mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 13:17:23 +00:00
Merge pull request #1801 from brianlic-msft/2001-update
January 2020 privacy update
This commit is contained in:
Dani Halfin
GitHub
commit
1879871faf
@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. Specific to Windows 10, version 1703.
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
|
||||
title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10)
|
||||
keywords: privacy, telemetry
|
||||
ms.prod: w10
|
||||
@ -7,14 +7,14 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
author: brianlic-msft
|
||||
ms.author: brianlic
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 04/19/2019
|
||||
ms.reviewer:
|
||||
ms.date: 01/04/2020
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
|
||||
@ -33,8 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
|
||||
- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
@ -60,6 +59,7 @@ The following fields are available:
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
|
||||
- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
|
||||
- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
|
||||
- **DecisionDevicePnp_RS2** The count of DataSourceMatchingInfoBlock objects present on this machine targeting the next release of Windows
|
||||
- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
|
||||
- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
|
||||
@ -77,7 +77,6 @@ The following fields are available:
|
||||
- **SystemWim** The total number of objects of this type present on this device.
|
||||
- **SystemWindowsActivationStatus** The count of DecisionSystemBios objects present on this machine targeting the next release of Windows
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS3** The total Wmdrm objects targeting the next release of Windows on this device.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
|
||||
@ -92,7 +91,7 @@ The following fields are available:
|
||||
- **HasCitData** Indicates whether the file is present in CIT data.
|
||||
- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
|
||||
- **IsAv** Is the file an anti-virus reporting EXE?
|
||||
- **ResolveAttempted** This will always be an empty string when sending telemetry.
|
||||
- **ResolveAttempted** This will always be an empty string when sending diagnostic data.
|
||||
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
|
||||
|
||||
|
||||
@ -190,7 +189,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
|
||||
|
||||
This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
|
||||
This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -221,7 +220,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
|
||||
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -252,7 +251,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
|
||||
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -283,7 +282,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
|
||||
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -315,7 +314,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
|
||||
|
||||
This event sends compatibility decision data about a file to help keep Windows up-to-date.
|
||||
This event sends compatibility decision data about a file to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -364,7 +363,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
|
||||
|
||||
This event sends compatibility decision data about a PNP device to help keep Windows up to date.
|
||||
This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -790,7 +789,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
|
||||
@ -856,7 +855,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
|
||||
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -927,7 +926,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
|
||||
|
||||
This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -960,7 +959,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
|
||||
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -1159,7 +1158,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemWlanAdd
|
||||
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -1196,32 +1195,32 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
|
||||
|
||||
This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
|
||||
- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
|
||||
- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
|
||||
- **AppraiserProcess** The name of the process that launched Appraiser.
|
||||
- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
|
||||
- **AuxFinal** Obsolete, always set to false.
|
||||
- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
|
||||
- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
|
||||
- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
|
||||
- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
|
||||
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
|
||||
- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
|
||||
- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
|
||||
- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
|
||||
- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
|
||||
- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
|
||||
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
|
||||
- **RunResult** The hresult of the Appraiser telemetry run.
|
||||
- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
|
||||
- **RunResult** The hresult of the Appraiser diagnostic data run.
|
||||
- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run.
|
||||
- **StoreHandleIsNotNull** Obsolete, always set to false
|
||||
- **TelementrySent** Indicates if telemetry was successfully sent.
|
||||
- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
|
||||
- **TelementrySent** Indicates whether diagnostic data was successfully sent.
|
||||
- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
|
||||
- **Time** The client time of the event.
|
||||
- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
|
||||
- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
|
||||
@ -1444,6 +1443,7 @@ The following fields are available:
|
||||
- **LicenseStateReason** Retrieves why (or how) a system is licensed or unlicensed. The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
|
||||
- **OA3xOriginalProductKey** Retrieves the License key stamped by the OEM to the machine.
|
||||
- **OSEdition** Retrieves the version of the current OS.
|
||||
- **OSInstallDateTime** Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd
|
||||
- **OSInstallType** Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
|
||||
- **OSOOBEDateTime** Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
|
||||
- **OSSKU** Retrieves the Friendly Name of OS Edition.
|
||||
@ -1538,6 +1538,7 @@ The following fields are available:
|
||||
- **InternalPrimaryDisplayResolutionVertical** Retrieves the number of pixels in the vertical direction of the internal display.
|
||||
- **InternalPrimaryDisplaySizePhysicalH** Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
|
||||
- **InternalPrimaryDisplaySizePhysicalY** Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
|
||||
- **InternalPrimaryDisplayType** Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc.
|
||||
- **NumberofExternalDisplays** Retrieves the number of external displays connected to the machine
|
||||
- **NumberofInternalDisplays** Retrieves the number of internal displays in a machine.
|
||||
- **VRAMDedicated** Retrieves the video RAM in MB.
|
||||
@ -1720,7 +1721,7 @@ The following fields are available:
|
||||
- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
|
||||
- **op** Represents the ETW Op Code.
|
||||
- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
|
||||
- **sqmId** The Windows SQM ID.
|
||||
- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier.
|
||||
- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
|
||||
- **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
|
||||
|
||||
@ -1778,6 +1779,47 @@ This event provides information about the results of installing optional Windows
|
||||
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsQualityUpdateInstall
|
||||
|
||||
This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
|
||||
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsSelectableUpdateChangeV2
|
||||
|
||||
This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **applicableUpdateState** Indicates the highest applicable state of the optional content.
|
||||
- **buildVersion** The build version of the package being installed.
|
||||
- **clientId** The name of the application requesting the optional content change.
|
||||
- **downloadSource** Indicates if optional content was obtained from Windows Update or a locally accessible file.
|
||||
- **downloadtimeInSeconds** Indicates if optional content was obtained from Windows Update or a locally accessible file.
|
||||
- **executionID** A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
|
||||
- **executionSequence** A counter that tracks the number of servicing operations attempted on the device.
|
||||
- **firstMergedExecutionSequence** The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
|
||||
- **firstMergedID** A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
|
||||
- **hrDownloadResult** The return code of the download operation.
