mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 05:07:23 +00:00
Merge pull request #4216 from MicrosoftDocs/privacy-update-vb
Privacy update vb
This commit is contained in:
Sinead O'Sullivan
GitHub
commit
2444d2dc0e
@ -13,7 +13,7 @@ manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 09/30/2020
|
||||
ms.date: 04/28/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
@ -52,31 +52,31 @@ This event lists the types of objects and how many of each exist on the client d
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DatasourceApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
|
||||
- **DatasourceDevicePnp_RS3** The total DatasourceDevicePnp objects targeting the next release of Windows on this device.
|
||||
- **DatasourceDriverPackage_RS3** The total DatasourceDriverPackage objects targeting the next release of Windows on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS3** The total DataSourceMatchingInfoBlock objects targeting the next release of Windows on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
|
||||
- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting the next release of Windows on this device.
|
||||
- **DecisionApplicationFile_RS3** The total DecisionApplicationFile objects targeting the next release of Windows on this device.
|
||||
- **DecisionDevicePnp_RS2** The count of DataSourceMatchingInfoBlock objects present on this machine targeting the next release of Windows
|
||||
- **DecisionDevicePnp_RS3** The total DecisionDevicePnp objects targeting the next release of Windows on this device.
|
||||
- **DecisionDriverPackage_RS3** The total DecisionDriverPackage objects targeting the next release of Windows on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
|
||||
- **DecisionMatchingInfoPassive_RS3** The total DataSourceMatchingInfoPassive objects targeting the next release of Windows on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
|
||||
- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting the next release of Windows on this device.
|
||||
- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting the next release of Windows on this device.
|
||||
- **InventoryLanguagePack** The count of DecisionApplicationFile objects present on this machine targeting the next release of Windows
|
||||
- **InventorySystemBios** The count of DecisionDevicePnp objects present on this machine targeting the next release of Windows
|
||||
- **PCFP** The count of DecisionDriverPackage objects present on this machine targeting the next release of Windows
|
||||
- **SystemProcessorCompareExchange** The count of DecisionMatchingInfoBlock objects present on this machine targeting the next release of Windows
|
||||
- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS2** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **InventoryLanguagePack** The total number of objects of this type present on this device.
|
||||
- **InventorySystemBios** The total number of objects of this type present on this device.
|
||||
- **PCFP** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorCompareExchange** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorNx** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorPrefetchW** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorSse2** The total number of objects of this type present on this device.
|
||||
- **SystemWim** The total number of objects of this type present on this device.
|
||||
- **SystemWindowsActivationStatus** The count of DecisionSystemBios objects present on this machine targeting the next release of Windows
|
||||
- **SystemWindowsActivationStatus** The total number of objects of this type present on this device.
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
|
||||
|
||||
@ -1511,7 +1511,7 @@ This event sends data about the current user's default preferences for browser a
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
|
||||
|
||||
|
||||
@ -2490,7 +2490,7 @@ The following fields are available:
|
||||
- **Enumerator** Identifies the bus that enumerated the device.
|
||||
- **HWID** A list of hardware IDs for the device. See [HWID](#hwid).
|
||||
- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
|
||||
- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
|
||||
- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx)
|
||||
- **InventoryVersion** The version number of the inventory process generating the events.
|
||||
- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device.
|
||||
- **LowerFilters** The identifiers of the Lower filters installed for the device.
|
||||
@ -2678,6 +2678,31 @@ The following fields are available:
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
|
||||
|
||||
This event provides basic information about active memory slots on the device.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Capacity** Memory size in bytes
|
||||
- **Manufacturer** Name of the DRAM manufacturer
|
||||
- **Model** Model and sub-model of the memory
|
||||
- **Slot** Slot to which the DRAM is plugged into the motherboard.
|
||||
- **Speed** The configured memory slot speed in MHz.
|
||||
- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2.
|
||||
- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync
|
||||
|
||||
This diagnostic event indicates a new sync is being generated for this object type.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -2696,84 +2721,6 @@ This event indicates that a new sync is being generated for this object type. Th
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
|
||||
|
||||
This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
|
||||
|
||||
This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
|
||||
|
||||
This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
|
||||
|
||||
This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
|
||||
|
||||
This event describes various Office settings. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
|
||||
|
||||
This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
|
||||
|
||||
This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -3173,20 +3120,20 @@ The following fields are available:
|
||||
- **PluginName** Name of the plugin specified for each generic plugin event.
|
||||
- **Reload** True if SIH reload is required.
|
||||
- **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started.
|
||||
- **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled.
|
||||
- **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists.
|
||||
- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran.
|
||||
- **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run.
|
||||
- **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network.
|
||||
- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in.
|
||||
- **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin.
|
||||
- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled.
