c+`q z?$7l%F9a_F8$1=BZ3qcIc8~hl6`(NhVKfySyvNQ7??Liii0=s0Bh$p~L&oD=BQqJ& zctw8{@r5FMFm|@)twduuCbgSlu?vSkhF-Px=JQ+gzs-x|VqdJIh+8=KfSQA2~#^ zUvm1RC}gUXn)lc3H- zIF+_RsDq+@*szYILN091x#$3y7El~;nkfTvjW;Tbu+^3sbyq)d0tja=vfY}GdhzpP zlaQV-i>@=9rEG47hTyY$TM-HyT*#Skld4hDh(kfE;B(wkN7r;GDGIuy6e-;aYsT=A z=llaU`2cvPG#!XFHu`8Q z*dB<)M&p8Gw4yj>_sfE5B}^hC#BaGD4C=Q4D^N}*`i@INdr6j#l*icVW4p%6&+Qoh z{fpv_08RatZ2fb34Jm#MOb+gky;Sari5bF;LJrKo6k*e^=5R5el?PpaAFK8>o0$!t z6)G>!&+$YpPx|F9TiSGyp|FJ!#S9#KLMBf*U~fQJt6r^45VyDBHHPY88lW7=9i5jI zqHDXjDQ(ea1jM<|rK!yjTL)~u+TDUzkuttb+BF-!ogNS)C98&}b~{JMZqX8_`z0!7 zl~WW<0@0g?`|(^yW1f!M^eBhPk&;tYJ$NJaCBCa`(OK??tpF(gJn<63Ks7*?8w%|W zbFn5h8K)zP=@cEVyiAN}pSB+Y`Th$XQupF>kNUeLk+0Eybs?IuWNR}ZgIe-zTI{!M zOcJNhTo&mh>OG5ARKaNL+icW;J;t51IdJMX`m9+S3I9G`K$cMe*Ud1Sp$_p&t&5Fj zd2QmMO+9*`r&OR8jJ>>T$6~(Iolk(NI6zY3AY@e+lVlRE5?azt{$argumD9=<+x{%*M>J5B|MB>+knS&gXh`DZQrF(bi?_C>`G@?` z>)Hnrx~wmEU5T^4et$Js#UtreUHlQJ;kW6b>yxsUSdPk_9A+rtkQh-hO!=r4-}( Date: Fri, 30 Apr 2021 11:00:16 +0100 Subject: [PATCH 16/41] finalupdates --- ...ndows-diagnostic-events-and-fields-1703.md | 2 +- ...ndows-diagnostic-events-and-fields-1709.md | 2 +- ...ndows-diagnostic-events-and-fields-1803.md | 2 +- ...ndows-diagnostic-events-and-fields-1809.md | 214 ++-- ...ndows-diagnostic-events-and-fields-1903.md | 1129 +++++++---------- 5 files changed, 585 insertions(+), 764 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 492fd0f8b9..2abc6b7ebe 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -1511,7 +1511,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: -- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index fadd1d0b31..2832263d8b 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -1601,7 +1601,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: -- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 5f10eba0c9..1714c3efad 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -1705,7 +1705,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: -- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index a11a2a2a37..407f824ca4 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/28/2021 +ms.date: 04/29/2021 ms.reviewer: --- @@ -2395,7 +2395,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: - **CalendarType** The calendar identifiers that are used to specify different calendars. -- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. - **LongDateFormat** The long date format the user has selected. - **ShortDateFormat** The short date format the user has selected. @@ -2885,6 +2885,80 @@ The following fields are available: - **updateTargetState** A value indicating the desired state of the optional content. +## Deployment events + +### Microsoft.Windows.Deployment.Imaging.AppExit + +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned from app exit. +- **sId** Session Id of the application. +- **totalTimeInMs** Total time taken in Ms. + + +### Microsoft.Windows.Deployment.Imaging.AppInvoked + +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. +- **sId** Id of the session. + + +### Microsoft.Windows.Deployment.Imaging.Failed + +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cs** Line that failed. +- **ec** Execution status. +- **hr** HResult returned. +- **msg** Message returned. +- **stack** Stack information. + + +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted + +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **sId** Session id for the application. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. + + +### Microsoft.Windows.Deployment.Imaging.ImagingStarted + +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. +- **sId** Session id for the app. + + ## Deployment extensions ### DeploymentTelemetry.Deployment_End @@ -5672,109 +5746,6 @@ The following fields are available: - **szBatteryInfo** Battery performance data. -### Microsoft.Windows.Deployment.Imaging.AppExit - -This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **hr** HResult returned from app exit. -- **sId** Session Id of the application. -- **totalTimeInMs** Total time taken in Ms. - - -### Microsoft.Windows.Deployment.Imaging.AppInvoked - -This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **branch** Corresponding branch for the image. -- **isInDbg** Whether the app is in debug mode or not. -- **isWSK** Whether the app is building images using WSK or not. -- **sId** Id of the session. - - -### Microsoft.Windows.Deployment.Imaging.Failed - -This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **cs** Line that failed. -- **ec** Execution status. -- **hr** HResult returned. -- **msg** Message returned. -- **stack** Stack information. - - -### Microsoft.Windows.Deployment.Imaging.ImagingCompleted - -This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **appExecTimeInMs** Execution time in milliseconds. -- **buildInfo** Information of the build. -- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. -- **executeUpdateTimeInMs** Update execution time in milliseconds. -- **fileStageTimeInMs** File staging time in milliseconds. -- **hr** HResult returned from imaging. -- **imgSizeInMB** Image size in MB. -- **mutexWaitTimeInMs** Mutex wait time in milliseconds. -- **prepareUpdateTimeInMs** Update preparation time in milliseconds. -- **sId** Session id for the application. -- **totalRunTimeInMs** Total running time in milliseconds. -- **updateOsTimeInMs** Time in milliseconds spent in update OS. - - -### Microsoft.Windows.Deployment.Imaging.ImagingStarted - -This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **arch** Architecture of the image. -- **device** Device type for which the image is built. -- **imgFormat** Format of the image. -- **imgSkip** Parameter for skipping certain image types when building. -- **imgType** The type of image being built. -- **lang** Language of the image being built. -- **prod** Image product type. -- **sId** Session id for the app. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. - - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **CommandLine** The command line used to launch RUXIMICS. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit - -This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **hrInitialize** Error, if any, that occurred while initializing OneSettings. -- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch - -This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. - - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -6526,7 +6497,7 @@ The following fields are available: - **CurrentMobileOperator** The mobile operator the device is currently connected to. - **DeferralPolicySources** Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000). - **DeferredUpdates** Update IDs which are currently being deferred until a later time -- **DeviceModel** What is the device model. +- **DeviceModel** The device model. - **DriverError** The error code hit during a driver scan. This is 0 if no error was encountered. - **DriverExclusionPolicy** Indicates if the policy for not including drivers with Windows Update is enabled. - **DriverSyncPassPerformed** Were drivers scanned this time? @@ -9641,6 +9612,37 @@ The following fields are available: - **PackageVersion** Current package version of remediation. +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit + +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch + +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 6777b7b07d..fc8cc61ee7 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/28/2021 +ms.date: 04/29/2021 --- @@ -2614,7 +2614,7 @@ This event sends data about the current user's default preferences for browser a The following fields are available: - **CalendarType** The calendar identifiers that are used to specify different calendars. -- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. +- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf. - **DefaultBrowserProgId** The ProgramId of the current user's default browser. - **LocaleName** Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function. - **LongDateFormat** The long date format the user has selected. @@ -3096,6 +3096,79 @@ This event reports the results of deferring Windows Content to keep Windows up t +## Deployment events + +### Microsoft.Windows.Deployment.Imaging.AppExit + +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned from app exit. +- **sId** Session Id of the application. +- **totalTimeInMs** Total time taken in Ms. + + +### Microsoft.Windows.Deployment.Imaging.AppInvoked + +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. +- **sId** Id of the session. + + +### Microsoft.Windows.Deployment.Imaging.Failed + +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned. +- **msg** Message returned. +- **sId** Session Id. +- **stack** Stack information. + + +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted + +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **sId** Session id for the application. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. + + +### Microsoft.Windows.Deployment.Imaging.ImagingStarted + +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. +- **sId** Session id for the app. + + ## Deployment extensions ### DeploymentTelemetry.Deployment_End @@ -4712,7 +4785,7 @@ The following fields are available: This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevice.deviceinventorychange). The following fields are available: @@ -5093,8 +5166,8 @@ The following fields are available: - **Model** Model and sub-model of the memory - **Slot** Slot to which the DRAM is plugged into the motherboard. - **Speed** The configured memory slot speed in MHz. -- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. -- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. +- **Type** Reports DDR as an enumeration value per DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile as a bit flag enumeration as per the DMTF SMBIOS standard version 3.3.0, section 7.18.3. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove @@ -5823,7 +5896,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## ONNX runtime events +## Other events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5850,47 +5923,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. -- **telemetryPrivacyType** The telemetry opt-in setting for this gateway. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - -### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties - -This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. - -The following fields are available: - -- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. -- **nodeOperatingSystem** A user friendly description of the node's OS version. -- **nodeOSVersion** A major or minor build version string for the node's OS. -- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. -- **nodeUuid** Universal unique identifier GUID. -- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. - - ### Microsoft.Surface.Battery.Prod.BatteryInfoEvent This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. @@ -5906,401 +5938,383 @@ The following fields are available: - **szBatteryInfo** Battery performance data. -### Microsoft.Surface.Health.Binary.Prod.McuHealthLog +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked -This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **CUtility::GetTargetNameA(Target)** Sub component name. -- **HealthLog** Health indicator log. -- **healthLogSize** 4KB. -- **productId** Identifier for product model. +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. -### Microsoft.Windows.Deployment.Imaging.AppExit +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted -This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **hr** HResult returned from app exit. -- **sId** Session Id of the application. -- **totalTimeInMs** Total time taken in Ms. +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. -### Microsoft.Windows.Deployment.Imaging.AppInvoked +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted -This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **branch** Corresponding branch for the image. -- **isInDbg** Whether the app is in debug mode or not. -- **isWSK** Whether the app is building images using WSK or not. -- **sId** Id of the session. +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.Deployment.Imaging.Failed +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted -This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **hr** HResult returned. -- **msg** Message returned. -- **sId** Session Id. -- **stack** Stack information. +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.Deployment.Imaging.ImagingCompleted +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted -This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **appExecTimeInMs** Execution time in milliseconds. -- **buildInfo** Information of the build. -- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. -- **executeUpdateTimeInMs** Update execution time in milliseconds. -- **fileStageTimeInMs** File staging time in milliseconds. -- **hr** HResult returned from imaging. -- **imgSizeInMB** Image size in MB. -- **mutexWaitTimeInMs** Mutex wait time in milliseconds. -- **prepareUpdateTimeInMs** Update preparation time in milliseconds. -- **sId** Session id for the application. -- **totalRunTimeInMs** Total running time in milliseconds. -- **updateOsTimeInMs** Time in milliseconds spent in update OS. +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.Deployment.Imaging.ImagingStarted +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr -This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **arch** Architecture of the image. -- **device** Device type for which the image is built. -- **imgFormat** Format of the image. -- **imgSkip** Parameter for skipping certain image types when building. -- **imgType** The type of image being built. -- **lang** Language of the image being built. -- **prod** Image product type. -- **sId** Session id for the app. +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr -This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **applicable** The operations that were needed to be attempted. -- **failed** Result of the individual operations that were attempted. -- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.RecommendedTroubleshootingService.MitigationFailed +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete -This event is raised after an executable delivered by Mitigation Service has run and failed. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. Failure data will also be used for root-cause investigation by feature teams, as signal to halt mitigation rollout and, possible follow-up action on specific devices still impacted by the problem because the mitigation failed (i.e. reoffer it to impacted devices). The data collected with this event is used to help keep Windows up to date and performing properly. +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **activeProcesses** Number of active processes. -- **atleastOneMitigationSucceeded** Bool flag indicating if at least one mitigation succeeded. -- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. -- **countDownloadedPayload** Count instances of payload downloaded. -- **description** Description of failure. -- **devicePreference** Recommended Troubleshooting Setting on the device. -- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. -- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. -- **executionHR** HR code of the execution of the mitigation. -- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, eg when executing Critical troubleshooters, the executionPreference is set to the Silent option. -- **exitCode** Exit code of the execution of the mitigation. -- **experimentFeatureId** Experiment feature ID. -- **experimentFeatureState** Config state of the experiment. -- **hr** HRESULT for error code. -- **isActiveSessionPresent** If an active user session is present on the device. -- **isCriticalMitigationAvailable** If a critical mitigation is available to this device. -- **isFilteringSuccessful** If the filtering operation was successful. -- **isReApply** reApply status for the mitigation. -- **mitigationId** ID value of the mitigation. -- **mitigationProcessCycleTime** Process cycle time used by the mitigation. -- **mitigationRequestWithCompressionFailed** Boolean flag indicating if HTTP request with compression failed for this device. -- **mitigationServiceResultFetched** Boolean flag indicating if mitigation details were fetched from the admin service. -- **mitigationVersion** String indicating version of the mitigation. -- **oneSettingsMetadataParsed** If OneSettings metadata was parsed successfully. -- **oneSettingsSchemaVersion** Schema version used by the OneSettings parser. -- **onlyNoOptMitigationsPresent** Checks if all mitigations were no opt. -- **parsedOneSettingsFile** Indicates if OneSettings parsing was successful. -- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. -- **SessionId** Random GUID used for grouping events in a session. -- **subType** Error type. -- **totalKernelTime** Total kernel time used by the mitigation. -- **totalNumberOfApplicableMitigations** Total number of applicable mitigations. -- **totalProcesses** Total number of processes assigned to the job object. -- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. -- **totalUserTime** Total user mode time used by the job object. +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **ExpediteUpdatesInProgress** Comma delimited list of updates in progress. +- **ExpediteUsoCorrelationVector** The current USO correlation vector as surfaced from the USO store. +- **ExpediteUsoLastError** The last error as surfaced from the USO store. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. -### Microsoft.Windows.RecommendedTroubleshootingService.MitigationSucceeded +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired -This event is raised after an executable delivered by Mitigation Service has successfully run. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **activeProcesses** Number of active processes. -- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. -- **devicePreference** Recommended troubleshooting setting on the device. -- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. -- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. -- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, for example, when executing Critical troubleshooters, the executionPreference is set to the Silent option. -- **experimentFeatureId** Experiment feature ID. -- **experimentFeatureState** Feature state for the experiment. -- **mitigationId** ID value of the mitigation. -- **mitigationProcessCycleTime** Process cycle time used by the mitigation. -- **mitigationVersion** String indicating version of the mitigation. -- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. -- **SessionId** Random GUID used for grouping events in a session. -- **totalKernelTime** Total kernel time used by the mitigation. -- **totalProcesses** Total number of processes assigned to the job object. -- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. -- **totalUserTime** Total user mode time used by the job object. +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **ControlId** String identifying the control (if any) that was selected by the user during presentation. -- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. -- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. -- **InteractionCampaignID** The ID of the interaction campaign that was processed. -- **ResultId** The result of the evaluation/presentation. -- **WasCompleted** True if the interaction campaign is complete. -- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. +- **CV** Correlation vector. +- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. - - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **CommandLine** The command line used to launch RUXIMICS. +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd -This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **hrInitialize** Error, if any, that occurred while initializing OneSettings. -- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart -This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. - - - -### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent - -This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. -- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. -- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. -- **ResultId** The result generated by the evaluation and presentation. -- **WasCompleted** True if the user interaction campaign is complete. -- **WasPresented** True if the user interaction campaign is displayed to the user. +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. -### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved -This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: -- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. -### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded -This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **CommandLine** The command line used to launch RUXIMIH. -- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed -This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) -- **Id** GUID passed in by the caller to identify the evaluation. -- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. -- **Result** Overall result generated by the evaluation. +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. -### Microsoft.Xbox.Multiplayer.Bumblelion.OnConnectToNetworkCompleted +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted -No content is currently available. +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **ClientInstanceId** The client-generated globally unique identifier of this instance of bumblelion. -- **ConnectDurationInMs** The duration of the isolated connection operation in milliseconds. -- **DurationInMs** The duration of this request in milliseconds. -- **ErrorDetail** The PartyError error detail code. -- **Hostname** The hostname of the relay we are trying to connect to. -- **IsLocalUdpSocketBindAddressConfigurationTitleSpecified** Whether the title has overridden the local UDP socket bind address configuration for this instance of PlayFab Party. -- **LocalConnectionId** A local identifier to disambiguate multiple connections to the same network from a single client. -- **LocalUdpSocketBindAddressConfigurationOptions** The additional options set by the title to control how the Party library binds to a UDP socket. -- **LocalUdpSocketBindAddressConfigurationPort** The port value specified by the title in the local UDP socket bind address configuration. -- **LocalUdpSocketSelectedPort** The bound port for this instance of PlayFab Party. -- **NetworkIdentifier** The network's unique identifier. -- **Port** The port we are trying to connect to. -- **QosLatencyInMs** Qos latency in ms. -- **QosRank** Qos rank. -- **RegionName** The region Name associated with the underlying relay for the network. -- **Result** The PartyStateChangeResult of the operation. -- **TotalDurationInMs** The duration of connection operation and all associated operations queued before it in milliseconds. +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -### Microsoft.Xbox.Multiplayer.Bumblelion.OnCreateNewNetworkCompleted +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived -No content is currently available. +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. -- **DirectPeerConnectivityOptions** The direct peer connectivity options specified when creating the network. -- **DurationInMs** The duration of this request in milliseconds. -- **ErrorDetail** The PartyError error detail code. -- **Hostname** The hostname of the relay we are trying to create. -- **MaxDeviceCount** The maximum device count specified in the network configuration. -- **MaxDevicesPerUserCount** The maximum devices per user count specified in the network configuration. -- **MaxEndpointsPerDeviceCount** The maximum endpoints per device count specified in the network configuration. -- **MaxUserCount** The maximum user count specified in the network configuration. -- **MaxUsersPerDeviceCount** The maximum users per device count specified in the network configuration. -- **NetworkIdentifier** The network's unique identifier. -- **Port** The relay's port. -- **PreferredRegionLatenciesInMs** Preferred region latencies in ms. -- **PreferredRegionNames** Preferred region names. -- **RegionCount** The count of regions specified when creating the network. -- **RegionName** The region name associated with the newly created network. Empty if the creation failed. -- **RequestedRelayBuildAliasId** The requested relay build alias ID. -- **RequestedRelayVersion** The requested relay version including the protocol version and tag. -- **Result** The PartyStateChangeResult of the operation. -- **ServerId** The ServerId field from the PlayFab RequestPartyResponse. -- **VmId** The VmId field from the PlayFab RequestPartyResponse. +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. -### Microsoft.Xbox.Multiplayer.Bumblelion.OnNetworkDestroyed +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus -This event is emitted when a network is destroyed. The data collected with this event is used to help keep Windows up to date and performing properly. +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **AuthenticatedLocalUserCount** The count of authenticated local users when the network was destroyed. -- **AuthenticatedLocalUserPeakCount** The peak count of authenticated local users over the lifetime of the network. -- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. -- **ErrorDetail** The PartyError error detail code. -- **FirstNetworkIdentifier** The network's unique identifier at the time it was created. -- **Hostname** The relay's hostName. -- **LocalConnectionId** A local identifier to disambiguate multiple connections to the same network from a single client. -- **LocalPrivateEndpointCount** The count of local private endpoints when the network was destroyed. -- **LocalPrivateEndpointPeakCount** The peak count of local private endpoints over the lifetime of the network. -- **LocalPublicEndpointCount** The count of local public endpoints when the network was destroyed. -- **LocalPublicEndpointPeakCount** The peak count of local public endpoints over the lifetime of the network. -- **LocalUserCount** The count of local users when the network was destroyed. -- **LocalUserPeakCount** The peak count of local users over the lifetime of the network. -- **MigrationCount** The number of migrations attempted. -- **NetworkIdentifier** The network's unique identifier. -- **Port** The relay's port. -- **Reason** The PartyDestroyedReason that the network was destroyed. -- **RegionName** The region Name associated with the underlying relay for the network. -- **RemoteDeviceActiveDirectLinkPeakCount** The peak count of remote devices to which the local device had concurrently chosen the direct link as the data transmission path over the lifetime of the network. -- **RemoteDeviceCount** The count of remote devices when the network was destroyed. -- **RemoteDeviceEvaluatingDirectLinkPeakCount** The peak count of remote devices to which the local device was concurrently evaluating a direct peer connection over the lifetime of the network. -- **RemoteDevicePeakCount** The peak count of remote devices over the lifetime of the network. -- **RemotePrivateEndpointCount** The count of remote private endpoints when the network was destroyed. -- **RemotePrivateEndpointPeakCount** The peak count of remote private endpoints over the lifetime of the network. -- **RemotePublicEndpointCount** The count of remote public endpoints when the network was destroyed. -- **RemotePublicEndpointPeakCount** The peak count of remote public endpoints over the lifetime of the network. -- **StateBeforeDestroy** The last NetworkModelState of the network before it was destroyed. -- **TimeSpentInAuthenticatedStateInMs** The total number of milliseconds spent in the Authenticated state. -- **TimeSpentInConnectingStateInMs** The total number of milliseconds spent in the Connecting state. -- **TimeSpentInDeauthenticatingStateInMs** The total number of milliseconds spent in the Deauthenticating state. -- **TimeSpentInLeavingStateInMs** The total number of milliseconds spent in the Leaving state. -- **TimeSpentInNewStateInMs** The total number of milliseconds spent in the New state. -- **TimeSpentInReadyStateInMs** The total number of milliseconds spent in the Ready state. -- **TimeSpentInUnauthenticatedStateInMs** The total number of milliseconds spent in the Unauthenticated state. +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification -### Microsoft.Xbox.Multiplayer.Bumblelion.OnPlayFabError +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails -No content is currently available. +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: -- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. -- **ErrorCode** The PlayFabError ErrorCode value. -- **ErrorMessage** The PlayFabError ErrorMessage value. -- **ErrorName** The PlayFabError ErrorName value. -- **HttpStatusCode** The PlayFabError HttpCode value. -- **HttpStatusString** The PlayFabError HttpStatus value. -- **RequestId** The OutstandingPlayFabRequestID of the request that had an error. -- **RequestType** The OutstandingPlayFabRequestType of the request that had an error. +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. -### Microsoft.Xbox.Multiplayer.Bumblelion.OnQosCompleted +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin -No content is currently available. +The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: -- **AverageLatenciesInMilliseconds** A semicolon-delimited list of average latencies across all pings to a given QoS server, in milliseconds. -- **AverageLatencyVariancesInMilliseconds** A semicolon-delimited list of latency variances (stddev squared) across all pings to a given QoS server, in milliseconds. -- **ClientInstanceId** The client-generated globally unique identifier of this instance of Bumblelion. -- **ErrorDetail** The PartyError detail code provided to the game as a result of the QoS operation. -- **FirstAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the first ping attempted to each QoS server. -- **FirstResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the first ping that had a successful response, to each QoS server. -- **Hostnames** A semicolon-delimited list of QoS server hostNames. -- **IpAddresses** A semicolon-delimited list of QoS server IP addresses. -- **LastAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the last ping attempted to each QoS server. -- **LastResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the last ping that had a successful response, to each QoS server. -- **LatenciesInMilliseconds** A semicolon-delimited list of median latencies across all pings to a given QoS server, in milliseconds. -- **MaximumLatenciesInMilliseconds** A semicolon-delimited list of maximum latencies across all pings to a given QoS server, in milliseconds. -- **MinimumLatenciesInMilliseconds** A semicolon-delimited list of minimum latencies across all pings to a given QoS server, in milliseconds. -- **PingErrorCodes** A semicolon-delimited list of the last error code encountered while pinging each QoS server. -- **PingFailureCounts** A semicolon-delimited list of failed ping counts to each QoS server. -- **PingFailureDueToTimeoutCounts** A semicolon-delimited list of timed-out ping counts to each QoS server. -- **PingSuccessCounts** A semicolon-delimited list of successful ping counts to each QoS server. -- **RegionCount** The number of regions. -- **RegionNames** A semicolon-delimited list of region names. -- **SecondAttemptLatenciesInMilliseconds** A semicolon-delimited list of latencies of the second ping attempted to each QoS server. -- **SecondResponseLatenciesInMilliseconds** A semicolon-delimited list of latencies of the second ping that had a successful response, to each QoS server. -- **StateChangeResult** The PartyStateChangeResult provided to the game as a result of the QoS operation. -- **TimeToGetRegionListInMilliseconds** The time it took to get the region list, in milliseconds. -- **TimeToMeasureLatencyInMilliseconds** The time it took to measure latency to all regions, in milliseconds. +- **CV** Correlation vector. +- **GlobalEventCounter** The global event counter counts the total events for the provider. +- **PackageVersion** The version for the current package. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. ## Privacy consent logging events @@ -6990,6 +7004,20 @@ The following fields are available: - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + + ## System reset events ### Microsoft.Windows.SysReset.FlightUninstallCancel @@ -9498,383 +9526,95 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. -### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign -This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. +- **ControlId** String identifying the control (if any) that was selected by the user during presentation. +- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. +- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. +- **InteractionCampaignID** The ID of the interaction campaign that was processed. +- **ResultId** The result of the evaluation/presentation. +- **WasCompleted** True if the interaction campaign is complete. +- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. -### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit -This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** The list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. +- **CommandLine** The command line used to launch RUXIMICS. -### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit -This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. +This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. +- **hrInitialize** Error, if any, that occurred while initializing OneSettings. +- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings. -### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch -This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. +This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent + +This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. +- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. +- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. +- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. +- **ResultId** The result generated by the evaluation and presentation. +- **WasCompleted** True if the user interaction campaign is complete. +- **WasPresented** True if the user interaction campaign is displayed to the user. -### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit -This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch -This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation -This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete - -This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **ExpediteUpdatesInProgress** Comma delimited list of updates in progress. -- **ExpediteUsoCorrelationVector** The current USO correlation vector as surfaced from the USO store. -- **ExpediteUsoLastError** The last error as surfaced from the USO store. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired - -This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. -- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. -- **ExpediteUsoLastError** Last HResult from the current USO session. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted - -This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). -- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. -- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted - -This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd - -This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. -- **PackageVersion** The package version label for currency tools. -- **UnifiedInstallerInstallResult** The final result code for the unified installer. -- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. -- **UnifiedInstallerPlatformType** The enum indicating the platform type. - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart - -This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** The correlation vector. -- **GlobalEventCounter** Counts the events at the global level for telemetry. -- **PackageVersion** The package version for currency tools. -- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. -- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. -- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. -- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. -- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. -- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. -- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. -- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. -- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. -- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. -- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. -- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. -- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. -- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. -- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved - -This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded - -This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. -- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed - -This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Telemetry event counter. -- **PackageVersion** Version label of the package sending telemetry. -- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted - -This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived - -This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus - -This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails - -The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. -- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. -- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. -- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. -- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. -- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. -- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin - -The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The global event counter counts the total events for the provider. -- **PackageVersion** The version for the current package. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin - -This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted - -This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. ### wilActivity @@ -9904,6 +9644,85 @@ The following fields are available: ## Windows Update mitigation events +### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete + +This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **applicable** The operations that were needed to be attempted. +- **failed** Result of the individual operations that were attempted. +- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationFailed + +This event is raised after an executable delivered by Mitigation Service has run and failed. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. Failure data will also be used for root-cause investigation by feature teams, as signal to halt mitigation rollout and, possible follow-up action on specific devices still impacted by the problem because the mitigation failed (i.e. reoffer it to impacted devices). The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **atleastOneMitigationSucceeded** Bool flag indicating if at least one mitigation succeeded. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **countDownloadedPayload** Count instances of payload downloaded. +- **description** Description of failure. +- **devicePreference** Recommended Troubleshooting Setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionHR** HR code of the execution of the mitigation. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, eg when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **exitCode** Exit code of the execution of the mitigation. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Config state of the experiment. +- **hr** HRESULT for error code. +- **isActiveSessionPresent** If an active user session is present on the device. +- **isCriticalMitigationAvailable** If a critical mitigation is available to this device. +- **isFilteringSuccessful** If the filtering operation was successful. +- **isReApply** reApply status for the mitigation. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationRequestWithCompressionFailed** Boolean flag indicating if HTTP request with compression failed for this device. +- **mitigationServiceResultFetched** Boolean flag indicating if mitigation details were fetched from the admin service. +- **mitigationVersion** String indicating version of the mitigation. +- **oneSettingsMetadataParsed** If OneSettings metadata was parsed successfully. +- **oneSettingsSchemaVersion** Schema version used by the OneSettings parser. +- **onlyNoOptMitigationsPresent** Checks if all mitigations were no opt. +- **parsedOneSettingsFile** Indicates if OneSettings parsing was successful. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **subType** Error type. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalNumberOfApplicableMitigations** Total number of applicable mitigations. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + +### Microsoft.Windows.RecommendedTroubleshootingService.MitigationSucceeded + +This event is raised after an executable delivered by Mitigation Service has successfully run. Data from this event is used to measure the health of mitigations used by engineers to solve in-market problems on internal, insider, and retail devices. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **activeProcesses** Number of active processes. +- **contactTSServiceAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to get Troubleshooter metadata from the Troubleshooting cloud service. +- **devicePreference** Recommended troubleshooting setting on the device. +- **downloadBinaryAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download Troubleshooter Exe. +- **downloadCabAttempts** Number of attempts made by TroubleshootingSvc in a single Scanner session to download PrivilegedActions Cab. +- **executionPreference** Current Execution level Preference. This may not be same as devicePreference, for example, when executing Critical troubleshooters, the executionPreference is set to the Silent option. +- **experimentFeatureId** Experiment feature ID. +- **experimentFeatureState** Feature state for the experiment. +- **mitigationId** ID value of the mitigation. +- **mitigationProcessCycleTime** Process cycle time used by the mitigation. +- **mitigationVersion** String indicating version of the mitigation. +- **sessionAttempts** Number of Scanner sessions attempted so far by TroubleshootingSvc for this troubleshooter. +- **SessionId** Random GUID used for grouping events in a session. +- **totalKernelTime** Total kernel time used by the mitigation. +- **totalProcesses** Total number of processes assigned to the job object. +- **totalTerminatedProcesses** Total number of processes in terminated state assigned to the job object. +- **totalUserTime** Total user mode time used by the job object. + + ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. From 606841c85e9374d1aaff4057cba0401dd2527b9f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 30 Apr 2021 11:15:13 +0100 Subject: [PATCH 17/41] fixbuildissue --- ...basic-level-windows-diagnostic-events-and-fields-1703_test.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/privacy/{basic-level-windows-diagnostic-events-and-fields-1703.md => basic-level-windows-diagnostic-events-and-fields-1703_test.md} (100%) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703_test.md similarity index 100% rename from windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md rename to windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703_test.md From fd044092e3c0d07439da9ec4f6691191adf0c638 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 30 Apr 2021 11:21:59 +0100 Subject: [PATCH 18/41] update --- ...d => basic-level-windows-diagnostic-events-and-fields-1703.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/privacy/{basic-level-windows-diagnostic-events-and-fields-1703_test.md => basic-level-windows-diagnostic-events-and-fields-1703.md} (100%) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703_test.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md similarity index 100% rename from windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703_test.md rename to windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md From 42ced0e2a988684877bc8c694f84691432e24ca9 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 30 Apr 2021 11:32:17 +0100 Subject: [PATCH 19/41] updating fields --- ...ndows-diagnostic-events-and-fields-1903.md | 74 +++++++++---------- ...-diagnostic-data-events-and-fields-2004.md | 6 -- 2 files changed, 37 insertions(+), 43 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index fc8cc61ee7..03aba67c4a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -4599,43 +4599,43 @@ This event captures basic checksum data about the device inventory items stored The following fields are available: -- **Device** A count of device objects in cache. -- **DeviceCensus** A count of device census objects in cache. -- **DriverPackageExtended** A count of driverpackageextended objects in cache. -- **File** A count of file objects in cache. -- **FileSigningInfo** A count of file signing objects in cache. -- **Generic** A count of generic objects in cache. -- **HwItem** A count of hwitem objects in cache. -- **InventoryAcpiPhatHealthRecord** No content is currently available. -- **InventoryAcpiPhatVersionElement** No content is currently available. -- **InventoryApplication** A count of application objects in cache. -- **InventoryApplicationAppV** A count of application AppV objects in cache. -- **InventoryApplicationDriver** A count of application driver objects in cache -- **InventoryApplicationFile** A count of application file objects in cache. -- **InventoryApplicationFramework** A count of application framework objects in cache -- **InventoryApplicationShortcut** A count of application shortcut objects in cache -- **InventoryDeviceContainer** A count of device container objects in cache. -- **InventoryDeviceInterface** A count of Plug and Play device interface objects in cache. -- **InventoryDeviceMediaClass** A count of device media objects in cache. -- **InventoryDevicePnp** A count of device Plug and Play objects in cache. -- **InventoryDeviceSensor** No content is currently available. -- **InventoryDeviceUsbHubClass** A count of device usb objects in cache -- **InventoryDriverBinary** A count of driver binary objects in cache. -- **InventoryDriverPackage** A count of device objects in cache. -- **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in cache -- **InventoryMiscellaneousOfficeAddInUsage** A count of office add-in usage objects in cache. -- **InventoryMiscellaneousOfficeIdentifiers** A count of office identifier objects in cache -- **InventoryMiscellaneousOfficeIESettings** A count of office ie settings objects in cache -- **InventoryMiscellaneousOfficeInsights** A count of office insights objects in cache -- **InventoryMiscellaneousOfficeProducts** A count of office products objects in cache -- **InventoryMiscellaneousOfficeSettings** A count of office settings objects in cache -- **InventoryMiscellaneousOfficeVBA** A count of office vba objects in cache -- **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in cache -- **InventoryMiscellaneousUUPInfo** A count of uup info objects in cache -- **InventoryVersion** No content is currently available. -- **Metadata** A count of metadata objects in cache. -- **Orphan** A count of orphan file objects in cache. -- **Programs** A count of program objects in cache. +- **Device** A count of device objects in the cache. +- **DeviceCensus** A count of device census objects in the cache. +- **DriverPackageExtended** A count of driverpackageextended objects in the cache. +- **File** A count of file objects in the cache. +- **FileSigningInfo** A count of file signing objects in the cache. +- **Generic** A count of generic objects in the cache. +- **HwItem** A count of hwitem objects in the cache. +- **InventoryAcpiPhatHealthRecord** A count of ACPI PHAT health record objects in the cache. +- **InventoryAcpiPhatVersionElement** A count of ACPI PHAT version element objects in the cache. +- **InventoryApplication** A count of application objects in the cache. +- **InventoryApplicationAppV** A count of application AppV objects in the cache. +- **InventoryApplicationDriver** A count of application driver objects in the cache +- **InventoryApplicationFile** A count of application file objects in the cache. +- **InventoryApplicationFramework** A count of application framework objects in the cache +- **InventoryApplicationShortcut** A count of application shortcut objects in the cache +- **InventoryDeviceContainer** A count of device container objects in the cache. +- **InventoryDeviceInterface** A count of Plug and Play device interface objects in the cache. +- **InventoryDeviceMediaClass** A count of device media objects in the cache. +- **InventoryDevicePnp** A count of device Plug and Play objects in the cache. +- **InventoryDeviceSensor** A count of device sensor objects in the cache. +- **InventoryDeviceUsbHubClass** A count of device usb objects in the cache +- **InventoryDriverBinary** A count of driver binary objects in the cache. +- **InventoryDriverPackage** A count of device objects in the cache. +- **InventoryMiscellaneousOfficeAddIn** A count of office add-in objects in the cache +- **InventoryMiscellaneousOfficeAddInUsage** A count of office add-in usage objects in the cache. +- **InventoryMiscellaneousOfficeIdentifiers** A count of office identifier objects in the cache. +- **InventoryMiscellaneousOfficeIESettings** A count of office ie settings objects in the cache. +- **InventoryMiscellaneousOfficeInsights** A count of office insights objects in the cache. +- **InventoryMiscellaneousOfficeProducts** A count of office products objects in the cache. +- **InventoryMiscellaneousOfficeSettings** A count of office settings objects in the cache. +- **InventoryMiscellaneousOfficeVBA** A count of office vba objects in the cache. +- **InventoryMiscellaneousOfficeVBARuleViolations** A count of office vba rule violations objects in the cache. +- **InventoryMiscellaneousUUPInfo** A count of uup info objects in the cache. +- **InventoryVersion** The version of the inventory components. +- **Metadata** A count of metadata objects in the cache. +- **Orphan** A count of orphan file objects in the cache. +- **Programs** A count of program objects in the cache. ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 5cb6293b88..c63a7e38f1 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -4641,12 +4641,6 @@ The following fields are available: - **Result** Overall result generated by the evaluation. -### SFR.NandDefragSubmitFailed - -No content is currently available. - - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted From f042f9334d9d442336b8287a6901464bca60a49c Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Fri, 30 Apr 2021 19:37:32 +0100 Subject: [PATCH 20/41] Update basic-level-windows-diagnostic-events-and-fields-1709.md --- .../basic-level-windows-diagnostic-events-and-fields-1709.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 2832263d8b..c482709d32 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -2521,7 +2521,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx) - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. From bd8b3c8a2ec7e20e6075ac155a0cf6a3212c4464 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 30 Apr 2021 12:48:55 -0700 Subject: [PATCH 21/41] creating new groups --- ...ndows-diagnostic-events-and-fields-1709.md | 16 - ...ndows-diagnostic-events-and-fields-1803.md | 23 +- ...ndows-diagnostic-events-and-fields-1809.md | 48 +- ...ndows-diagnostic-events-and-fields-1903.md | 790 +++++++++--------- ...-diagnostic-data-events-and-fields-2004.md | 311 ++++--- 5 files changed, 575 insertions(+), 613 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index c482709d32..6dc4ef0157 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -3028,22 +3028,6 @@ The following fields are available: - **winInetError** The HResult of the operation. - -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties - -This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. - -The following fields are available: - -- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. -- **nodeOperatingSystem** A user friendly description of the node's OS version. -- **nodeOSVersion** A major or minor build version string for the node's OS. -- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. -- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. - - ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 1714c3efad..8a5eb64108 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -4340,19 +4340,6 @@ The following fields are available: - **winInetError** The HResult of the operation. - -## Other events - -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent - -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5446,6 +5433,16 @@ The following fields are available: - **UpdateId** The update ID for a specific piece of content. - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +## Surface events + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. ## Update Assistant events diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 407f824ca4..68a25db3af 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -5716,36 +5716,6 @@ The following fields are available: - **totalRunDuration** Total running/evaluation time from last time. - **totalRuns** Total number of running/evaluation from last time. - -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties - -This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management. - -The following fields are available: - -- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node. -- **nodeOperatingSystem** A user friendly description of the node's OS version. -- **nodeOSVersion** A major or minor build version string for the node's OS. -- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster. -- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string. - - -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent - -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **batteryData.data()** Battery performance data. -- **BatteryDataSize:** Size of the battery performance data. -- **batteryInfo.data()** Battery performance data. -- **BatteryInfoSize:** Size of the battery performance data. -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -6955,6 +6925,20 @@ The following fields are available: - **UpdateId** The update ID for a specific piece of content. - **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp. +## Surface events + +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Size of the battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. ## System Resource Usage Monitor events @@ -8177,7 +8161,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends simple data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -8192,7 +8176,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends simple data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 03aba67c4a..4024f057fe 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -5896,7 +5896,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## Other events +## ONNX runtime events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5922,401 +5922,6 @@ The following fields are available: - **totalRunDuration** Total running/evaluation time from last time. - **totalRuns** Total number of running/evaluation from last time. - -### Microsoft.Surface.Battery.Prod.BatteryInfoEvent - -This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. - -The following fields are available: - -- **batteryData** Hardware level data about battery performance. -- **batteryData.data()** Battery performance data. -- **BatteryDataSize:** Size of the battery performance data. -- **batteryInfo.data()** Battery performance data. -- **BatteryInfoSize:** Battery performance data. -- **pszBatteryDataXml** Battery performance data. -- **szBatteryInfo** Battery performance data. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked - -This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted - -This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** The list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted - -This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted - -This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** A list of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted - -This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** List of update IDs in progress. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr - -This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr - -This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete - -This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The ubr of the device. -- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. -- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. -- **ExpediteUpdatesInProgress** Comma delimited list of updates in progress. -- **ExpediteUsoCorrelationVector** The current USO correlation vector as surfaced from the USO store. -- **ExpediteUsoLastError** The last error as surfaced from the USO store. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired - -This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. -- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. -- **ExpediteUsoLastError** Last HResult from the current USO session. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted - -This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpeditePolicyId** The policy ID of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). -- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. -- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted - -This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **ExpediteErrorBitMap** Bit map value for any error code. -- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. -- **ExpeditePolicyId** The policy Id of the expedite request. -- **ExpediteResult** Boolean value for success or failure. -- **ExpediteUpdaterCurrentUbr** The UBR of the device. -- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. -- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. -- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. -- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. -- **ExpediteUsoLastError** The last error returned by USO. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version label. -- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd - -This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. -- **PackageVersion** The package version label for currency tools. -- **UnifiedInstallerInstallResult** The final result code for the unified installer. -- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. -- **UnifiedInstallerPlatformType** The enum indicating the platform type. - - -### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart - -This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** The correlation vector. -- **GlobalEventCounter** Counts the events at the global level for telemetry. -- **PackageVersion** The package version for currency tools. -- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. -- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. -- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. -- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. -- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. -- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. -- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. -- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. -- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. -- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. -- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. -- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. -- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. -- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. -- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. -- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. -- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. -- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. -- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved - -This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Counts the number of events for this provider. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded - -This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. -- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed - -This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Telemetry event counter. -- **PackageVersion** Version label of the package sending telemetry. -- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted - -This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived - -This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus - -This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of UpdateHealthTools. -- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. -- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. -- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. -- **UpdateHealthToolsPushCurrentResults** The results from the push request. -- **UpdateHealthToolsPushCurrentStep** The current step for the push notification - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails - -The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. -- **PackageVersion** The package version of the label. -- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. -- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. -- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. -- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. -- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. -- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. -- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin - -The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** The global event counter counts the total events for the provider. -- **PackageVersion** The version for the current package. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin - -This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** A correlation vector. -- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. -- **PackageVersion** The package version of the label. - - -### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted - -This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. - -The following fields are available: - -- **CV** Correlation vector. -- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. -- **PackageVersion** Current package version of remediation. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -7006,6 +6611,21 @@ The following fields are available: ## Surface events +### Microsoft.Surface.Battery.Prod.BatteryInfoEvent + +This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly. + +The following fields are available: + +- **batteryData** Hardware level data about battery performance. +- **batteryData.data()** Battery performance data. +- **BatteryDataSize:** Size of the battery performance data. +- **batteryInfo.data()** Battery performance data. +- **BatteryInfoSize:** Battery performance data. +- **pszBatteryDataXml** Battery performance data. +- **szBatteryInfo** Battery performance data. + + ### Microsoft.Surface.Health.Binary.Prod.McuHealthLog This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. @@ -9616,6 +9236,384 @@ The following fields are available: - **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. - **Result** Overall result generated by the evaluation. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **ExpediteUpdatesInProgress** Comma delimited list of updates in progress. +- **ExpediteUsoCorrelationVector** The current USO correlation vector as surfaced from the USO store. +- **ExpediteUsoLastError** The last error as surfaced from the USO store. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteCbsServicingInProgressStatus** True if servicing is in progress in cbs for the device. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteHoursOfUpTimeSincePolicy** The number of hours the device has been active since it received a policy. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsBlobNotificationRetrieved + +This event is sent when a blob notification is received. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** True if the blob notification is not empty. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin + +The event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The global event counter counts the total events for the provider. +- **PackageVersion** The version for the current package. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + ### wilActivity diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index c63a7e38f1..98c3fc2588 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -2579,6 +2579,76 @@ The following fields are available: - **wipeDuration** The time taken to purge the system volume and format data volume. +## Deployment events + +### Microsoft.Windows.Deployment.Imaging.AppExit + +This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **hr** HResult returned from app exit. +- **totalTimeInMs** Total time taken in Ms. + + +### Microsoft.Windows.Deployment.Imaging.AppInvoked + +This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **branch** Corresponding branch for the image. +- **isInDbg** Whether the app is in debug mode or not. +- **isWSK** Whether the app is building images using WSK or not. + + +### Microsoft.Windows.Deployment.Imaging.Failed + +This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **cs** Line that failed. +- **ec** Execution status. +- **hr** HResult returned. +- **msg** Message returned. +- **stack** Stack information. + + +### Microsoft.Windows.Deployment.Imaging.ImagingCompleted + +This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **appExecTimeInMs** Execution time in milliseconds. +- **buildInfo** Information of the build. +- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. +- **executeUpdateTimeInMs** Update execution time in milliseconds. +- **fileStageTimeInMs** File staging time in milliseconds. +- **hr** HResult returned from imaging. +- **imgSizeInMB** Image size in MB. +- **mutexWaitTimeInMs** Mutex wait time in milliseconds. +- **prepareUpdateTimeInMs** Update preparation time in milliseconds. +- **totalRunTimeInMs** Total running time in milliseconds. +- **updateOsTimeInMs** Time in milliseconds spent in update OS. + + +### Microsoft.Windows.Deployment.Imaging.ImagingStarted + +This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **arch** Architecture of the image. +- **device** Device type for which the image is built. +- **imgFormat** Format of the image. +- **imgSkip** Parameter for skipping certain image types when building. +- **imgType** The type of image being built. +- **lang** Language of the image being built. +- **prod** Image product type. + + ## Diagnostic data events ### TelClientSynthetic.AbnormalShutdown_0 @@ -4485,162 +4555,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Other events - -### Microsoft.Windows.Deployment.Imaging.AppExit - -This event is sent on imaging application exit. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **hr** HResult returned from app exit. -- **totalTimeInMs** Total time taken in Ms. - - -### Microsoft.Windows.Deployment.Imaging.AppInvoked - -This event is sent when the app for image creation is invoked. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **branch** Corresponding branch for the image. -- **isInDbg** Whether the app is in debug mode or not. -- **isWSK** Whether the app is building images using WSK or not. - - -### Microsoft.Windows.Deployment.Imaging.Failed - -This failure event is sent when imaging fails. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **cs** Line that failed. -- **ec** Execution status. -- **hr** HResult returned. -- **msg** Message returned. -- **stack** Stack information. - - -### Microsoft.Windows.Deployment.Imaging.ImagingCompleted - -This event is sent when imaging is done. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **appExecTimeInMs** Execution time in milliseconds. -- **buildInfo** Information of the build. -- **compDbPrepTimeInMs** Preparation time in milliseconds for the CompDBs. -- **executeUpdateTimeInMs** Update execution time in milliseconds. -- **fileStageTimeInMs** File staging time in milliseconds. -- **hr** HResult returned from imaging. -- **imgSizeInMB** Image size in MB. -- **mutexWaitTimeInMs** Mutex wait time in milliseconds. -- **prepareUpdateTimeInMs** Update preparation time in milliseconds. -- **totalRunTimeInMs** Total running time in milliseconds. -- **updateOsTimeInMs** Time in milliseconds spent in update OS. - - -### Microsoft.Windows.Deployment.Imaging.ImagingStarted - -This event is sent when an imaging session starts. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **arch** Architecture of the image. -- **device** Device type for which the image is built. -- **imgFormat** Format of the image. -- **imgSkip** Parameter for skipping certain image types when building. -- **imgType** The type of image being built. -- **lang** Language of the image being built. -- **prod** Image product type. - - -### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete - -This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **applicable** The operations that were needed to be attempted. -- **failed** Result of the individual operations that were attempted. -- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **ControlId** String identifying the control (if any) that was selected by the user during presentation. -- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. -- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. -- **InteractionCampaignID** The ID of the interaction campaign that was processed. -- **ResultId** The result of the evaluation/presentation. -- **WasCompleted** True if the interaction campaign is complete. -- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. - - - -### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch - -This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **CommandLine** The command line used to launch RUXIMICS. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent - -This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. -- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. -- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. -- **ResultId** The result generated by the evaluation and presentation. -- **WasCompleted** True if the user interaction campaign is complete. -- **WasPresented** True if the user interaction campaign is displayed to the user. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit - -This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch - -This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **CommandLine** The command line used to launch RUXIMIH. -- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. - - -### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation - -This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. - -The following fields are available: - -- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) -- **Id** GUID passed in by the caller to identify the evaluation. -- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. -- **Result** Overall result generated by the evaluation. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -7118,6 +7032,80 @@ The following fields are available: ## Windows Update events +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSEvaluateInteractionCampaign + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) finishes processing an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **ControlId** String identifying the control (if any) that was selected by the user during presentation. +- **hrInteractionHandler** The error (if any) reported by the RUXIM Interaction Handler while processing the interaction campaign. +- **hrScheduler** The error (if any) encountered by RUXIM Interaction Campaign Scheduler itself while processing the interaction campaign. +- **InteractionCampaignID** The ID of the interaction campaign that was processed. +- **ResultId** The result of the evaluation/presentation. +- **WasCompleted** True if the interaction campaign is complete. +- **WasPresented** True if the Interaction Handler displayed the interaction campaign to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + + + +### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch + +This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMICS. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent + +This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation. +- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation. +- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler. +- **ResultId** The result generated by the evaluation and presentation. +- **WasCompleted** True if the user interaction campaign is complete. +- **WasPresented** True if the user interaction campaign is displayed to the user. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch + +This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **CommandLine** The command line used to launch RUXIMIH. +- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process. + + +### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation + +This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.) +- **Id** GUID passed in by the caller to identify the evaluation. +- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation. +- **Result** Overall result generated by the evaluation. + ### Microsoft.Windows.Update.DataMigrationFramework.DmfMigrationStarted This event sends data collected at the beginning of the Data Migration Framework (DMF) and parameters involved in its invocation, to help keep Windows up to date. @@ -7778,6 +7766,17 @@ The following fields are available: ## Windows Update mitigation events +### Microsoft.Windows.Mitigations.AllowInPlaceUpgrade.ApplyTroubleshootingComplete + +This event provides summary information after attempting to enable In-Place Upgrade. The data collected with this event is used to help keep Windows up to date and performing properly. + +The following fields are available: + +- **applicable** The operations that were needed to be attempted. +- **failed** Result of the individual operations that were attempted. +- **hr** Result of the overall operation to evaluate and enable In-Place Upgrade. + + ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. From 97e351be165e8ee4f42ba822783afbd661641fbd Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 12 May 2021 11:57:36 -0700 Subject: [PATCH 22/41] draft --- windows/whats-new/TOC.yml | 6 +- windows/whats-new/index.yml | 5 +- .../whats-new-windows-10-version-21H1.md | 103 ++++++++++++++++++ 3 files changed, 110 insertions(+), 4 deletions(-) create mode 100644 windows/whats-new/whats-new-windows-10-version-21H1.md diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index a0d1667af2..b0d672f68c 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -1,5 +1,7 @@ - name: What's new in Windows 10 href: index.yml +- name: What's new in Windows 10, version 21H1 + href: whats-new-windows-10-version-21H1.md - name: What's new in Windows 10, version 20H2 href: whats-new-windows-10-version-20H2.md - name: What's new in Windows 10, version 2004 @@ -10,10 +12,10 @@ href: whats-new-windows-10-version-1903.md - name: What's new in Windows 10, version 1809 href: whats-new-windows-10-version-1809.md -- name: What's new in Windows 10, version 1803 - href: whats-new-windows-10-version-1803.md - name: Previous versions items: + - name: What's new in Windows 10, version 1803 + href: whats-new-windows-10-version-1803.md - name: What's new in Windows 10, version 1709 href: whats-new-windows-10-version-1709.md - name: What's new in Windows 10, version 1703 diff --git a/windows/whats-new/index.yml b/windows/whats-new/index.yml index ee9d04bd21..45c6930684 100644 --- a/windows/whats-new/index.yml +++ b/windows/whats-new/index.yml @@ -26,6 +26,8 @@ landingContent: linkLists: - linkListType: overview links: + - text: What's new in Windows 10, version 21H1 + url: whats-new-windows-10-version-21h1.md - text: What's new in Windows 10, version 20H2 url: whats-new-windows-10-version-20H2.md - text: What's new in Windows 10, version 2004 @@ -36,8 +38,7 @@ landingContent: url: whats-new-windows-10-version-1903.md - text: What's new in Windows 10, version 1809 url: whats-new-windows-10-version-1809.md - - text: What's new in Windows 10, version 1803 - url: whats-new-windows-10-version-1803.md + # Card (optional) - title: Learn more diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md new file mode 100644 index 0000000000..36732221fb --- /dev/null +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -0,0 +1,103 @@ +--- +title: What's new in Windows 10, version 21H1 +description: New and updated features in Windows 10, version 21H1 (also known as the Windows 10 May 2021 Update). +keywords: ["What's new in Windows 10", "Windows 10", "May 2021 Update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10, version 21H1 for IT Pros + +**Applies to** +- Windows 10, version 21H1 + +This article lists new and updated features and content that is of interest to IT Pros for Windows 10, version 21H1, also known as the Windows 10 Map 2021 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 20H2. + +Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](https://docs.microsoft.com/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. + +To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). + +## Microsoft Edge + +This release automatically includes the new Chromium-based [Microsoft Edge](https://www.microsoft.com/edge/business) browser instead of the legacy version of Edge. For more information, see the [Microsoft Edge documentation](/microsoft-edge/). + +## Servicing + +### Windows Update + +There are several changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for updates. For more information, see [Changes to improve security for Windows devices scanning WSUS](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/changes-to-improve-security-for-windows-devices-scanning-wsus/ba-p/1645547). + +Starting with Windows 10, version 20H2, LCUs and SSUs have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). + +## Deployment + +New guidance is available to help + +### Windows Autopilot + + + +### Windows Assessment and Deployment Toolkit (ADK) + +There is no new ADK for Windows 10, version 20H2. The ADK for Windows 10, version 2004 will also work with Windows 10, version 20H2. For more information, see [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). + +## Device management + + + +## Security + +### Windows Defender Application Guard (WDAG) + +WDAG performance improvements including optimizing document opening scenario times. + +“We fixed an issue that causes a one minute or more delay when you open a Microsoft Defender Application Guard (WDAG) Office document. This occurs when you try to open a file using a Universal Naming Convention (UNC) path or Server Message Block (SMB) share link.” + +### Microsoft Defender Application Guard for Office + +Microsoft Defender Application Guard now supports Office: With [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard), you can launch untrusted Office documents (from outside the Enterprise) in an isolated container to prevent potentially malicious content from compromising your device. + +### Windows Hello + +Windows Hello multi-camera support to allow users to choose an external camera priority when using high end displays with integrated cameras. + +## Virtualization + +### Windows Sandbox + + + +## Windows Shell + + + +### 2-in-1 PCs + +On a 2-in-1 device, Windows will now automatically switch to tablet mode when you detach the screen. + +## Surface + + + + + + + +## See Also + +[What’s new for IT pros in Windows 10, version 20H2](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-20h2/ba-p/1800132)
+[Get started with the October 2020 update to Windows 10](https://www.linkedin.com/learning/windows-10-october-2020-update-new-features-2/get-started-with-the-october-2020-update-to-windows-10)
+[Learn Windows 10 with the October 2020 Update](https://www.linkedin.com/learning/windows-10-october-2020-update-essential-training/learn-windows-10-with-the-october-2020-update)
+[What's New in Windows Server](/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
+[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
+[What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
+[Announcing more ways we’re making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
+[Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features.