|
||||
- **hrStatusUpdate** The return code of the servicing operation.
|
||||
- **identityHash** A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
|
||||
- **initiatedOffline** Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
|
||||
- **majorVersion** The major version of the package being installed.
|
||||
- **minorVersion** The minor version of the package being installed.
|
||||
- **packageArchitecture** The architecture of the package being installed.
|
||||
- **packageLanguage** The language of the package being installed.
|
||||
- **packageName** The name of the package being installed.
|
||||
- **rebootRequired** Indicates whether a reboot is required to complete the operation.
|
||||
- **revisionVersion** The revision number of the package being installed.
|
||||
- **stackBuild** The build number of the servicing stack binary performing the installation.
|
||||
- **stackMajorVersion** The major version number of the servicing stack binary performing the installation.
|
||||
- **stackMinorVersion** The minor version number of the servicing stack binary performing the installation.
|
||||
- **stackRevision** The revision number of the servicing stack binary performing the installation.
|
||||
- **updateName** The name of the optional Windows Operation System feature being enabled or disabled.
|
||||
- **updateStartState** A value indicating the state of the optional content before the operation started.
|
||||
- **updateTargetState** A value indicating the desired state of the optional content.
|
||||
|
||||
|
||||
## Content Delivery Manager events
|
||||
|
||||
### Microsoft.Windows.ContentDeliveryManager.ProcessCreativeEvent
|
||||
@ -1864,7 +1906,7 @@ The following fields are available:
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartBeat_0
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -2597,6 +2639,45 @@ The following fields are available:
|
||||
- **InventoryVersion** The version of the inventory file generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
|
||||
|
||||
This event sends details collected for a specific application on the source device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AhaVersion** The binary version of the App Health Analyzer tool.
|
||||
- **ApplicationErrors** The count of application errors from the event log.
|
||||
- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit).
|
||||
- **device_level** Various JRE/JAVA versions installed on a particular device.
|
||||
- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type.
|
||||
- **Jar** Flag to determine if an app has a Java JAR file dependency.
|
||||
- **Jre** Flag to determine if an app has JRE framework dependency.
|
||||
- **Jre_version** JRE versions an app has declared framework dependency for.
|
||||
- **Name** Name of the application.
|
||||
- **NonDPIAware** Flag to determine if an app is non-DPI aware
|
||||
- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location.
|
||||
- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility.
|
||||
- **VB6** Flag to determine if an app is based on VB6 framework.
|
||||
- **VB6v2** Additional flag to determine if an app is based on VB6 framework.
|
||||
- **Version** Version of the application.
|
||||
- **VersionCheck** Flag to determine if an app has a static dependency on OS version.
|
||||
- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
|
||||
|
||||
This event indicates the beginning of a series of AppHealthStaticAdd events.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument.
|
||||
- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable.
|
||||
- **Enhanced** Indicates the presence of the 'enhanced' command line argument.
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
Invalid variant - Provides data on the installed Office Add-ins
|
||||
@ -2724,6 +2805,15 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
The following fields are available:
|
||||
|
||||
- **IndicatorValue** The indicator value.
|
||||
- **Value** Describes an operating system indicator that may be relevant for the device upgrade.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync
|
||||
|
||||
This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
|
||||
@ -2814,6 +2904,20 @@ The following fields are available:
|
||||
- **UptimeDeltaMS** Duration in last state in milliseconds.
|
||||
|
||||
|
||||
## Migration events
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
|
||||
|
||||
This event returns data about the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
|
||||
|
||||
This event returns data to track the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
## OneDrive events
|
||||
|
||||
### Microsoft.OneDrive.Sync.Setup.APIOperation
|
||||
@ -4387,7 +4491,7 @@ The following fields are available:
|
||||
|
||||
- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
|
||||
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
|
||||
- **ExtendedStatusCode** The secondary status code of the event.
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
|
||||
- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed.
|
||||
- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
|
||||
- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
|
||||
@ -4799,7 +4903,13 @@ The following fields are available:
|
||||
|
||||
### FacilitatorTelemetry.DCATDownload
|
||||
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
|
||||
|
||||
### FacilitatorTelemetry.DUDownload
|
||||
|
||||
This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows.
|
||||
|
||||
|
||||
|
||||
@ -4811,7 +4921,7 @@ This event determines whether devices received additional or critical supplement
|
||||
|
||||
### Setup360Telemetry.Downlevel
|
||||
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5127,6 +5237,7 @@ The following fields are available:
|
||||
- **CategoryId** The Item Category ID.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** The result code of the last action performed before this operation.
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Was this requested by a user?
|
||||
- **IsMandatory** Was this a mandatory update?
|
||||
@ -5137,6 +5248,7 @@ The following fields are available:
|
||||
- **PFN** The product family name of the product being installed.
|
||||
- **ProductId** The identity of the package or packages being installed.
|
||||
- **SystemAttemptNumber** The total number of automatic attempts at installation before it was canceled.
|
||||
- **UpdateId** Update ID (if this is an update)
|
||||
- **UserAttemptNumber** The total number of user attempts at installation before it was canceled.
|
||||
- **WUContentId** The Windows Update content ID.
|
||||
|
||||
@ -5164,6 +5276,7 @@ The following fields are available:
|
||||
- **BundleId** The identity of the Windows Insider build that is associated with this product.
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Was this requested by a user?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
@ -5203,16 +5316,20 @@ The following fields are available:
|
||||
|
||||
- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
|
||||
- **AttemptNumber** The total number of attempts to acquire this product.
|
||||
- **BundleId** The bundle ID
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** HResult code to show the result of the operation (success/failure).
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Did the user initiate the installation?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this happening after a device restore?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **IsWin32** Flag indicating if this is a Win32app.
|
||||
- **ParentBundledId** The product's parent bundle ID.
|
||||
- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
|
||||
- **PFN** Product Family Name of the product being installed.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
|
||||
@ -5235,16 +5352,19 @@ The following fields are available:
|
||||
- **DownloadSize** The total size of the download.
|
||||
- **ExtendedHResult** Any extended HResult error codes.
|
||||
- **HResult** The result code of the last action performed.