|
||||
@ -3274,7 +3221,7 @@ The following fields are available:
|
||||
- **RemediationDUAKeyDeleteSucceeded** TRUE if the UninstallActive registry key was successfully deleted.
|
||||
- **RemediationDuplicateTokenSucceeded** TRUE if the user token was successfully duplicated.
|
||||
- **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully.
|
||||
- **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried.
|
||||
- **RemediationRanHibernation** TRUE if the system entered Hibernation.
|
||||
- **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded.
|
||||
@ -3416,7 +3363,7 @@ The following fields are available:
|
||||
- **DatetimeSyncPlugin** TRUE / FALSE depending on whether the DateTimeSync plug-in ran successfully.
|
||||
- **DiskCleanupPlugin** TRUE / FALSE depending on whether the DiskCleanup plug-in ran successfully.
|
||||
- **GlobalEventCounter** The client-side counter that indicates ordering of events.
|
||||
- **NoisyHammerPlugin** TRUE / FALSE depending on whether the NoisyHammer plug-in ran successfully.
|
||||
- **NoisyHammerPlugin** TRUE / FALSE depending on whether the Auto UA plug-in ran successfully.
|
||||
- **PackageVersion** The version number of the current remediation package.
|
||||
- **RebootRequiredPlugin** TRUE / FALSE depending on whether the Reboot plug-in ran successfully.
|
||||
- **RemediationNotifyUserFixIssuesPlugin** TRUE / FALSE depending on whether the User Fix Issues plug-in ran successfully
|
||||
@ -3583,133 +3530,6 @@ The following fields are available:
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings
|
||||
|
||||
This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CustomVer** The registry value for targeting.
|
||||
- **IsMetered** TRUE if the machine is on a metered network.
|
||||
- **LastVer** The version of the last successful run.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl
|
||||
|
||||
This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AttemptNumber** The count indicating which download attempt is starting.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.Error
|
||||
|
||||
This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **FailureType** The type of error encountered.
|
||||
- **FileName** The code file in which the error occurred.
|
||||
- **HResult** The failure error code.
|
||||
- **LineNumber** The line number in the code file at which the error occurred.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the validated EXE was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess
|
||||
|
||||
This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the successfully extracted content was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.NewUrlFound
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ProcessCreated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be executed.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.SelfUpdate
|
||||
|
||||
This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The major version number for the component.
|
||||
- **ServiceVersionMinor** The minor version number for the component.
|
||||
- **Time** The system timestamp for when the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.UrlState
|
||||
|
||||
This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Id** A number identifying the URL
|
||||
- **ServiceVersionMajor** Version info for the component
|
||||
- **ServiceVersionMinor** Version info for the component
|
||||
- **StateData** State-specific data, such as which attempt number for the download
|
||||
- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.)
|
||||
- **Time** System timestamp the event was fired
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed
|
||||
|
||||
This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date.
|
||||
@ -6417,6 +6237,78 @@ The following fields are available:
|
||||
- **wuDeviceid** The Windows Update device GUID.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete
|
||||
|
||||
This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that became complete.
|
||||
- **ResultId** The final result of the interaction campaign.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMICS.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit
|
||||
|
||||
This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **hrInitialize** Error, if any, that occurred while initializing OneSettings.
|
||||
- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch
|
||||
|
||||
This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMIH.
|
||||
- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation
|
||||
|
||||
This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.)
|
||||
- **Id** GUID passed in by the caller to identify the evaluation.
|
||||
- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation.
|
||||
- **Result** The overall result generated by the evaluation.
|
||||
|
||||
|
||||
## Windows Update mitigation events
|
||||
|
||||
### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 09/30/2020
|
||||
ms.date: 04/28/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
|
||||
@ -52,40 +52,40 @@ This event lists the types of objects and how many of each exist on the client d
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DatasourceApplicationFile_RS4** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **DatasourceDevicePnp_RS4** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_19H1Setup** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionSystemBios_19H1Setup** The total DecisionSystemBios objects targeting the next release of Windows on this device.
|
||||
- **DecisionSystemBios_RS4** The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device.
|
||||
- **InventoryApplicationFile** The count of the number of this particular object type present on this device.
|
||||
- **InventoryLanguagePack** The count of InventoryLanguagePack objects present on this machine.
|
||||
- **InventoryMediaCenter** The count of the number of this particular object type present on this device.
|
||||
- **InventorySystemBios** The count of the number of this particular object type present on this device.
|
||||
- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device.
|
||||
- **PCFP** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **SystemMemory** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS4** The total number of objects of this type present on this device.
|
||||
- **InventoryApplicationFile** The total number of objects of this type present on this device.
|
||||
- **InventoryLanguagePack** The total number of objects of this type present on this device.
|
||||
- **InventoryMediaCenter** The total number of objects of this type present on this device.