+[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
\ No newline at end of file From 99ab71d0c598e105e8fb7bc2b2d795d7c1c71dd4 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 13:14:58 -0700 Subject: [PATCH 23/41] draft --- .../whats-new-windows-10-version-21H1.md | 99 ++++++++++++------- 1 file changed, 65 insertions(+), 34 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 36732221fb..6eeb9ef54d 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -24,74 +24,105 @@ Windows 10, version 21H1 is a scoped set of features for select performance impr To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). -## Microsoft Edge - -This release automatically includes the new Chromium-based [Microsoft Edge](https://www.microsoft.com/edge/business) browser instead of the legacy version of Edge. For more information, see the [Microsoft Edge documentation](/microsoft-edge/). - ## Servicing ### Windows Update -There are several changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for updates. For more information, see [Changes to improve security for Windows devices scanning WSUS](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/changes-to-improve-security-for-windows-devices-scanning-wsus/ba-p/1645547). - Starting with Windows 10, version 20H2, LCUs and SSUs have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). ## Deployment -New guidance is available to help - ### Windows Autopilot +A new [resolved issues](/mem/autopilot/resolved-issues) article is available that includes several new fixes for Windows Autopilot deployment scenarios. +A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/fundamentals/whats-new#collect-diagnostics-remote-action). + +Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used with your Windows Autopilot deployment. For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). ### Windows Assessment and Deployment Toolkit (ADK) -There is no new ADK for Windows 10, version 20H2. The ADK for Windows 10, version 2004 will also work with Windows 10, version 20H2. For more information, see [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). +There is no new ADK for Windows 10, version 21H1. The ADK for Windows 10, version 2004 will also work with Windows 10, version 20H2. For more information, see [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). ## Device management - +Windows Management Instrumentation (WMI) Group Policy Service (GPSVC) has a performance improvement to support remote work scenarios: +- An issue is fixed that caused changes by an Active Directory (AD) administrator to user or computer group memberships to propagate slowly. Although the access token eventually updates, these changes might not appear when the administrator uses gpresult /r or gpresult /h to create a report. ## Security ### Windows Defender Application Guard (WDAG) -WDAG performance improvements including optimizing document opening scenario times. - -“We fixed an issue that causes a one minute or more delay when you open a Microsoft Defender Application Guard (WDAG) Office document. This occurs when you try to open a file using a Universal Naming Convention (UNC) path or Server Message Block (SMB) share link.” - -### Microsoft Defender Application Guard for Office - -Microsoft Defender Application Guard now supports Office: With [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard), you can launch untrusted Office documents (from outside the Enterprise) in an isolated container to prevent potentially malicious content from compromising your device. +WDAG performance is improved with optimized document opening times: +- An issue is fixed that could cause a one minute or more delay when you open a Microsoft Defender Application Guard (WDAG) Office document. This can occur when you try to open a file using a Universal Naming Convention (UNC) path or Server Message Block (SMB) share link. +- A memory issue is fixed that could casue a WDAG container to use almost 1 GB of working set memory when the container is idle. +- The performance of Robocopy is improved when copying files over 400 MB in size. ### Windows Hello -Windows Hello multi-camera support to allow users to choose an external camera priority when using high end displays with integrated cameras. - -## Virtualization - -### Windows Sandbox - - - -## Windows Shell - - - -### 2-in-1 PCs - -On a 2-in-1 device, Windows will now automatically switch to tablet mode when you detach the screen. - -## Surface +Windows Hello multi-camera support to allow users to choose an external camera priority when both external and internal Windows Hello cameras are present. +## Microsoft Edge +The new Chromium-based [Microsoft Edge](https://www.microsoft.com/edge/business) browser is included with this release. For more information about what's new in Edge, see the [Microsoft Edge insider](https://www.microsoftedgeinsider.com/whats-new). +## Fixes +A list of fixes is provided in the [Windows Insider blog](https://blogs.windows.com/windows-insider/2021/02/17/releasing-windows-10-build-19042-844-20h2-to-beta-and-release-preview-channels/) and below. +Fixed: +- a memory leak in Internet Explorer 11 that occurs when you use the Chinese language pack. +- COM+ callout policies that cause a deadlock in certain applications. +- an issue that prevents certain Win32 apps from opening as a different user when you use the runas +- unexpected screens during the Windows Out of Box Experience (OOBE). +- an issue that might cause a deadlock when a COM server delivers an event to multiple subscribers in parallel. +- an issue in Advanced display settings that shows the incorrect refresh rates available for high dynamic range (HDR) displays. +- an issue that might prevent certain CAD applications from opening if those applications rely on OpenGL. +- an issue that might cause video playback to flicker when rendering on certain low-latency capable monitors. +- an issue that sometimes prevents the input of strings into the Input Method Editor (IME). +- an issue that exhausts resources because Desktop Windows Manager (DWM) leaks handles and virtual memory in Remote Desktop sessions. +- a stop error that occurs at start up. +- an issue that might delay a Windows Hello for Business (WHfB) Certificate Trust deployment when you open the Settings-> Accounts-> Sign-in Options page. +- an issue that might prevent some keyboard keys from working, such as the home, Ctrl, or left arrow keys when you set the Japanese IME input mode to Kana. +- removed the history of previously used pictures from a user account profile. +- wrong language displayed on a console after you change the system locale. +- host process of Windows Remote Management (WinRM) can stop working when it formats messages from a PowerShell plugin. +- Windows Management Instrumentation (WMI) service caused a heap leak each time security settings are applied to WMI namespace permissions. +- screen rendering after opening games with certain hardware configurations. +- startup times for applications that have roaming settings when User Experience Virtualization (UE-V) is turned on. +- a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers (DC). This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerfromTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, “KRB_GENERIC_ERROR”, if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag. +- high memory and CPU utilization in Microsoft Defender for Endpoint. +- We enhanced data loss prevention and insider risk management solution functionalities in Microsoft 365 endpoints. +- an error when you attempt to open an untrusted webpage using Microsoft Edge or open an untrusted Microsoft Office document. The error is, “WDAG Report – Container: Error: 0x80070003, Ext error: 0x00000001”. This issue occurs after installing the .NET update KB4565627. +- an issue that prevents wevtutil from parsing an XML file. +- failure to report an error when the Elliptic Curve Digital Signature Algorithm (ECDSA) generates invalid keys of 163 bytes instead of 165 bytes. +- We added support for using the new Chromium-based Microsoft Edge as the assigned access single kiosk app. Now, you can also customize a breakout key sequence for single app kiosks. For more information, see Configure Microsoft Edge kiosk mode. +- User Datagram Protocol (UDP) broadcast packets that are larger than the maximum transmission unit (MTU). Devices that receive these packets discard them because the checksum is not valid. +- the WinHTTP AutoProxy service does not comply with the value set for the maximum Time To Live (TTL) on the Proxy Auto-Configuration (PAC) file. This prevents the cached file from updating dynamically. +- We improved the ability of the WinHTTP Web Proxy Auto-Discovery Service to ignore invalid Web Proxy Auto-Discovery Protocol (WPAD) URLs that the Dynamic Host Configuration Protocol (DHCP) server returns. +- We displayed the proper Envelope media type as a selectable output paper type for Universal Print queues. +- We ended the display of a random paper size for a printer when it uses the Microsoft Internet Printing Protocol (IPP) Class Driver. +- We enabled Windows to retrieve updated printer capabilities to ensure that users have the proper set of selectable print options. +- We updated support for hole punch and stapling locations for print jobs with long edge first paper feed direction on certain printers. +- an issue that might cause the IKEEXT service to stop working intermittently. +- an issue that might prevent a Non-Volatile Memory Express (NVMe) device from entering the proper power state. +- an issue that might cause stop error 7E in sys on servers running the Network File System (NFS) service. +- an issue that prevents the User Profile Service from detecting a slow or a fast link reliably. +- an issue that causes contention for a metadata lock when using Work Folders. +- We added a new dfslogkey as described below: +Keypath: HKEY_LOCAL_MACHINE/SOFTWARE/MICROSOFT/dfslog. +The RootShareAcquireSuccessEvent field has the following possible values: +Default value = 1; enables the log. +Value other than 1; disables the log. +If this key does not exist, it will be created automatically. To take effect, any change to dfslog/RootShareAcquireSuccessEvent in the registry requires that you restart the DFSN service. +-We updated the Open Mobile Alliance (OMA) Device Management (DM) sync protocol by adding a check-in reason for requests from the client to the server. The check-in reason will allow the mobile device management (MDM) service to make better decisions about sync sessions. With this change, the OMA-DM service must negotiate a protocol version of 4.0 with the Windows OMA-DM client. +- We turned off token binding by default in Windows Internet (WinINet). +- an issue that might prevent the correct Furigana characters from appearing in apps that automatically allow the input of Furigana characters. You might need to enter the Furigana characters manually. This issue occurs when using the Microsoft Japanese Input Method Editor (IME) to enter Kanji characters in these apps. ## See Also +[Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/) [What’s new for IT pros in Windows 10, version 20H2](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-20h2/ba-p/1800132)
[Get started with the October 2020 update to Windows 10](https://www.linkedin.com/learning/windows-10-october-2020-update-new-features-2/get-started-with-the-october-2020-update-to-windows-10)
[Learn Windows 10 with the October 2020 Update](https://www.linkedin.com/learning/windows-10-october-2020-update-essential-training/learn-windows-10-with-the-october-2020-update)
From 54aee858ec2d77dbec31896c080a5b59d54731b7 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 13:36:46 -0700 Subject: [PATCH 24/41] draft2 --- .../whats-new-windows-10-version-21H1.md | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 6eeb9ef54d..1092b47a47 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -18,7 +18,7 @@ ms.topic: article **Applies to** - Windows 10, version 21H1 -This article lists new and updated features and content that is of interest to IT Pros for Windows 10, version 21H1, also known as the Windows 10 Map 2021 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 20H2. +This article lists new and updated features and content that is of interest to IT Pros for Windows 10, version 21H1, also known as the **Windows 10 May 2021 Update**. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 20H2. Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](https://docs.microsoft.com/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. @@ -109,23 +109,22 @@ Fixed: - an issue that might cause stop error 7E in sys on servers running the Network File System (NFS) service. - an issue that prevents the User Profile Service from detecting a slow or a fast link reliably. - an issue that causes contention for a metadata lock when using Work Folders. -- We added a new dfslogkey as described below: -Keypath: HKEY_LOCAL_MACHINE/SOFTWARE/MICROSOFT/dfslog. -The RootShareAcquireSuccessEvent field has the following possible values: -Default value = 1; enables the log. -Value other than 1; disables the log. -If this key does not exist, it will be created automatically. To take effect, any change to dfslog/RootShareAcquireSuccessEvent in the registry requires that you restart the DFSN service. --We updated the Open Mobile Alliance (OMA) Device Management (DM) sync protocol by adding a check-in reason for requests from the client to the server. The check-in reason will allow the mobile device management (MDM) service to make better decisions about sync sessions. With this change, the OMA-DM service must negotiate a protocol version of 4.0 with the Windows OMA-DM client. +- We added a new dfslogkey:
+ Keypath: **HKEY_LOCAL_MACHINE/SOFTWARE/MICROSOFT/dfslog**
+ The **RootShareAcquireSuccessEvent** field has the following possible values: + * Default value = 1; enables the log. + * Value other than 1; disables the log. + + If this key does not exist, it will be created automatically. + To take effect, any change to **dfslog/RootShareAcquireSuccessEvent** in the registry requires that you restart the DFSN service. +- We updated the Open Mobile Alliance (OMA) Device Management (DM) sync protocol by adding a check-in reason for requests from the client to the server. The check-in reason will allow the mobile device management (MDM) service to make better decisions about sync sessions. With this change, the OMA-DM service must negotiate a protocol version of 4.0 with the Windows OMA-DM client. - We turned off token binding by default in Windows Internet (WinINet). - an issue that might prevent the correct Furigana characters from appearing in apps that automatically allow the input of Furigana characters. You might need to enter the Furigana characters manually. This issue occurs when using the Microsoft Japanese Input Method Editor (IME) to enter Kanji characters in these apps. ## See Also -[Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/) -[What’s new for IT pros in Windows 10, version 20H2](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-20h2/ba-p/1800132)
-[Get started with the October 2020 update to Windows 10](https://www.linkedin.com/learning/windows-10-october-2020-update-new-features-2/get-started-with-the-october-2020-update-to-windows-10)
-[Learn Windows 10 with the October 2020 Update](https://www.linkedin.com/learning/windows-10-october-2020-update-essential-training/learn-windows-10-with-the-october-2020-update)
+[Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/): Windows Experience Blog.