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this initiated by the user?
|
||||
- **IsMandatory** Is this a mandatory installation?
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this a restore of a previously acquired product?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **IsWin32** Flag indicating if this is a Win32 app (unused).
|
||||
- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
|
||||
- **PFN** The Product Family Name of the app being download.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The number of attempts by the system to download.
|
||||
- **UpdateId** Update ID (if this is an update)
|
||||
- **UserAttemptNumber** The number of attempts by the user to download.
|
||||
- **WUContentId** The Windows Update content ID.
|
||||
|
||||
@ -5280,16 +5400,19 @@ The following fields are available:
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **ExtendedHResult** The extended HResult error code.
|
||||
- **HResult** The result code of the last action performed.
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this an interactive installation?
|
||||
- **IsMandatory** Is this a mandatory installation?
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this automatically restoring a previously acquired product?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **IsWin32** Flag indicating if this a Win32 app (unused).
|
||||
- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
|
||||
- **PFN** Product Family Name of the product being installed.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The total number of system attempts.
|
||||
- **UpdateId** Update ID (if this is an update)
|
||||
- **UserAttemptNumber** The total number of user attempts.
|
||||
- **WUContentId** The Windows Update content ID.
|
||||
|
||||
@ -5319,16 +5442,19 @@ The following fields are available:
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** The result code of the last action performed.
|
||||
- **IntentPFNs** The licensing identity of this package.
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this user requested?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this restoring previously acquired content?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **IsWin32** Flag indicating if this a Win32 app (unused).
|
||||
- **ParentBundleId** The product ID of the parent (if this product is part of a bundle).
|
||||
- **PFN** The name of the package or packages requested for install.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The total number of system attempts.
|
||||
- **UpdateId** Update ID (if this is an update)
|
||||
- **UserAttemptNumber** The total number of user attempts.
|
||||
- **WUContentId** The Windows Update content ID.
|
||||
|
||||
@ -5345,6 +5471,7 @@ The following fields are available:
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** The result code of the last action performed.
|
||||
- **IntentPFNs** The licensing identity of this package.
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this user requested?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
@ -5414,6 +5541,7 @@ The following fields are available:
|
||||
- **BundleId** The identity of the build associated with this product.
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **IntentPFNs** The licensing identity of this package.
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this user requested?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
@ -5443,6 +5571,7 @@ The following fields are available:
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** The result code of the last action performed before this operation.
|
||||
- **IntentPFNs** Intent Product Family Name
|
||||
- **IsBundle** Is this a bundle?
|
||||
- **IsInteractive** Is this user requested?
|
||||
- **IsMandatory** Is this a mandatory update?
|
||||
@ -6260,6 +6389,12 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda
|
||||
|
||||
## Windows Update Reserve Manager events
|
||||
|
||||
### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment
|
||||
|
||||
This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
|
||||
|
||||
This event returns data about the Update Reserve Manager, including whether it’s been initialized.
|
||||
@ -6272,6 +6407,12 @@ This event is sent when the Update Reserve Manager removes a pending hard reserv
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment
|
||||
|
||||
This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed.
|
||||
|
||||
|
||||
|
||||
## Winlogon events
|
||||
|
||||
### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. Specific to Windows 10, version 1709.
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
|
||||
title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10)
|
||||
keywords: privacy, telemetry
|
||||
ms.prod: w10
|
||||
@ -7,14 +7,14 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
author: brianlic-msft
|
||||
ms.author: brianlic
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 04/19/2019
|
||||
ms.reviewer:
|
||||
ms.date: 01/04/2020
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
|
||||
@ -33,8 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
|
||||
- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
|
||||
@ -102,7 +101,7 @@ The following fields are available:
|
||||
- **HasCitData** Indicates whether the file is present in CIT data.
|
||||
- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
|
||||
- **IsAv** Is the file an anti-virus reporting EXE?
|
||||
- **ResolveAttempted** This will always be an empty string when sending telemetry.
|
||||
- **ResolveAttempted** This will always be an empty string when sending diagnostic data.
|
||||
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
|
||||
|
||||
|
||||
@ -201,7 +200,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
|
||||
|
||||
This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
|
||||
This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -234,7 +233,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
|
||||
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -267,7 +266,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
|
||||
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -300,7 +299,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
|
||||
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -333,7 +332,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
|
||||
|
||||
This event sends compatibility decision data about a file to help keep Windows up-to-date.
|
||||
This event sends compatibility decision data about a file to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -347,7 +346,7 @@ The following fields are available:
|
||||
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
|
||||
- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
|
||||
- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dimissed?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dismissed?
|
||||
- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
|
||||
- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade?
|
||||
- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app.
|
||||
@ -384,7 +383,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
|
||||
|
||||
This event sends compatibility decision data about a PNP device to help keep Windows up to date.
|
||||
This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -828,7 +827,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
|
||||
@ -895,7 +894,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
|
||||
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -970,7 +969,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
|
||||
|
||||
This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1005,7 +1004,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
|
||||
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1216,7 +1215,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemWlanAdd
|
||||
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1255,7 +1254,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
|
||||
|
||||
This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -1266,21 +1265,21 @@ The following fields are available:
|
||||
- **AuxFinal** Obsolete, always set to false.
|
||||
- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
|
||||
- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
|
||||
- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
|
||||
- **InventoryFullSync** Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
|
||||
- **PCFP** An ID for the system calculated by hashing hardware identifiers.
|
||||
- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
|
||||
- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
|
||||
- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
|
||||
- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
|
||||
- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
|
||||
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
|
||||
- **RunResult** The hresult of the Appraiser telemetry run.
|
||||
- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
|
||||
- **RunResult** The hresult of the Appraiser diagnostic data run.
|
||||
- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run.
|
||||
- **StoreHandleIsNotNull** Obsolete, always set to false
|
||||
- **TelementrySent** Indicates if telemetry was successfully sent.
|
||||
- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
|
||||
- **TelementrySent** Indicates whether diagnostic data was successfully sent.
|
||||
- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
|
||||
- **Time** The client time of the event.
|
||||
- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
|
||||
- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
|
||||
@ -1819,7 +1818,7 @@ The following fields are available:
|
||||
- **mon** Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
|
||||
- **op** Represents the ETW Op Code.
|
||||
- **raId** Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
|
||||
- **sqmId** The Windows SQM ID.
|
||||
- **sqmId** The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier.
|
||||
- **stId** Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
|
||||
- **tickets** An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
|
||||
|
||||
@ -1914,6 +1913,12 @@ The following fields are available:
|
||||
- **pendingDecision** Indicates the cause of reboot, if applicable.