|
||||
- **InventorySystemBios** The total number of objects of this type present on this device.
|
||||
- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device.
|
||||
- **PCFP** The total number of objects of this type present on this device.
|
||||
- **SystemMemory** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorCompareExchange** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorLahfSahf** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorNx** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorPrefetchW** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorSse2** The count of SystemProcessorSse2 objects present on this machine.
|
||||
- **SystemTouch** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorSse2** The total number of objects of this type present on this device.
|
||||
- **SystemTouch** The total number of objects of this type present on this device.
|
||||
- **SystemWim** The total number of objects of this type present on this device.
|
||||
- **SystemWindowsActivationStatus** The count of the number of this particular object type present on this device.
|
||||
- **SystemWindowsActivationStatus** The total number of objects of this type present on this device.
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
|
||||
- **Wmdrm_RS4** The total number of objects of this type present on this device.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
|
||||
@ -1601,7 +1601,7 @@ This event sends data about the current user's default preferences for browser a
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
|
||||
|
||||
|
||||
@ -1963,6 +1963,15 @@ This event is fired by UTC at startup to signal what data we are allowed to coll
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CensusExitCode** Returns last execution codes from census client run.
|
||||
- **CensusStartTime** Returns timestamp corresponding to last successful census run.
|
||||
- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
|
||||
- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred.
|
||||
- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
|
||||
- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
|
||||
- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period.
|
||||
|
||||
|
||||
### TelClientSynthetic.HeartBeat_5
|
||||
@ -2512,7 +2521,7 @@ The following fields are available:
|
||||
- **Enumerator** Identifies the bus that enumerated the device.
|
||||
- **HWID** A list of hardware IDs for the device.
|
||||
- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
|
||||
- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
|
||||
- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx)
|
||||
- **InventoryVersion** The version number of the inventory process generating the events.
|
||||
- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device.
|
||||
- **LowerFilters** The identifiers of the Lower filters installed for the device.
|
||||
@ -2712,6 +2721,31 @@ The following fields are available:
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
|
||||
|
||||
This event provides basic information about active memory slots on the device.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Capacity** Memory size in bytes
|
||||
- **Manufacturer** Name of the DRAM manufacturer
|
||||
- **Model** Model and sub-model of the memory
|
||||
- **Slot** Slot to which the DRAM is plugged into the motherboard.
|
||||
- **Speed** The configured memory slot speed in MHz.
|
||||
- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2.
|
||||
- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync
|
||||
|
||||
This diagnostic event indicates a new sync is being generated for this object type.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -2765,237 +2799,6 @@ The following fields are available:
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
|
||||
|
||||
This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
|
||||
- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
|
||||
- **OMID** Identifier for the Office SQM Machine
|
||||
- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit
|
||||
- **OTenantId** Unique GUID representing the Microsoft O365 Tenant
|
||||
- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000
|
||||
- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
|
||||
|
||||
This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature.
|
||||
- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files.
|
||||
- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
|
||||
- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag
|
||||
- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request
|
||||
- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
|
||||
- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts
|
||||
- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords
|
||||
- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control
|
||||
- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted
|
||||
- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC)
|
||||
- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL
|
||||
- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior
|
||||
- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows
|
||||
- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
|
||||
|
||||
This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OfficeApplication** The name of the Office application.
|
||||
- **OfficeArchitecture** The bitness of the Office application.
|
||||
- **OfficeVersion** The version of the Office application.
|
||||
- **Value** The insights collected about this entity.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
|
||||
|
||||
This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OC2rApps** A GUID the describes the Office Click-To-Run apps
|
||||
- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
|
||||
- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
|
||||
- **OProductCodes** A GUID that describes the Office MSI products
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
|
||||
|
||||
This event describes various Office settings. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BrowserFlags** Browser flags for Office-related products.
|
||||
- **ExchangeProviderFlags** Office Exchange provider policies
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **SharedComputerLicensing** Office Shared Computer Licensing policies
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
|
||||
|
||||
This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Design** Count of files with design issues found
|
||||
- **Design_x64** Count of files with 64 bit design issues found
|
||||
- **DuplicateVBA** Count of files with duplicate VBA code
|
||||
- **HasVBA** Count of files with VBA code
|
||||
- **Inaccessible** Count of files that were inaccessible for scanning
|
||||
- **Issues** Count of files with issues detected
|
||||
- **Issues_x64** Count of files with 64-bit issues detected
|
||||
- **IssuesNone** Count of files with no issues detected
|
||||
- **IssuesNone_x64** Count of files with no 64-bit issues detected
|
||||
- **Locked** Count of files that were locked, preventing scanning
|
||||
- **NoVBA** Count of files with no VBA inside
|
||||
- **Protected** Count of files that were password protected, preventing scanning
|
||||
- **RemLimited** Count of files that require limited remediation changes
|
||||
- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues
|
||||
- **RemSignificant** Count of files that require significant remediation changes
|
||||
- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues
|
||||
- **Score** Overall compatibility score calculated for scanned content
|
||||
- **Score_x64** Overall 64-bit compatibility score calculated for scanned content
|
||||
- **Total** Total number of files scanned
|
||||
- **Validation** Count of files that require additional manual validation
|
||||
- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
|
||||
|
||||
This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Count** Count of total Microsoft Office VBA rule violations
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
|
||||
|
||||
This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
|
||||
|
||||
This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -3225,7 +3028,6 @@ The following fields are available:
|
||||
|
||||
- **winInetError** The HResult of the operation.