[What's New in Windows Server](/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
[What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
From 84c625cfc9f15268aa5a91c6c0af72dcc677fae9 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 13:51:24 -0700 Subject: [PATCH 25/41] Update whats-new-windows-10-version-21H1.md --- windows/whats-new/whats-new-windows-10-version-21H1.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 1092b47a47..3e8515ddd8 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -20,7 +20,7 @@ ms.topic: article This article lists new and updated features and content that is of interest to IT Pros for Windows 10, version 21H1, also known as the **Windows 10 May 2021 Update**. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 20H2. -Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](https://docs.microsoft.com/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. +Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). @@ -30,6 +30,8 @@ To download and install Windows 10, version 21H1, use Windows Update (**Settings Starting with Windows 10, version 20H2, LCUs and SSUs have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). +Also see [What's next for Windows 10 updates](https://blogs.windows.com/windowsexperience/2020/06/16/whats-next-for-windows-10-updates/). + ## Deployment ### Windows Autopilot @@ -60,7 +62,7 @@ WDAG performance is improved with optimized document opening times: ### Windows Hello -Windows Hello multi-camera support to allow users to choose an external camera priority when both external and internal Windows Hello cameras are present. +Windows Hello multi-camera support is added, allowing users to choose an external camera priority when both external and internal Windows Hello-capable cameras are present. ## Microsoft Edge From 94cd8e4c752529b3a1b567dc6e6110e36e9ceb7c Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 14:27:43 -0700 Subject: [PATCH 26/41] draft --- windows/deployment/planning/windows-10-deprecated-features.md | 4 ++++ windows/deployment/planning/windows-10-removed-features.md | 1 + 2 files changed, 5 insertions(+) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 7002aac879..0db0caf063 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,6 +26,10 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | +| Pewrsonalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. + | 21H1 | +| Paint 3D | Description | 21H1 | +| 3D Viewer | Description | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](https://docs.microsoft.com/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-7.1). Note: This deprecation only applies to the [command-line management tool](https://docs.microsoft.com/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index e760025b65..8fe4445b91 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -28,6 +28,7 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | +| XDDM-based remote display driver | The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers is removed in this release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 21H1 | |Microsoft Edge|The legacy version of Microsoft Edge is no longer supported after March 9th, 2021. For more information, see [End of support reminder for Microsoft Edge Legacy](/lifecycle/announcements/edge-legacy-eos-details). | 21H1 | |MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | | Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | From c26ef2742a8747e98d40115a25dcaca0a77618d0 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:02:05 -0700 Subject: [PATCH 27/41] draft3 --- windows/whats-new/whats-new-windows-10-version-21H1.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 3e8515ddd8..8e9fc2548d 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -40,7 +40,7 @@ A new [resolved issues](/mem/autopilot/resolved-issues) article is available tha A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/fundamentals/whats-new#collect-diagnostics-remote-action). -Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used with your Windows Autopilot deployment. For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). +Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information see [Create Enrollment Status Page profile and assign to a group](/mem/intune/enrollment/windows-enrollment-status#create-enrollment-status-page-profile-and-assign-to-a-group). For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). ### Windows Assessment and Deployment Toolkit (ADK) From 695bd07c8d7944f5e7c08315a024bafb3bcf0302 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:24:02 -0700 Subject: [PATCH 28/41] draft4 --- windows/deployment/planning/windows-10-removed-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index f28cebb9ee..32c81745be 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -28,7 +28,7 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | -| XDDM-based remote display driver | Support for Windows 2000 Display Driver Model (XDDM) based remote display drivers is removed in this release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 21H1 | +| XDDM-based remote display driver | Support for Windows 2000 Display Driver Model (XDDM) based remote display drivers is removed in this release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, see [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 21H1 | |Microsoft Edge|The legacy version of Microsoft Edge is no longer supported after March 9th, 2021. For more information, see [End of support reminder for Microsoft Edge Legacy](/lifecycle/announcements/edge-legacy-eos-details). | 21H1 | |MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | | Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | From d4d31e2ca704bd7b35f10999524c48d94b213a00 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:29:08 -0700 Subject: [PATCH 29/41] remove sv folder --- windows/sv/TOC.yml | 2 -- windows/sv/breadcrumb/toc.yml | 3 --- windows/sv/docfx.json | 51 ----------------------------------- windows/sv/index.md | 1 - 4 files changed, 57 deletions(-) delete mode 100644 windows/sv/TOC.yml delete mode 100644 windows/sv/breadcrumb/toc.yml delete mode 100644 windows/sv/docfx.json delete mode 100644 windows/sv/index.md diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml deleted file mode 100644 index b5ef71ac32..0000000000 --- a/windows/sv/TOC.yml +++ /dev/null @@ -1,2 +0,0 @@ -- name: Index - href: index.md \ No newline at end of file diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml deleted file mode 100644 index 61d8fca61e..0000000000 --- a/windows/sv/breadcrumb/toc.yml +++ /dev/null @@ -1,3 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / \ No newline at end of file diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json deleted file mode 100644 index 7035c4cd69..0000000000 --- a/windows/sv/docfx.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**", - "README.md", - "LICENSE", - "LICENSE-CODE", - "ThirdPartyNotices.md" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": { - "breadcrumb_path": "/windows/sv/breadcrumb/toc.json", - "extendBreadcrumb": true, - "feedback_system": "None" - }, - "fileMetadata": {}, - "template": [], - "dest": "SV", - "markdownEngineName": "markdig" - } -} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md deleted file mode 100644 index 8f7cbe8630..0000000000 --- a/windows/sv/index.md +++ /dev/null @@ -1 +0,0 @@ -# Welcome to SV! \ No newline at end of file From 39cd75ceceea211fcabe72c3c8cd1d62205bc465 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:42:38 -0700 Subject: [PATCH 30/41] draft5 --- windows/sv/TOC.yml | 2 - windows/sv/breadcrumb/toc.yml | 3 -- windows/sv/docfx.json | 51 ------------------- windows/sv/index.md | 1 - .../whats-new-windows-10-version-21H1.md | 11 ++-- 5 files changed, 7 insertions(+), 61 deletions(-) delete mode 100644 windows/sv/TOC.yml delete mode 100644 windows/sv/breadcrumb/toc.yml delete mode 100644 windows/sv/docfx.json delete mode 100644 windows/sv/index.md diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml deleted file mode 100644 index b5ef71ac32..0000000000 --- a/windows/sv/TOC.yml +++ /dev/null @@ -1,2 +0,0 @@ -- name: Index - href: index.md \ No newline at end of file diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml deleted file mode 100644 index 61d8fca61e..0000000000 --- a/windows/sv/breadcrumb/toc.yml +++ /dev/null @@ -1,3 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / \ No newline at end of file diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json deleted file mode 100644 index 7035c4cd69..0000000000 --- a/windows/sv/docfx.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**", - "README.md", - "LICENSE", - "LICENSE-CODE", - "ThirdPartyNotices.md" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": { - "breadcrumb_path": "/windows/sv/breadcrumb/toc.json", - "extendBreadcrumb": true, - "feedback_system": "None" - }, - "fileMetadata": {}, - "template": [], - "dest": "SV", - "markdownEngineName": "markdig" - } -} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md deleted file mode 100644 index 8f7cbe8630..0000000000 --- a/windows/sv/index.md +++ /dev/null @@ -1 +0,0 @@ -# Welcome to SV! \ No newline at end of file diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 8e9fc2548d..1e50c02bab 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -40,7 +40,9 @@ A new [resolved issues](/mem/autopilot/resolved-issues) article is available tha A new Intune remote action: **Collect diagnostics**, lets you collect the logs from corporate devices without interrupting or waiting for the end user. For more information, see [Collect diagnostics remote action](/mem/intune/fundamentals/whats-new#collect-diagnostics-remote-action). -Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information see [Create Enrollment Status Page profile and assign to a group](/mem/intune/enrollment/windows-enrollment-status#create-enrollment-status-page-profile-and-assign-to-a-group). For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). +Intune has also added capabilities to [Role-based access control](/mem/intune/fundamentals/whats-new#role-based-access-control) (RBAC) that can be used to further define profile settings for the Enrollment Status Page (ESP). For more information see [Create Enrollment Status Page profile and assign to a group](/mem/intune/enrollment/windows-enrollment-status#create-enrollment-status-page-profile-and-assign-to-a-group). + +For a full list of what's new in Microsoft Intune, see [What's new in Microsoft Intune](/mem/intune/fundamentals/whats-new). ### Windows Assessment and Deployment Toolkit (ADK) @@ -68,11 +70,12 @@ Windows Hello multi-camera support is added, allowing users to choose an externa The new Chromium-based [Microsoft Edge](https://www.microsoft.com/edge/business) browser is included with this release. For more information about what's new in Edge, see the [Microsoft Edge insider](https://www.microsoftedgeinsider.com/whats-new). -## Fixes +## General fixes -A list of fixes is provided in the [Windows Insider blog](https://blogs.windows.com/windows-insider/2021/02/17/releasing-windows-10-build-19042-844-20h2-to-beta-and-release-preview-channels/) and below. +See the [Windows Insider blog](https://blogs.windows.com/windows-insider/2021/02/17/releasing-windows-10-build-19042-844-20h2-to-beta-and-release-preview-channels/) for more information. + +This release includes the following enhancements and issues fixed: -Fixed: - a memory leak in Internet Explorer 11 that occurs when you use the Chinese language pack. - COM+ callout policies that cause a deadlock in certain applications. - an issue that prevents certain Win32 apps from opening as a different user when you use the runas From e27cb71799d5931dd1ea82e26f4659f99aa4d632 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:49:34 -0700 Subject: [PATCH 31/41] draft6 --- windows/sv/TOC.yml | 2 ++ windows/sv/breadcrumb/toc.yml | 3 +++ windows/sv/docfx.json | 51 +++++++++++++++++++++++++++++++++++ windows/sv/index.md | 1 + 4 files changed, 57 insertions(+) create mode 100644 windows/sv/TOC.yml create mode 100644 windows/sv/breadcrumb/toc.yml create mode 100644 windows/sv/docfx.json create mode 100644 windows/sv/index.md diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml new file mode 100644 index 0000000000..b5ef71ac32 --- /dev/null +++ b/windows/sv/TOC.yml @@ -0,0 +1,2 @@ +- name: Index + href: index.md \ No newline at end of file diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml new file mode 100644 index 0000000000..61d8fca61e --- /dev/null +++ b/windows/sv/breadcrumb/toc.yml @@ -0,0 +1,3 @@ +- name: Docs + tocHref: / + topicHref: / \ No newline at end of file diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json new file mode 100644 index 0000000000..7035c4cd69 --- /dev/null +++ b/windows/sv/docfx.json @@ -0,0 +1,51 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md", + "**/*.yml" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**", + "**/docfx.json", + "_repo.en-us/**", + "README.md", + "LICENSE", + "LICENSE-CODE", + "ThirdPartyNotices.md" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**", + "**/docfx.json", + "_repo.en-us/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": { + "breadcrumb_path": "/windows/sv/breadcrumb/toc.json", + "extendBreadcrumb": true, + "feedback_system": "None" + }, + "fileMetadata": {}, + "template": [], + "dest": "SV", + "markdownEngineName": "markdig" + } +} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md new file mode 100644 index 0000000000..8f7cbe8630 --- /dev/null +++ b/windows/sv/index.md @@ -0,0 +1 @@ +# Welcome to SV! \ No newline at end of file From 27f6970d72dcc41d1a90f5950d4f8a3becd8e2f4 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 13 May 2021 15:50:08 -0700 Subject: [PATCH 32/41] draft7 --- windows/sv/TOC.yml | 2 ++ windows/sv/breadcrumb/toc.yml | 3 +++ windows/sv/docfx.json | 51 +++++++++++++++++++++++++++++++++++ windows/sv/index.md | 1 + 4 files changed, 57 insertions(+) create mode 100644 windows/sv/TOC.yml create mode 100644 windows/sv/breadcrumb/toc.yml create mode 100644 windows/sv/docfx.json create mode 100644 windows/sv/index.md diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml new file mode 100644 index 0000000000..b5ef71ac32 --- /dev/null +++ b/windows/sv/TOC.yml @@ -0,0 +1,2 @@ +- name: Index + href: index.md \ No newline at end of file diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml new file mode 100644 index 0000000000..61d8fca61e --- /dev/null +++ b/windows/sv/breadcrumb/toc.yml @@ -0,0 +1,3 @@ +- name: Docs + tocHref: / + topicHref: / \ No newline at end of file diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json new file mode 100644 index 0000000000..7035c4cd69 --- /dev/null +++ b/windows/sv/docfx.json @@ -0,0 +1,51 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md", + "**/*.yml" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**", + "**/docfx.json", + "_repo.en-us/**", + "README.md", + "LICENSE", + "LICENSE-CODE", + "ThirdPartyNotices.md" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**", + "**/docfx.json", + "_repo.en-us/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": { + "breadcrumb_path": "/windows/sv/breadcrumb/toc.json", + "extendBreadcrumb": true, + "feedback_system": "None" + }, + "fileMetadata": {}, + "template": [], + "dest": "SV", + "markdownEngineName": "markdig" + } +} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md new file mode 100644 index 0000000000..8f7cbe8630 --- /dev/null +++ b/windows/sv/index.md @@ -0,0 +1 @@ +# Welcome to SV! \ No newline at end of file From ef69d4189e03edba83030c4666c0b9674266be38 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 14 May 2021 10:56:56 -0700 Subject: [PATCH 33/41] draft8 --- windows/whats-new/whats-new-windows-10-version-21H1.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 1e50c02bab..dddd87bc01 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -22,7 +22,7 @@ This article lists new and updated features and content that is of interest to I Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. -To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). +To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). New features and fixes in Windows 10, version 21H1 are included in the latest monthly quality update for Windows 10. For more information, see [Feature Update through Windows 10, version 21H1 Enablement Package](https://support.microsoft.com/help/5000736). ## Servicing @@ -126,7 +126,6 @@ This release includes the following enhancements and issues fixed: - We turned off token binding by default in Windows Internet (WinINet). - an issue that might prevent the correct Furigana characters from appearing in apps that automatically allow the input of Furigana characters. You might need to enter the Furigana characters manually. This issue occurs when using the Microsoft Japanese Input Method Editor (IME) to enter Kanji characters in these apps. - ## See Also [Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/): Windows Experience Blog.