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsQualityUpdateInstall
|
||||
|
||||
This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
|
||||
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsSelectableUpdateChangeV2
|
||||
|
||||
This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
|
||||
@ -1965,7 +1970,7 @@ Fired by UTC at startup to signal what data we are allowed to collect.
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartBeat_0
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
|
||||
|
||||
|
||||
|
||||
@ -2476,7 +2481,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
|
||||
|
||||
This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
|
||||
This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -2650,6 +2655,45 @@ The following fields are available:
|
||||
- **InventoryVersion** The version of the inventory file generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
|
||||
|
||||
This event sends details collected for a specific application on the source device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AhaVersion** The binary version of the App Health Analyzer tool.
|
||||
- **ApplicationErrors** The count of application errors from the event log.
|
||||
- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit).
|
||||
- **device_level** Various JRE/JAVA versions installed on a particular device.
|
||||
- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type.
|
||||
- **Jar** Flag to determine if an app has a Java JAR file dependency.
|
||||
- **Jre** Flag to determine if an app has JRE framework dependency.
|
||||
- **Jre_version** JRE versions an app has declared framework dependency for.
|
||||
- **Name** Name of the application.
|
||||
- **NonDPIAware** Flag to determine if an app is non-DPI aware
|
||||
- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location.
|
||||
- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility.
|
||||
- **VB6** Flag to determine if an app is based on VB6 framework.
|
||||
- **VB6v2** Additional flag to determine if an app is based on VB6 framework.
|
||||
- **Version** Version of the application.
|
||||
- **VersionCheck** Flag to determine if an app has a static dependency on OS version.
|
||||
- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
|
||||
|
||||
This event indicates the beginning of a series of AppHealthStaticAdd events.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument.
|
||||
- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable.
|
||||
- **Enhanced** Indicates the presence of the 'enhanced' command line argument.
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
Invalid variant - Provides data on the installed Office Add-ins
|
||||
@ -2837,7 +2881,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BrowserFlags** Browser flags for Office-related products
|
||||
- **BrowserFlags** Browser flags for Office-related products.
|
||||
- **ExchangeProviderFlags** Office Exchange provider policies
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **SharedComputerLicensing** Office Shared Computer Licensing policies
|
||||
@ -3039,6 +3083,26 @@ The following fields are available:
|
||||
- **UserInputTime** The amount of time the loader application spent waiting for user input.
|
||||
|
||||
|
||||
## Migration events
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
|
||||
|
||||
This event returns data to track the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
|
||||
|
||||
This event returns data about the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
|
||||
|
||||
This event returns data to track the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
## OneDrive events
|
||||
|
||||
### Microsoft.OneDrive.Sync.Setup.APIOperation
|
||||
@ -4411,7 +4475,7 @@ The following fields are available:
|
||||
|
||||
- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
|
||||
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
|
||||
- **ExtendedStatusCode** The secondary status code of the event.
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
|
||||
- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed.
|
||||
- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
|
||||
- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
|
||||
@ -5032,7 +5096,13 @@ The following fields are available:
|
||||
|
||||
### FacilitatorTelemetry.DCATDownload
|
||||
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
|
||||
|
||||
### FacilitatorTelemetry.DUDownload
|
||||
|
||||
This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows.
|
||||
|
||||
|
||||
|
||||
@ -5044,7 +5114,7 @@ This event determines whether devices received additional or critical supplement
|
||||
|
||||
### Setup360Telemetry.Downlevel
|
||||
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5274,7 +5344,7 @@ The following fields are available:
|
||||
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
|
||||
- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
@ -5293,6 +5363,18 @@ The following fields are available:
|
||||
- **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String.
|
||||
|
||||
|
||||
### Microsoft.Windows.WaaSMedic.RemediationFailed
|
||||
|
||||
This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **diagnostic** Parameter where the resolution failed.
|
||||
- **hResult** Error code that resulted from attempting the resolution.
|
||||
- **isRemediated** Indicates whether the condition was remediated.
|
||||
- **pluginName** Name of the attempted resolution.
|
||||
|
||||
|
||||
### Microsoft.Windows.WaaSMedic.Summary
|
||||
|
||||
This event provides the results of the WaaSMedic diagnostic run
|
||||
@ -5459,6 +5541,7 @@ The following fields are available:
|
||||
|
||||
- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
|
||||
- **AttemptNumber** The total number of attempts to acquire this product.
|
||||
- **BundleId** The bundle ID
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** HResult code to show the result of the operation (success/failure).
|
||||
@ -5468,6 +5551,7 @@ The following fields are available:
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this happening after a device restore?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
|
||||
- **PFN** Product Family Name of the product being installed.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
|
||||
@ -6573,6 +6657,7 @@ The following fields are available:
|
||||
This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
|
||||
|
||||
This event returns data about the Update Reserve Manager, including whether it’s been initialized.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. Specific to Windows 10, version 1803.
|
||||
description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level.