|
||||
|
||||
|
||||
## Privacy logging notification events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
|
||||
@ -3326,20 +3128,20 @@ The following fields are available:
|
||||
- **PluginName** Name of the plugin specified for each generic plugin event.
|
||||
- **Reload** True if SIH reload is required.
|
||||
- **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started.
|
||||
- **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled.
|
||||
- **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists.
|
||||
- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran.
|
||||
- **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run.
|
||||
- **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network.
|
||||
- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in.
|
||||
- **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin.
|
||||
- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled.
|
||||
@ -3461,7 +3263,7 @@ The following fields are available:
|
||||
- **RemediationHibernationMigrated** TRUE if hibernation was migrated.
|
||||
- **RemediationHibernationMigrationSucceeded** TRUE if hibernation migration succeeded.
|
||||
- **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully.
|
||||
- **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried.
|
||||
- **RemediationRanHibernation** TRUE if the system entered Hibernation.
|
||||
- **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded.
|
||||
@ -3571,133 +3373,6 @@ The event indicates progress made by the updater. This information assists in ke
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings
|
||||
|
||||
This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CustomVer** The registry value for targeting.
|
||||
- **IsMetered** TRUE if the machine is on a metered network.
|
||||
- **LastVer** The version of the last successful run.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl
|
||||
|
||||
This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AttemptNumber** The count indicating which download attempt is starting.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.Error
|
||||
|
||||
This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **FailureType** The type of error encountered.
|
||||
- **FileName** The code file in which the error occurred.
|
||||
- **HResult** The failure error code.
|
||||
- **LineNumber** The line number in the code file at which the error occurred.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the validated EXE was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess
|
||||
|
||||
This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the successfully extracted content was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.NewUrlFound
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ProcessCreated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be executed.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.SelfUpdate
|
||||
|
||||
This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The major version number for the component.
|
||||
- **ServiceVersionMinor** The minor version number for the component.
|
||||
- **Time** The system timestamp for when the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.UrlState
|
||||
|
||||
This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Id** A number identifying the URL
|
||||
- **ServiceVersionMajor** Version info for the component
|
||||
- **ServiceVersionMinor** Version info for the component
|
||||
- **StateData** State-specific data, such as which attempt number for the download
|
||||
- **StateNumber** A number identifying which state the URL is in (found, downloading, extracted, etc.)
|
||||
- **Time** System timestamp the event was fired
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed
|
||||
|
||||
This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date.
|
||||
@ -6724,6 +6399,78 @@ The following fields are available:
|
||||
- **wuDeviceid** The Windows Update device GUID.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete
|
||||
|
||||
This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that became complete.
|
||||
- **ResultId** The final result of the interaction campaign.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMICS.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit
|
||||
|
||||
This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **hrInitialize** Error, if any, that occurred while initializing OneSettings.
|
||||
- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch
|
||||
|
||||
This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMIH.
|
||||
- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation
|
||||
|
||||
This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.)
|
||||
- **Id** GUID passed in by the caller to identify the evaluation.
|
||||
- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation.
|
||||
- **Result** Overall result generated by the evaluation.
|
||||
|
||||
|
||||
## Windows Update mitigation events
|
||||
|
||||
### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
audience: ITPro
|
||||
ms.date: 09/30/2020
|
||||
ms.date: 04/28/2021
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Windows 10, version 2004 and Windows 10, version 20H2 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 basic diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
|
||||
@ -52,74 +52,74 @@ This event lists the types of objects and how many of each exist on the client d
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DatasourceApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **DatasourceApplicationFile_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDevicePnp_RS1** The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device.
|
||||
- **DatasourceDevicePnp_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDriverPackage_RS1** The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device.
|
||||
- **DatasourceDriverPackage_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS1** The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS1** The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS1** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_RS1** The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device.
|
||||
- **DatasourceSystemBios_RS3** The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device.
|
||||
- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_RS5Setup** The count of the number of this particular object type present on this device.
|
||||
- **DecisionApplicationFile_RS1** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **DecisionApplicationFile_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDevicePnp_RS1** The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device.