From d070a8ee11c5197ff8ad7422122005e37a0543d0 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 14 May 2021 12:10:22 -0700 Subject: [PATCH 34/41] draft --- windows/deployment/planning/windows-10-deprecated-features.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 8d403c4d1b..fb628e92da 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,8 +26,6 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| Paint 3D | Description | 21H1 | -| 3D Viewer | Description | 21H1 | | Pewrsonalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](https://docs.microsoft.com/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-7.1). Note: This deprecation only applies to the [command-line management tool](https://docs.microsoft.com/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | | Timeline | Starting in July 2021, if you have your activity history synced across your devices through your Microsoft account (MSA), you'll no longer have the option to upload new activity in Timeline. See [Get help with timeline](https://support.microsoft.com/windows/get-help-with-timeline-febc28db-034c-d2b0-3bbe-79aa0c501039).| 20H2 | From fd46db2132cba59ff3ec0c7ac1c8eee88e036211 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 14 May 2021 12:13:09 -0700 Subject: [PATCH 35/41] typo --- windows/deployment/planning/windows-10-deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index fb628e92da..6dffd0dd5a 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,7 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| Pewrsonalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | +| Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](https://docs.microsoft.com/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-7.1). Note: This deprecation only applies to the [command-line management tool](https://docs.microsoft.com/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | | Timeline | Starting in July 2021, if you have your activity history synced across your devices through your Microsoft account (MSA), you'll no longer have the option to upload new activity in Timeline. See [Get help with timeline](https://support.microsoft.com/windows/get-help-with-timeline-febc28db-034c-d2b0-3bbe-79aa0c501039).| 20H2 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | From b42ffac95d17085b3ebd7ac58bfd864b9b67d6e5 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 14 May 2021 12:17:47 -0700 Subject: [PATCH 36/41] link sugg fixes --- windows/deployment/planning/windows-10-deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 6dffd0dd5a..6f9b41695b 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -27,7 +27,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | | Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | -| Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](https://docs.microsoft.com/powershell/scripting/learn/ps101/07-working-with-wmi?view=powershell-7.1). Note: This deprecation only applies to the [command-line management tool](https://docs.microsoft.com/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | +| Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation only applies to the [command-line management tool](/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | | Timeline | Starting in July 2021, if you have your activity history synced across your devices through your Microsoft account (MSA), you'll no longer have the option to upload new activity in Timeline. See [Get help with timeline](https://support.microsoft.com/windows/get-help-with-timeline-febc28db-034c-d2b0-3bbe-79aa0c501039).| 20H2 | | Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 | | Companion Device Framework | The [Companion Device Framework](/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 | From b0f5a16e7d5ac481b3e8fe9635657adb6c393e6d Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 14 May 2021 13:10:54 -0700 Subject: [PATCH 37/41] edits --- windows/whats-new/whats-new-windows-10-version-21H1.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index dddd87bc01..c56c65dac3 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -22,13 +22,14 @@ This article lists new and updated features and content that is of interest to I Windows 10, version 21H1 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As an [H1-targeted release](/lifecycle/faq/windows#what-is-the-servicing-timeline-for-a-version--feature-update--of-windows-10-), 21H1 is serviced for 18 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. -To download and install Windows 10, version 21H1, use Windows Update (**Settings > Update & Security > Windows Update**). New features and fixes in Windows 10, version 21H1 are included in the latest monthly quality update for Windows 10. For more information, see [Feature Update through Windows 10, version 21H1 Enablement Package](https://support.microsoft.com/help/5000736). + +For details on how to update your device, or the devices in your organization, see [How to get the Windows 10 May 2021 Update](https://blogs.windows.com/windowsexperience/?p=175674). Devices running Windows 10, versions 2004 and 20H2 have the ability to update quickly to version 21H1 via an enablement package. For more details, see [Feature Update through Windows 10, version 21H1 Enablement Package](https://support.microsoft.com/help/5000736). ## Servicing ### Windows Update -Starting with Windows 10, version 20H2, LCUs and SSUs have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). +Starting with Windows 10, version 20H2 and including this release, Latest Cumulative Updates (LCUs) and Servicing Stack Updates (SSUs) have been combined into a single cumulative monthly update, available via Microsoft Catalog or Windows Server Update Services. For more information, see [Simplifying on-premises deployment of servicing stack updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039). Also see [What's next for Windows 10 updates](https://blogs.windows.com/windowsexperience/2020/06/16/whats-next-for-windows-10-updates/). @@ -128,6 +129,7 @@ This release includes the following enhancements and issues fixed: ## See Also +[IT tools to support Windows 10, version 21H1](https://aka.ms/tools-for-21H1)
[Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/): Windows Experience Blog.
[What's New in Windows Server](/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
From 6fc92a33903e1364ca9bb6f61879ceb8012dc302 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 17 May 2021 16:44:47 +0100 Subject: [PATCH 38/41] Update basic-level-windows-diagnostic-events-and-fields-1903.md --- .../basic-level-windows-diagnostic-events-and-fields-1903.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 4024f057fe..c06281ee61 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -4785,7 +4785,7 @@ The following fields are available: This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevice.deviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: From 7a133363bca31c42493dc96123ee3f3714f3f6b9 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Mon, 17 May 2021 17:29:01 +0100 Subject: [PATCH 39/41] Update required-windows-diagnostic-data-events-and-fields-2004.md --- ...ndows-diagnostic-data-events-and-fields-2004.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 98c3fc2588..5b82593002 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -2402,6 +2402,20 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. +## Common data fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. + ## Component-based servicing events From 64ea9b72cfcf62b593cfd3c4cf38b53f4e83d010 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Mon, 17 May 2021 11:13:06 -0700 Subject: [PATCH 40/41] acrolinx --- .../deployment/planning/windows-10-removed-features.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/deployment/planning/windows-10-removed-features.md index 32c81745be..2725d29de0 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/deployment/planning/windows-10-removed-features.md @@ -1,6 +1,6 @@ --- title: Windows 10 - Features that have been removed -description: In this article, learn about the features and functionality that have been removed or replaced in Windows 10. +description: In this article, learn about the features and functionality that has been removed or replaced in Windows 10. ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: medium @@ -29,10 +29,10 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | | XDDM-based remote display driver | Support for Windows 2000 Display Driver Model (XDDM) based remote display drivers is removed in this release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, see [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 21H1 | -|Microsoft Edge|The legacy version of Microsoft Edge is no longer supported after March 9th, 2021. For more information, see [End of support reminder for Microsoft Edge Legacy](/lifecycle/announcements/edge-legacy-eos-details). | 21H1 | +|Microsoft Edge|The legacy version of Microsoft Edge is no longer supported after March 9, 2021. For more information, see [End of support reminder for Microsoft Edge Legacy](/lifecycle/announcements/edge-legacy-eos-details). | 21H1 | |MBAE service metadata|The MBAE app experience is replaced by an MO UWP app. Metadata for the MBAE service is removed. | 20H2 | | Connect app | The **Connect** app for wireless projection using Miracast is no longer installed by default, but is available as an optional feature. To install the app, click on **Settings** > **Apps** > **Optional features** > **Add a feature** and then install the **Wireless Display** app. | 2004 | -| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13th, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 | +| Rinna and Japanese Address suggestion | The Rinna and Japanese Address suggestion service for Microsoft Japanese Input Method Editor (IME) ended on August 13, 2020. For more information, see [Rinna and Japanese Address suggestion will no longer be offered](https://support.microsoft.com/help/4576767/windows-10-rinna-and-japanese-address-suggestion) | 2004 | | Cortana | Cortana has been updated and enhanced in the Windows 10 May 2020 Update. With [these changes](/windows/whats-new/whats-new-windows-10-version-2004#cortana), some previously available consumer skills such as music, connected home, and other non-Microsoft skills are no longer available. | 2004 | | Windows To Go | Windows To Go was announced as deprecated in Windows 10, version 1903 and is removed in this release. | 2004 | | Mobile Plans and Messaging apps | Both apps are still supported, but are now distributed in a different way. OEMs can now include these apps in Windows images for cellular enabled devices. The apps are removed for non-cellular devices.| 2004 | @@ -41,7 +41,7 @@ The following features and functionalities have been removed from the installed | Desktop messaging app doesn't offer messages sync | The messaging app on Desktop has a sync feature that can be used to sync SMS text messages received from Windows Mobile and keep a copy of them on the Desktop. The sync feature has been removed from all devices. Due to this change, you will only be able to access messages from the device that received the message. | 1903 | |Business Scanning, also called Distributed Scan Management (DSM)|We're removing this secure scanning and scanner management capability - there are no devices that support this feature.| 1809 | |[FontSmoothing setting](/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-visualeffects-fontsmoothing) in unattend.xml|The FontSmoothing setting let you specify the font antialiasing strategy to use across the system. We've changed Windows 10 to use [ClearType](/typography/cleartype/) by default, so we're removing this setting as it is no longer necessary. If you include this setting in the unattend.xml file, it'll be ignored.| 1809 | -|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or Hololens with the Mixed Reality Viewer.| 1809 | +|Hologram app|We've replaced the Hologram app with the [Mixed Reality Viewer](https://support.microsoft.com/help/4041156/windows-10-mixed-reality-help). If you would like to create 3D word art, you can still do that in Paint 3D and view your art in VR or HoloLens with the Mixed Reality Viewer.| 1809 | |limpet.exe|We're releasing the limpet.exe tool, used to access TPM for Azure connectivity, as open source.| 1809 | |Phone Companion|When you update to Windows 10, version 1809, the Phone Companion app will be removed from your PC. Use the **Phone** page in the Settings app to sync your mobile phone with your PC. It includes all the Phone Companion features.| 1809 | |Future updates through [Windows Embedded Developer Update](/previous-versions/windows/embedded/ff770079(v=winembedded.60)) for Windows Embedded Standard 7-SP1 (WES7-SP1) and Windows Embedded Standard 8 (WES8)|We’re no longer publishing new updates to the WEDU server. Instead, you may secure any new updates from the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/Home.aspx). [Learn how](https://techcommunity.microsoft.com/t5/Windows-Embedded/Change-to-the-Windows-Embedded-Developer-Update/ba-p/285704) to get updates from the catalog.| 1809 | From d2923629be502fb66583e2e62171b8379d2b591f Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 18 May 2021 11:18:09 +0100 Subject: [PATCH 41/41] update for links --- ...ndows-diagnostic-events-and-fields-1809.md | 4 +- ...-diagnostic-data-events-and-fields-2004.md | 40 +++++++++++++++++++ 2 files changed, 42 insertions(+), 2 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 68a25db3af..99cc79b6ea 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -5128,7 +5128,7 @@ The following fields are available: - **FirmwareResetReasonPch** Reason for system reset provided by firmware. - **FirmwareResetReasonPchAdditional** Additional information on system reset reason provided by firmware if needed. - **FirmwareResetReasonSupplied** Flag indicating that a reason for system reset was provided by firmware. -- **IO** Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io). +- **IO** Amount of data written to and read from the disk by the OS Loader during boot. See IO. - **LastBootSucceeded** Flag indicating whether the last boot was successful. - **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful. - **MaxAbove4GbFreeRange** This field describes the largest memory range available above 4Gb. @@ -7772,7 +7772,7 @@ The following fields are available: - **DPRange** Maximum mean value range. - **DPValue** Randomized bit value (0 or 1) that can be reconstituted over a large population to estimate the mean. -- **Value** Standard UTC emitted DP value structure See [Value](#value). +- **Value** Standard UTC emitted DP value structure See Value. ## Windows Store events diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 5b82593002..67158554c1 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1714,6 +1714,23 @@ The following fields are available: ## Audio endpoint events +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -5584,6 +5601,29 @@ The following fields are available: - **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. - **PackageVersion** Current package version of remediation. +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. ## Update events