|
||||
title: Windows 10, version 1803 basic diagnostic events and fields (Windows 10)
|
||||
keywords: privacy, telemetry
|
||||
ms.prod: w10
|
||||
@ -7,14 +7,14 @@ ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
author: brianlic-msft
|
||||
ms.author: brianlic
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 04/19/2019
|
||||
ms.reviewer:
|
||||
ms.date: 01/04/2020
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
|
||||
@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Windows 10, version 1903 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
|
||||
@ -135,7 +135,7 @@ The following fields are available:
|
||||
- **HasCitData** Indicates whether the file is present in CIT data.
|
||||
- **HasUpgradeExe** Indicates whether the anti-virus app has an upgrade.exe file.
|
||||
- **IsAv** Is the file an antivirus reporting EXE?
|
||||
- **ResolveAttempted** This will always be an empty string when sent.
|
||||
- **ResolveAttempted** This will always be an empty string when sending diagnostic data.
|
||||
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
|
||||
|
||||
|
||||
@ -234,7 +234,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
|
||||
|
||||
This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
|
||||
This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -267,7 +267,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
|
||||
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -300,7 +300,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
|
||||
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -333,7 +333,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
|
||||
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
|
||||
This event sends compatibility database information about the BIOS to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -366,7 +366,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
|
||||
|
||||
This event sends compatibility decision data about a file to help keep Windows up-to-date.
|
||||
This event sends compatibility decision data about a file to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -381,7 +381,7 @@ The following fields are available:
|
||||
- **HasUxBlockOverride** Does the file have a block that is overridden by a tag in the SDB?
|
||||
- **MigApplication** Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
|
||||
- **MigRemoval** Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dimissed?
|
||||
- **NeedsDismissAction** Will the file cause an action that can be dismissed?
|
||||
- **NeedsInstallPostUpgradeData** After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
|
||||
- **NeedsNotifyPostUpgradeData** Does the file have a notification that should be shown after upgrade?
|
||||
- **NeedsReinstallPostUpgradeData** After upgrade, this file will have a post-upgrade notification to reinstall the app.
|
||||
@ -418,7 +418,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
|
||||
|
||||
This event sends compatibility decision data about a PNP device to help keep Windows up to date.
|
||||
This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -865,7 +865,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
- **AppraiserVersion** The version of the Appraiser binary (executable) generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
|
||||
@ -931,7 +931,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
|
||||
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
|
||||
This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1006,7 +1006,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
|
||||
|
||||
This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1041,7 +1041,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
|
||||
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1258,7 +1258,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemWlanAdd
|
||||
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
|
||||
This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -1297,18 +1297,18 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
|
||||
|
||||
This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserBranch** The source branch in which the version of Appraiser that is running was built.
|
||||
- **AppraiserDataVersion** The version of the data files being used by the Appraiser telemetry run.
|
||||
- **AppraiserDataVersion** The version of the data files being used by the Appraiser diagnostic data run.
|
||||
- **AppraiserProcess** The name of the process that launched Appraiser.
|
||||
- **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
|
||||
- **AuxFinal** Obsolete, always set to false.
|
||||
- **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
|
||||
- **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
|
||||
- **EnterpriseRun** Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
|
||||
- **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
|
||||
- **InboxDataVersion** The original version of the data files before retrieving any newer version.
|
||||
- **IndicatorsWritten** Indicates if all relevant UEX indicators were successfully written or updated.
|
||||
@ -1317,14 +1317,14 @@ The following fields are available:
|
||||
- **PerfBackoff** Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
|
||||
- **PerfBackoffInsurance** Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
|
||||
- **RunAppraiser** Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
|
||||
- **RunDate** The date that the telemetry run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
|
||||
- **RunDate** The date that the diagnostic data run was stated, expressed as a filetime.
|
||||
- **RunGeneralTel** Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
|
||||
- **RunOnline** Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
|
||||
- **RunResult** The hresult of the Appraiser telemetry run.
|
||||
- **SendingUtc** Indicates if the Appraiser client is sending events during the current telemetry run.
|
||||
- **RunResult** The hresult of the Appraiser diagnostic data run.
|
||||
- **SendingUtc** Indicates whether the Appraiser client is sending events during the current diagnostic data run.
|
||||
- **StoreHandleIsNotNull** Obsolete, always set to false
|
||||
- **TelementrySent** Indicates if telemetry was successfully sent.
|
||||
- **ThrottlingUtc** Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
|
||||
- **TelementrySent** Indicates whether diagnostic data was successfully sent.
|
||||
- **ThrottlingUtc** Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
|
||||
- **Time** The client time of the event.
|
||||
- **VerboseMode** Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
|
||||
- **WhyFullSyncWithoutTablePrefix** Indicates the reason or reasons that a full sync was generated.
|
||||
@ -1391,6 +1391,18 @@ The following fields are available:
|
||||
- **IEVersion** The version of Internet Explorer that is running on the device.
|
||||
|
||||
|
||||
### Census.Azure
|
||||
|
||||
This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CloudCoreBuildEx** The Azure CloudCore build number.
|
||||
- **CloudCoreSupportBuildEx** The Azure CloudCore support build number.
|
||||
- **NodeID** The node identifier on the device that indicates whether the device is part of the Azure fleet.
|
||||
- **PartA_PrivTags** The privacy tags associated with the event.
|
||||
|
||||
|
||||
### Census.Battery
|
||||
|
||||
This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
|
||||
@ -2105,6 +2117,43 @@ The following fields are available:
|
||||
- **transactionCanceled** Indicates whether the uninstall was cancelled.