|
||||
- **DecisionDevicePnp_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDriverPackage_RS1** The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device.
|
||||
- **DecisionDriverPackage_RS3** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS1** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS1** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
|
||||
- **DecisionMatchingInfoPassive_RS3** The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device.
|
||||
- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS1** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS3** The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMediaCenter_RS1** The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device.
|
||||
- **DecisionMediaCenter_RS3** The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device.
|
||||
- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionSystemBios_RS1** The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device.
|
||||
- **DecisionSystemBios_RS3** The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device.
|
||||
- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device.
|
||||
- **DecisionSystemBios_RS5Setup** The count of the number of this particular object type present on this device.
|
||||
- **DecisionTest_RS1** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **InventoryApplicationFile** The count of the number of this particular object type present on this device.
|
||||
- **InventoryLanguagePack** The count of the number of this particular object type present on this device.
|
||||
- **InventoryMediaCenter** The count of the number of this particular object type present on this device.
|
||||
- **InventorySystemBios** The count of the number of this particular object type present on this device.
|
||||
- **InventoryTest** The count of the number of this particular object type present on this device.
|
||||
- **InventoryUplevelDriverPackage** The count of the number of this particular object type present on this device.
|
||||
- **PCFP** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **SystemMemory** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorCompareExchange** The count of the number of this particular object type present on this device.
|
||||
- **SystemProcessorLahfSahf** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionTest_RS1** The total number of objects of this type present on this device.
|
||||
- **InventoryApplicationFile** The total number of objects of this type present on this device.
|
||||
- **InventoryLanguagePack** The total number of objects of this type present on this device.
|
||||
- **InventoryMediaCenter** The total number of objects of this type present on this device.
|
||||
- **InventorySystemBios** The total number of objects of this type present on this device.
|
||||
- **InventoryTest** The total number of objects of this type present on this device.
|
||||
- **InventoryUplevelDriverPackage** The total number of objects of this type present on this device.
|
||||
- **PCFP** The total number of objects of this type present on this device.
|
||||
- **SystemMemory** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorCompareExchange** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorLahfSahf** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorNx** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorPrefetchW** The total number of objects of this type present on this device.
|
||||
- **SystemProcessorSse2** The total number of objects of this type present on this device.
|
||||
- **SystemTouch** The count of SystemTouch objects present on this machine.
|
||||
- **SystemTouch** The total number of objects of this type present on this device.
|
||||
- **SystemWim** The total number of objects of this type present on this device.
|
||||
- **SystemWindowsActivationStatus** The count of SystemWindowsActivationStatus objects present on this machine.
|
||||
- **SystemWindowsActivationStatus** The total number of objects of this type present on this device.
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS1** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **Wmdrm_RS3** An ID for the system, calculated by hashing hardware identifiers.
|
||||
- **Wmdrm_RS5** The count of the number of this particular object type present on this device.
|
||||
- **Wmdrm_RS1** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS3** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS5** The total number of objects of this type present on this device.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
|
||||
@ -1705,7 +1705,7 @@ This event sends data about the current user's default preferences for browser a
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **DefaultApp** The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultApp** The current user's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
|
||||
- **DefaultBrowserProgId** The ProgramId of the current user's default browser.
|
||||
|
||||
|
||||
@ -2288,21 +2288,6 @@ The following fields are available:
|
||||
- **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise.
|
||||
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartbeat_0
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CensusExitCode** Last exit code of the Census task.
|
||||
- **CensusStartTime** Time of last Census run.
|
||||
- **CensusTaskEnabled** True if Census is enabled, false otherwise.
|
||||
- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred.
|
||||
- **NetworkState** The network state of the device.
|
||||
- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period.
|
||||
- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period.
|
||||
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartBeat_0
|
||||
|
||||
This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date.
|
||||
@ -2312,10 +2297,10 @@ The following fields are available:
|
||||
- **CensusExitCode** Last exit code of the Census task.
|
||||
- **CensusStartTime** Time of last Census run.
|
||||
- **CensusTaskEnabled** True if Census is enabled, false otherwise.
|
||||
- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred.
|
||||
- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred.
|
||||
- **NetworkState** The network state of the device.
|
||||
- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period.
|
||||
- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period.
|
||||
- **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds.
|
||||
- **RestrictedNetworkTime** The total number of seconds with restricted network during this heartbeat period.
|
||||
|
||||
|
||||
### TelClientSynthetic.HeartBeat_5
|
||||
@ -3470,7 +3455,7 @@ The following fields are available:
|
||||
- **Enumerator** Identifies the bus that enumerated the device.
|
||||
- **HWID** A list of hardware IDs for the device.
|
||||
- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
|
||||
- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
|
||||
- **InstallState** The device installation state. For a list of values, see: [Device Install State](https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx)
|
||||
- **InventoryVersion** The version number of the inventory process generating the events.