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsQualityUpdateInstall
|
||||
|
||||
This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **buildVersion** The build version number of the update package.
|
||||
- **clientId** The name of the application requesting the optional content.
|
||||
- **corruptionHistoryFlags** A bitmask of the types of component store corruption that have caused update failures on the device.
|
||||
- **corruptionType** An enumeration listing the type of data corruption responsible for the current update failure.
|
||||
- **currentStateEnd** The final state of the package after the operation has completed.
|
||||
- **doqTimeSeconds** The time in seconds spent updating drivers.
|
||||
- **executeTimeSeconds** The number of seconds required to execute the install.
|
||||
- **failureDetails** The driver or installer that caused the update to fail.
|
||||
- **failureSourceEnd** An enumeration indicating at what phase of the update a failure occurred.
|
||||
- **hrStatusEnd** The return code of the install operation.
|
||||
- **initiatedOffline** A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file.
|
||||
- **majorVersion** The major version number of the update package.
|
||||
- **minorVersion** The minor version number of the update package.
|
||||
- **originalState** The starting state of the package.
|
||||
- **overallTimeSeconds** The time (in seconds) to perform the overall servicing operation.
|
||||
- **PartA_PrivTags** The privacy tags associated with the event.
|
||||
- **planTimeSeconds** The time in seconds required to plan the update operations.
|
||||
- **poqTimeSeconds** The time in seconds processing file and registry operations.
|
||||
- **postRebootTimeSeconds** The time (in seconds) to do startup processing for the update.
|
||||
- **preRebootTimeSeconds** The time (in seconds) between execution of the installation and the reboot.
|
||||
- **primitiveExecutionContext** An enumeration indicating at what phase of shutdown or startup the update was installed.
|
||||
- **rebootCount** The number of reboots required to install the update.
|
||||
- **rebootTimeSeconds** The time (in seconds) before startup processing begins for the update.
|
||||
- **resolveTimeSeconds** The time in seconds required to resolve the packages that are part of the update.
|
||||
- **revisionVersion** The revision version number of the update package.
|
||||
- **rptTimeSeconds** The time in seconds spent executing installer plugins.
|
||||
- **shutdownTimeSeconds** The time (in seconds) required to do shutdown processing for the update.
|
||||
- **stackRevision** The revision number of the servicing stack.
|
||||
- **stageTimeSeconds** The time (in seconds) required to stage all files that are part of the update.
|
||||
|
||||
|
||||
### CbsServicingProvider.CbsSelectableUpdateChangeV2
|
||||
|
||||
This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
|
||||
@ -2250,7 +2299,7 @@ The following fields are available:
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartbeat_0
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -3394,7 +3443,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
|
||||
|
||||
This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
|
||||
This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
@ -3568,6 +3617,50 @@ The following fields are available:
|
||||
- **InventoryVersion** The version of the inventory file generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
|
||||
|
||||
This event sends details collected for a specific application on the source device.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AhaVersion** The binary version of the App Health Analyzer tool.
|
||||
- **ApplicationErrors** The count of application errors from the event log.
|
||||
- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit).
|
||||
- **device_level** Various JRE/JAVA versions installed on a particular device.
|
||||
- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type.
|
||||
- **Jar** Flag to determine if an app has a Java JAR file dependency.
|
||||
- **Jre** Flag to determine if an app has JRE framework dependency.
|
||||
- **Jre_version** JRE versions an app has declared framework dependency for.
|
||||
- **Name** Name of the application.
|
||||
- **NonDPIAware** Flag to determine if an app is non-DPI aware
|
||||
- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location.
|
||||
- **ProgramId** The ID of the associated program.
|
||||
- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution.
|
||||
- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility.
|
||||
- **VB6** Flag to determine if an app is based on VB6 framework.
|
||||
- **VB6v2** Additional flag to determine if an app is based on VB6 framework.
|
||||
- **Version** Version of the application.
|
||||
- **VersionCheck** Flag to determine if an app has a static dependency on OS version.
|
||||
- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
|
||||
|
||||
This event indicates the beginning of a series of AppHealthStaticAdd events.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AllowTelemetry** Indicates the presence of the 'allowtelemetry' command line argument.
|
||||
- **CommandLineArgs** Command line arguments passed when launching the App Health Analyzer executable.
|
||||
- **Enhanced** Indicates the presence of the 'enhanced' command line argument.
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
Provides data on the installed Office Add-ins
|
||||
@ -3760,10 +3853,10 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BrowserFlags** Browser flags for Office-related products
|
||||
- **ExchangeProviderFlags** Provider policies for Office Exchange
|
||||
- **BrowserFlags** Browser flags for Office-related products.
|
||||
- **ExchangeProviderFlags** Provider policies for Office Exchange.
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **SharedComputerLicensing** Office shared computer licensing policies
|
||||
- **SharedComputerLicensing** Office shared computer licensing policies.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
|
||||
@ -3994,6 +4087,215 @@ The following fields are available:
|
||||
- **UptimeDeltaMS** Total time (in milliseconds) added to Uptime since the last event
|
||||
|
||||
|
||||
## Microsoft Edge events
|
||||
|
||||
### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config
|
||||
|
||||
This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **app_version** The internal Microsoft Edge build version string.
|
||||
- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
|
||||
- **Channel** An integer indicating the channel of the installation (Canary or Dev).
|
||||
- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
|
||||
- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
|
||||
- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
|
||||
- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
|
||||
- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
|
||||
- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload.
|
||||
- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
|
||||
- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
|
||||
- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
|
||||
|
||||
|
||||
### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config
|
||||
|
||||
This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **app_version** The internal Microsoft Edge build version string.
|
||||
- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
|
||||
- **Channel** An integer indicating the channel of the installation (Canary or Dev).
|
||||
- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
|
||||
- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
|
||||
- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
|
||||
- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
|
||||
- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
|
||||
- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload.
|
||||
- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
|
||||
- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
|
||||
- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
|
||||
|
||||
|
||||
### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config
|
||||
|
||||
This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **app_version** The internal Microsoft Edge build version string.
|
||||
- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
|
||||
- **Channel** An integer indicating the channel of the installation (Canary or Dev).
|
||||
- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
|
||||
- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
|
||||
- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
|
||||
- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
|
||||
- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
|
||||
- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload.
|
||||
- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
|
||||
- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
|
||||
- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
|
||||
|
||||
|
||||
### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config
|
||||
|
||||
This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **app_version** The internal Microsoft Edge build version string.
|
||||
- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
|
||||
- **Channel** An integer indicating the channel of the installation (Canary or Dev).
|
||||
- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
|
||||
- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
|
||||
- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
|
||||
- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
|
||||
- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
|
||||
- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload.
|
||||
- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
|
||||
- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
|
||||
- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
|
||||
|
||||
|
||||
### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping
|
||||
|
||||
This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''.
|
||||
- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update.
|
||||
- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown).
|
||||
- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev).
|
||||
- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''.
|
||||
- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
|
||||
- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
|
||||
- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
|
||||
- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited.
|
||||
- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown).
|
||||
- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''.
|
||||
- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'.
|
||||
- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''.
|
||||
- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'.
|
||||
- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'.
|
||||
- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
|
||||
- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
|
||||
- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
|
||||
- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'.
|
||||
- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
|
||||
- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
|
||||
- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
|
||||
- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
|
||||
- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'.
|
||||
- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error).
|
||||
- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown).
|
||||
- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'.
|
||||
- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'.
|
||||
- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'.
|
||||
- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event.
|
||||
- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a <urls> tag.
|
||||
- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'.
|
||||
- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not.
|
||||
- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''.
|
||||
- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''.
|
||||
- **appVersion** The version of the product install. Default: '0.0.0.0'.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full.
|
||||
- **eventType** A string representation of appPingEventEventType indicating the type of the event.
|
||||
- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'.
|
||||
- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'.
|
||||
- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'.
|
||||
- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''.
|
||||
- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''.
|
||||
- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''.
|
||||
- **osVersion** The primary version of the operating system. '' if unknown. Default: ''.
|
||||
- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'.
|
||||
- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''.
|
||||
- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'.
|
||||
- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''.
|
||||
- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'.
|
||||
- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''.
|
||||
- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'.
|
||||
- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined.
|
||||
- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''.
|
||||
- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''.
|
||||
- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''.
|
||||
- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''.
|
||||
- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''.
|
||||
|
||||
|
||||
### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config
|
||||
|
||||
This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **app_version** The internal Microsoft Edge build version string.
|
||||
- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
|
||||
- **Channel** An integer indicating the channel of the installation (Canary or Dev).
|
||||
- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
|
||||
- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
|
||||
- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode.
|
||||
- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
|
||||
- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
|
||||
- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
|
||||
- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
|
||||
- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload.
|
||||
- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
|
||||
- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
|
||||
- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
|
||||
|
||||
|
||||
## Migration events
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
|
||||
|
||||
This event returns data to track the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
|
||||
|
||||
This event returns data about the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
|
||||
|
||||
This event returns data to track the count of the migration objects across various phases during feature update.
|
||||
|
||||
|
||||
|
||||
## Miracast events
|
||||
|
||||
### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd
|
||||
@ -4937,6 +5239,12 @@ The following fields are available:
|
||||
|
||||
## SIH events
|
||||
|
||||
### SIHEngineTelemetry.ExecuteAction
|
||||
|
||||
This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot.
|
||||
|
||||
|
||||
|
||||
### SIHEngineTelemetry.SLSActionData
|
||||
|
||||
This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated.
|
||||
@ -5287,28 +5595,111 @@ The following fields are available:
|
||||
- **CallerApplicationName** Name of application making the Windows Update request. Used to identify context of request.
|
||||
- **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
|
||||
- **EventScenario** The purpose of this event, such as scan started, scan succeeded, or scan failed.
|
||||
- **ExtendedStatusCode** The secondary status code of the event.
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
|
||||
- **LeafCertId** The integral ID from the FragmentSigning data for the certificate that failed.
|
||||
- **ListOfSHA256OfIntermediateCerData** A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
|
||||
- **MetadataIntegrityMode** The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
|
||||
- **MetadataSignature** Base64 string of the signature associated with the update metadata (specified by revision id)
|
||||
- **MetadataSignature** A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
|
||||
- **RawMode** The raw unparsed mode string from the SLS response. This field is null if not applicable.
|
||||
- **RawValidityWindowInDays** The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
|
||||
- **RevisionId** Identifies the revision of this specific piece of content
|
||||
- **RevisionNumber** Identifies the revision number of this specific piece of content
|
||||
- **RevisionId** The revision ID for a specific piece of content.
|
||||
- **RevisionNumber** The revision number for a specific piece of content.
|
||||
- **ServiceGuid** Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
|
||||
- **SHA256OfLeafCerData** A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
|
||||
- **SHA256OfLeafCertPublicKey** Base64 encoding of hash of the Base64CertData in the FragmentSigning data of leaf certificate.
|
||||
- **SHA256OfLeafCertPublicKey** A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
|
||||
- **SHA256OfTimestampToken** An encoded string of the timestamp token.
|
||||
- **SignatureAlgorithm** Hash algorithm for the metadata signature
|
||||
- **SignatureAlgorithm** The hash algorithm for the metadata signature.
|
||||
- **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast
|
||||
- **StatusCode** The status code of the event.
|
||||
- **StatusCode** Result code of the event (success, cancellation, failure code HResult).
|
||||
- **TimestampTokenCertThumbprint** The thumbprint of the encoded timestamp token.
|
||||
- **TimestampTokenId** The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
|
||||
- **UpdateId** Identifier associated with the specific piece of content
|
||||
- **UpdateId** The update ID for a specific piece of content.
|
||||
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
|
||||
|
||||
|
||||
## Update Assistant events
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId
|
||||
|
||||
The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ApplicabilityBlockedReason** Blocked due to an applicability issue.
|
||||
- **BlockWuUpgrades** The upgrade assistant is currently blocked.
|
||||
- **clientID** An identification of the current release of Update Assistant.
|
||||
- **CloverTrail** This device is Clovertrail.
|
||||
- **DeviceIsMdmManaged** This device is MDM managed.
|
||||
- **IsNetworkAvailable** If the device network is not available.
|
||||
- **IsNetworkMetered** If network is metered.
|
||||
- **IsSccmManaged** This device is SCCM managed.
|
||||
- **NewlyInstalledOs** OS is newly installed quiet period.
|
||||
- **PausedByPolicy** Updates are paused by policy.