|
||||
- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device.
|
||||
- **LowerFilters** The identifiers of the Lower filters installed for the device.
|
||||
@ -3675,6 +3660,23 @@ The following fields are available:
|
||||
- **StartTime** UTC date and time at which this event was sent.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
|
||||
|
||||
This event provides basic information about active memory slots on the device.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Capacity** Memory size in bytes
|
||||
- **Manufacturer** Name of the DRAM manufacturer
|
||||
- **Model** Model and sub-model of the memory
|
||||
- **Slot** Slot to which the DRAM is plugged into the motherboard.
|
||||
- **Speed** The configured memory slot speed in MHz.
|
||||
- **Type** Reports DDR as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2.
|
||||
- **TypeDetails** Reports Non-volatile as a bit flag enumeration per the DMTF SMBIOS standard version 3.3.0, section 7.18.3.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync
|
||||
|
||||
This diagnostic event indicates a new sync is being generated for this object type.
|
||||
@ -3738,241 +3740,6 @@ The following fields are available:
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
|
||||
|
||||
This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OAudienceData** Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
|
||||
- **OAudienceId** Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
|
||||
- **OMID** Identifier for the Office SQM Machine
|
||||
- **OPlatform** Whether the installed Microsoft Office product is 32-bit or 64-bit
|
||||
- **OTenantId** Unique GUID representing the Microsoft O365 Tenant
|
||||
- **OVersion** Installed version of Microsoft Office. For example, 16.0.8602.1000
|
||||
- **OWowMID** Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
|
||||
|
||||
This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OIeFeatureAddon** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature.
|
||||
- **OIeMachineLockdown** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files.
|
||||
- **OIeMimeHandling** Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
|
||||
- **OIeMimeSniffing** Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag
|
||||
- **OIeNoAxInstall** Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request
|
||||
- **OIeNoDownload** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
|
||||
- **OIeObjectCaching** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts
|
||||
- **OIePasswordDisable** Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords
|
||||
- **OIeSafeBind** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control
|
||||
- **OIeSecurityBand** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted
|
||||
- **OIeUncSaveCheck** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC)
|
||||
- **OIeValidateUrl** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL
|
||||
- **OIeWebOcPopup** Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior
|
||||
- **OIeWinRestrict** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows
|
||||
- **OIeZoneElevate** Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
|
||||
|
||||
This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OfficeApplication** The name of the Office application.
|
||||
- **OfficeArchitecture** The bitness of the Office application.
|
||||
- **OfficeVersion** The version of the Office application.
|
||||
- **Value** The insights collected about this entity.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
|
||||
|
||||
This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **OC2rApps** A GUID the describes the Office Click-To-Run apps
|
||||
- **OC2rSkus** Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
|
||||
- **OMsiApps** Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
|
||||
- **OProductCodes** A GUID that describes the Office MSI products
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
|
||||
|
||||
This event describes various Office settings. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BrowserFlags** Browser flags for Office-related products.
|
||||
- **ExchangeProviderFlags** Provider policies for Office Exchange.
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **SharedComputerLicensing** Office shared computer licensing policies.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
|
||||
|
||||
This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
|
||||
|
||||
This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Design** Count of files with design issues found
|
||||
- **Design_x64** Count of files with 64 bit design issues found
|
||||
- **DuplicateVBA** Count of files with duplicate VBA code
|
||||
- **HasVBA** Count of files with VBA code
|
||||
- **Inaccessible** Count of files that were inaccessible for scanning
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **Issues** Count of files with issues detected
|
||||
- **Issues_x64** Count of files with 64-bit issues detected
|
||||
- **IssuesNone** Count of files with no issues detected
|
||||
- **IssuesNone_x64** Count of files with no 64-bit issues detected
|
||||
- **Locked** Count of files that were locked, preventing scanning
|
||||
- **NoVBA** Count of files with no VBA inside
|
||||
- **Protected** Count of files that were password protected, preventing scanning
|
||||
- **RemLimited** Count of files that require limited remediation changes
|
||||
- **RemLimited_x64** Count of files that require limited remediation changes for 64-bit issues
|
||||
- **RemSignificant** Count of files that require significant remediation changes
|
||||
- **RemSignificant_x64** Count of files that require significant remediation changes for 64-bit issues
|
||||
- **Score** Overall compatibility score calculated for scanned content
|
||||
- **Score_x64** Overall 64-bit compatibility score calculated for scanned content
|
||||
- **Total** Total number of files scanned
|
||||
- **Validation** Count of files that require additional manual validation
|
||||
- **Validation_x64** Count of files that require additional manual validation for 64-bit issues
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
|
||||
|
||||
This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Count** Count of total Microsoft Office VBA rule violations
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
|
||||
|
||||
This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
|
||||
|
||||
This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
|
||||
|
||||
This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -4573,7 +4340,6 @@ The following fields are available:
|
||||
|
||||
- **winInetError** The HResult of the operation.