|
||||
- **RecoveredFromRS3** Previously recovered from RS3.
|
||||
- **RS1UninstallActive** Blocked due to an active RS1 uninstall.
|
||||
- **RS3RollBacks** Exceeded number of allowable RS3 rollbacks.
|
||||
- **triggerTaskSource** Describe which task launches this instance.
|
||||
- **WsusManaged** This device is WSUS managed.
|
||||
- **ZeroExhaust** This device is zero exhaust.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId
|
||||
|
||||
The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **clientID** An identification of the current release of Update Assistant.
|
||||
- **denyReason** All the reasons why the Update Assistant was prevented from launching. Bitmask with values from UpdateAssistant.cpp eUpgradeModeReason.
|
||||
- **triggerTaskSource** Describe which task launches this instance.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId
|
||||
|
||||
Event to mark that Update Assistant Orchestrator failed to launch Update Assistant.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **calendarRun** Standard time-based triggered task.
|
||||
- **clientID** An identification of the current release of Update Assistant.
|
||||
- **hResult** Error code of the Update Assistant Orchestrator failure.
|
||||
- **triggerTaskSource** Describe which task launches this instance.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId
|
||||
|
||||
Event indicating One Settings was not queried by update assistant.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **clientID** An identification of the current release of Update Assistant.
|
||||
- **hResult** Error code of One Settings query failure.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId
|
||||
|
||||
This event sends basic information on whether the device should be updated to the latest Windows 10 version.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **autoStartRunCount** The auto start run count of Update Assistant.
|
||||
- **clientID** The ID of the current release of Update Assistant.
|
||||
- **launchMode** Indicates the type of launch performed.
|
||||
- **launchTypeReason** A bitmask of all the reasons for type of launch.
|
||||
- **triggerTaskSource** Indicates which task launches this instance.
|
||||
|
||||
|
||||
### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId
|
||||
|
||||
The event sends basic info on whether the Windows 10 update notification has previously launched.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **clientID** ID of the current release of Update Assistant.
|
||||
- **restoreReason** All the reasons for the restore.
|
||||
- **triggerTaskSource** Indicates which task launches this instance.
|
||||
|
||||
|
||||
## Update events
|
||||
|
||||
### Update360Telemetry.Revert
|
||||
@ -5722,7 +6113,7 @@ The following fields are available:
|
||||
|
||||
### FacilitatorTelemetry.DCATDownload
|
||||
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
|
||||
This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5760,7 +6151,7 @@ The following fields are available:
|
||||
|
||||
### Setup360Telemetry.Downlevel
|
||||
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
|
||||
This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -6041,7 +6432,7 @@ The following fields are available:
|
||||
- **ReportId** With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
|
||||
- **Setup360Extended** Detailed information about the phase/action when the potential failure occurred.
|
||||
- **Setup360Mode** The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
|
||||
- **Setup360Result** The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
|
||||
- **Setup360Scenario** The Setup360 flow type. Example: Boot, Media, Update, MCT.
|
||||
- **SetupVersionBuildNumber** The build number of Setup360 (build number of target OS).
|
||||
- **State** The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
|
||||
@ -6219,6 +6610,7 @@ The following fields are available:
|
||||
|
||||
- **AggregatedPackageFullNames** Includes a set of package full names for each app that is part of an atomic set.
|
||||
- **AttemptNumber** The total number of attempts to acquire this product.
|
||||
- **BundleId** The bundle ID
|
||||
- **CategoryId** The identity of the package or packages being installed.
|
||||
- **ClientAppId** The identity of the app that initiated this operation.
|
||||
- **HResult** HResult code to show the result of the operation (success/failure).
|
||||
@ -6228,6 +6620,7 @@ The following fields are available:
|
||||
- **IsRemediation** Is this repairing a previous installation?
|
||||
- **IsRestore** Is this happening after a device restore?
|
||||
- **IsUpdate** Is this an update?
|
||||
- **ParentBundleId** The parent bundle ID (if it's part of a bundle).
|
||||
- **PFN** Product Family Name of the product being installed.
|
||||
- **ProductId** The Store Product ID for the product being installed.
|
||||
- **SystemAttemptNumber** The number of attempts by the system to acquire this product.
|
||||
@ -7169,6 +7562,19 @@ The following fields are available:
|
||||
- **wuDeviceid** The unique device ID used by Windows Update.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.DetectionResult
|
||||
|
||||
This event runs when an update is detected. This helps ensure Windows is kept up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **applicableUpdateIdList** A list of applicable update IDs.
|
||||
- **applicableUpdateList** A list of applicable update names.
|
||||
- **seekerUpdateIdList** A list of optional update IDs.
|
||||
- **seekerUpdateList** A list of optional update names.
|
||||
- **wuDeviceid** The Windows Update device identifier.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
|
||||
|
||||
This event indicates the reboot was postponed due to needing a display.
|
||||
@ -7481,6 +7887,32 @@ The following fields are available:
|
||||
- **wuDeviceid** Unique device ID used by Windows Update.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable
|
||||
|
||||
This event defines when an optional update is available for the device to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **flightID** The unique identifier of the Windows Insider build on this device.
|
||||
- **isFeatureUpdate** Indicates whether the update is a Feature Update.
|
||||
- **revisionNumber** The revision number of the update.
|
||||
- **updateId** The GUID (Globally Unique Identifier) of the update.
|
||||
- **wuDeviceid** The Windows Update device identifier.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.SeekUpdate
|
||||
|
||||
This event occurs when user initiates "seeker" scan. This helps keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **flightID** The ID of the Windows Insider builds on the device.
|
||||
- **isFeatureUpdate** Indicates that the target of the Seek is a feature update.
|
||||
- **revisionNumber** The revision number of the update.
|
||||
- **updateId** The identifier of the update.
|
||||
- **wuDeviceid** The Windows Update device identifier.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.SystemNeeded
|
||||
|
||||
This event sends data about why a device is unable to reboot, to help keep Windows up to date.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
x
Reference in New Issue
Block a user