|
||||
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -4734,20 +4500,20 @@ The following fields are available:
|
||||
- **PluginName** Name of the plugin specified for each generic plugin event.
|
||||
- **Reload** True if SIH reload is required.
|
||||
- **RemediationNoisyHammerAcLineStatus** Indicates the AC Line Status of the device.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times hammer auto-started.
|
||||
- **RemediationNoisyHammerAutoStartCount** The number of times Auto UA auto-started.
|
||||
- **RemediationNoisyHammerCalendarTaskEnabled** Event that indicates Update Assistant Calendar Task is enabled.
|
||||
- **RemediationNoisyHammerCalendarTaskExists** Event that indicates an Update Assistant Calendar Task exists.
|
||||
- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount** Event that indicates calendar triggers are enabled in the task.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the most recent Noisy Hammer task ran.
|
||||
- **RemediationNoisyHammerDaysSinceLastTaskRunTime** The number of days since the Auto UA ran.
|
||||
- **RemediationNoisyHammerGetCurrentSize** Size in MB of the $GetCurrent folder.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the noisy hammer is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result of the last hammer task run.
|
||||
- **RemediationNoisyHammerIsInstalled** TRUE if the Auto UA is installed.
|
||||
- **RemediationNoisyHammerLastTaskRunResult** The result from the last Auto UA task run.
|
||||
- **RemediationNoisyHammerMeteredNetwork** TRUE if the machine is on a metered network.
|
||||
- **RemediationNoisyHammerTaskEnabled** Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** Indicates whether the Update Assistant Task (Noisy Hammer) exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerUAExitState** The code for the exit state of the Update Assistant (Noisy Hammer) task.
|
||||
- **RemediationNoisyHammerTaskEnabled** TRUE if the Auto UA task is enabled.
|
||||
- **RemediationNoisyHammerTaskExists** TRUE if the Auto UA task exists.
|
||||
- **RemediationNoisyHammerTaskTriggerEnabledCount** Indicates whether the task has the count trigger enabled.
|
||||
- **RemediationNoisyHammerUAExitCode** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUAExitState** The exit code of the Update Assistant.
|
||||
- **RemediationNoisyHammerUserLoggedIn** TRUE if there is a user logged in.
|
||||
- **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin.
|
||||
- **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled.
|
||||
@ -4870,7 +4636,7 @@ The following fields are available:
|
||||
- **RemediationHibernationMigrationSucceeded** TRUE if hibernation migration succeeded.
|
||||
- **RemediationImpersonateUserSucceeded** TRUE if the user was successfully impersonated.
|
||||
- **RemediationNoisyHammerTaskFixSuccessId** Indicates whether the Update Assistant task fix was successful.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the NoisyHammer task started successfully.
|
||||
- **RemediationNoisyHammerTaskKickOffIsSuccess** TRUE if the Auto UA task started successfully.
|
||||
- **RemediationQueryTokenSucceeded** TRUE if the user token was successfully queried.
|
||||
- **RemediationRanHibernation** TRUE if the system entered Hibernation.
|
||||
- **RemediationRevertToSystemSucceeded** TRUE if reversion to the system context succeeded.
|
||||
@ -4989,133 +4755,6 @@ The following fields are available:
|
||||
- **Time** The system time at which the phase chance occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.CheckingOneSettings
|
||||
|
||||
This event indicates the parameters that the Operating System Remediation System Service (OSRSS) uses for a secure ping to Microsoft to help ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CustomVer** The registry value for targeting.
|
||||
- **IsMetered** TRUE if the machine is on a metered network.
|
||||
- **LastVer** The version of the last successful run.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadingUrl
|
||||
|
||||
This event provides information about the URL from which the Operating System Remediation System Service (OSRSS) is attempting to download. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AttemptNumber** The count indicating which download attempt is starting.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.DownloadSuccess
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully download data from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which data was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.Error
|
||||
|
||||
This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **FailureType** The type of error encountered.
|
||||
- **FileName** The code file in which the error occurred.
|
||||
- **HResult** The failure error code.
|
||||
- **LineNumber** The line number in the code file at which the error occurred.
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExeSignatureValidated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) successfully validated the signature of an EXE from the indicated URL. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the validated EXE was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ExtractSuccess
|
||||
|
||||
This event indicates that the Operating System Remediation System Service (OSRSS) successfully extracted downloaded content. The information provided helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The URL from which the successfully extracted content was downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.NewUrlFound
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) succeeded in finding a new URL to download from. This helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be downloaded.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.ProcessCreated
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) created a new process to execute content downloaded from the indicated URL. This information helps ensure Windows is up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The Major version information of the component.
|
||||
- **ServiceVersionMinor** The Minor version information of the component.
|
||||
- **Time** The system time at which the event occurred.
|
||||
- **Url** The new URL from which content will be executed.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.SelfUpdate
|
||||
|
||||
This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **ServiceVersionMajor** The major version number for the component.
|
||||
- **ServiceVersionMinor** The minor version number for the component.
|
||||
- **Time** The system timestamp for when the event occurred.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.OSRSS.UrlState
|
||||
|
||||
This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Id** A number identifying the URL.
|
||||
- **ServiceVersionMajor** Version information for the component.
|
||||
- **ServiceVersionMinor** Version information for the component.
|
||||
- **StateData** State-specific data, such as the attempt number for the download.
|
||||
- **StateNumber** A number identifying the current state of the URL (for example, found, downloading, extracted).
|
||||
- **Time** System timestamp when the event was started.
|
||||
|
||||
|
||||
### Microsoft.Windows.Sediment.ServiceInstaller.AttemptingUpdate
|
||||
|
||||
This event indicates the Operating System Remediation System Service (OSRSS) installer is attempting an update to itself. This information helps ensure Windows is up to date.
|
||||
@ -5794,6 +5433,16 @@ The following fields are available:
|
||||
- **UpdateId** The update ID for a specific piece of content.
|
||||
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
|
||||
|
||||
## Surface events
|
||||
|
||||
### Microsoft.Surface.Battery.Prod.BatteryInfoEvent
|
||||
|
||||
This event includes the hardware level data about battery performance. The data collected with this event is used to help keep Windows products and services performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **pszBatteryDataXml** Battery performance data.
|
||||
- **szBatteryInfo** Battery performance data.
|
||||
|
||||
## Update Assistant events
|
||||
|
||||
@ -8373,6 +8022,92 @@ The following fields are available:
|
||||
- **wuDeviceid** The Windows Update device GUID.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICOInteractionCampaignComplete
|
||||
|
||||
This event is generated whenever a RUXIM user interaction campaign becomes complete. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that became complete.
|
||||
- **ResultId** The final result of the interaction campaign.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMICS.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncExit
|
||||
|
||||
This event is sent when RUXIM completes checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **hrInitialize** Error, if any, that occurred while initializing OneSettings.
|
||||
- **hrQuery** Error, if any, that occurred while retrieving UX interaction campaign data from OneSettings.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSOneSettingsSyncLaunch
|
||||
|
||||
This event is sent when RUXIM begins checking with OneSettings to retrieve any UX interaction campaigns that may need to be displayed. The data collected with this event is used to help keep Windows up to date.
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHEvaluateAndPresent
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler finishes evaluating, and possibly presenting an interaction campaign. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **hrLocal** The error (if any) encountered by RUXIM Interaction Handler during evaluation and presentation.
|
||||
- **hrPresentation** The error (if any) reported by RUXIM Presentation Handler during presentation.
|
||||
- **InteractionCampaignID** GUID; the user interaction campaign processed by RUXIM Interaction Handler.
|
||||
- **ResultId** The result generated by the evaluation and presentation.
|
||||
- **WasCompleted** True if the user interaction campaign is complete.
|
||||
- **WasPresented** True if the user interaction campaign is displayed to the user.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InteractionCampaignID** GUID identifying the interaction campaign that RUXIMIH processed.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.IHLaunch
|
||||
|
||||
This event is generated when the RUXIM Interaction Handler (RUXIMIH.EXE) is launched. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CommandLine** The command line used to launch RUXIMIH.
|
||||
- **InteractionCampaignID** GUID identifying the user interaction campaign that the Interaction Handler will process.
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.SystemEvaluator.Evaluation
|
||||
|
||||
This event is generated whenever the RUXIM Evaluator DLL performs an evaluation. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **HRESULT** Error, if any, that occurred during evaluation. (Note that if errors encountered during individual checks do not affect the overall result of the evaluation, those errors will be reported in NodeEvaluationData, but this HRESULT will still be zero.)
|
||||
- **Id** GUID passed in by the caller to identify the evaluation.
|
||||
- **NodeEvaluationData** Structure showing the results of individual checks that occurred during the overall evaluation.
|
||||
- **Result** Overall result generated by the evaluation.
|
||||
|
||||
|
||||
## Windows Update mitigation events
|
||||
|
||||
### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -15,7 +15,7 @@
|
||||
href: Microsoft-DiagnosticDataViewer.md
|
||||
- name: Required Windows diagnostic data events and fields
|
||||
items:
|
||||
- name: Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields
|
||||
- name: Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic data events and fields
|
||||
href: required-windows-diagnostic-data-events-and-fields-2004.md
|
||||
- name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields
|
||||
href: basic-level-windows-diagnostic-events-and-fields-1903.md
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user