Merge pull request #8310 from MicrosoftDocs/main

[Publish] Updates to Windows privacy content for May 2023 release
This commit is contained in:
Dan Brown 2023-05-23 09:18:19 -07:00 committed by GitHub
commit 2c51fa5f30
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 174 additions and 64 deletions

View File

@ -6,8 +6,8 @@ ms.technology: itpro-privacy
localizationpriority: high
author: DHB-MSFT
ms.author: danbrown
manager: dougeby
ms.date: 03/27/2017
manager: laurawi
ms.date: 05/23/2023
ms.topic: reference
---
@ -3375,7 +3375,7 @@ The following fields are available:
- **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network.
- **IsDeviceOobeBlocked** Indicates whether user approval is required to install updates on the device.
- **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device.
- **IsDeviceSccmManaged** Indicates whether the device is running the Configuration Manager to keep the operating system and applications up to date.
- **IsDeviceSccmManaged** Indicates whether the device is running Configuration Manager to keep the operating system and applications up to date.
- **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated.
- **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications.
- **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services).
@ -4249,7 +4249,7 @@ The following fields are available:
- **FlightId** The ID of the Windows Insider build the device received.
- **InstallDate** The date the driver was installed.
- **InstallFlags** The driver installation flags.
- **OptionalData** Metadata specific to Windows Update (WU) associated with the driver (flight IDs, recovery IDs, etc.)
- **OptionalData** Metadata specific to Windows Update associated with the driver (flight IDs, recovery IDs, etc.)
- **RebootRequired** Indicates whether a reboot is required after the installation.
- **RollbackPossible** Indicates whether this driver can be rolled back.
- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
@ -5026,33 +5026,6 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly.
The following fields are available:
- **AhaVersion** The binary version of the App Health Analyzer tool.
- **ApplicationErrors** The count of application errors from the event log.
- **Bitness** The architecture type of the application (16 Bit or 32 bit or 64 bit).
- **device_level** Various JRE/JAVA versions installed on a particular device.
- **ExtendedProperties** Attribute used for aggregating all other attributes under this event type.
- **Jar** Flag to determine if an app has a Java JAR file dependency.
- **Jre** Flag to determine if an app has JRE framework dependency.
- **Jre_version** JRE versions an app has declared framework dependency for.
- **Name** Name of the application.
- **NonDPIAware** Flag to determine if an app is non-DPI aware.
- **NumBinaries** Count of all binaries (.sys,.dll,.ini) from application install location.
- **RequiresAdmin** Flag to determine if an app requests admin privileges for execution.
- **RequiresAdminv2** Additional flag to determine if an app requests admin privileges for execution.
- **RequiresUIAccess** Flag to determine if an app is based on UI features for accessibility.
- **VB6** Flag to determine if an app is based on VB6 framework.
- **VB6v2** Additional flag to determine if an app is based on VB6 framework.
- **Version** Version of the application.
- **VersionCheck** Flag to determine if an app has a static dependency on OS version.
- **VersionCheckv2** Additional flag to determine if an app has a static dependency on OS version.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
This event provides basic information about active memory slots on the device.
@ -10124,4 +10097,4 @@ The following fields are available:
- **LicenseType** The type of licensed used to authorize the app (0 - Unknown, 1 - User, 2 - Subscription, 3 - Offline, 4 - Disc).
- **LicenseXuid** If the license type is 1 (User), this field contains the XUID (Xbox User ID) of the registered owner of the license.
- **ProductGuid** The Xbox product GUID (Globally-Unique ID) of the application.
- **UserId** The XUID (Xbox User ID) of the current user.
- **UserId** The XUID (Xbox User ID) of the current user.

View File

@ -7,8 +7,8 @@ ms.technology: itpro-privacy
localizationpriority: high
author: DHB-MSFT
ms.author: danbrown
manager: dougeby
ms.date: 08/26/2022
manager: laurawi
ms.date: 05/23/2023
ms.topic: reference
---
@ -108,6 +108,29 @@ The following fields are available:
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileBackupAdd
This event sends true/false compatibility decision data about a file to help keep Windows up to date.
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the appraiser binary generating the events.
- **SdbEntries** Indicates if any matching compat Sdb entries are associated with this application
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileBackupStartSync
This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date.
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the appraiser binary generating the events.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date.
@ -1269,7 +1292,6 @@ The following fields are available:
- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
- **xid** A list of base10-encoded XBOX User IDs.
## Common data fields
### Ms.Device.DeviceInventoryChange
@ -1284,6 +1306,7 @@ The following fields are available:
- **objectType** Indicates the object type that the event applies to.
- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
## Component-based servicing events
### CbsServicingProvider.CbsCapabilitySessionFinalize
@ -2246,6 +2269,18 @@ The following fields are available:
## Setup events
### Microsoft.Windows.Setup.WinSetupMon.ProtectionViolation
This event provides information about move or deletion of a file or a directory which is being monitored for data safety during feature updates. The data collected with this event is used to help keep Windows up to date.
The following fields are available:
- **Path** Path to the file or the directory which is being moved or deleted.
- **Process** Path to the process which is requesting the move or the deletion.
- **SessionId** Identifier to correlate this component's telemetry with that of others.
- **TargetPath** (Optional) If the operation is a move, the target path to which the file or directory is being moved.
### SetupPlatformTel.SetupPlatformTelEvent
This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date.
@ -3373,7 +3408,6 @@ The following fields are available:
This event is derived event results for the LaunchPageDuration scenario.
### Microsoft.Windows.Update.WUClient.DownloadPaused
This event is fired when the Download stage is paused.
@ -3448,4 +3482,7 @@ The following fields are available:
- **ScenarioSupported** Whether the updated scenario that was passed in was supported.
- **SessionId** The UpdateAgent “SessionId” value.
- **UpdateId** Unique identifier for the Update.
- **WuId** Unique identifier for the Windows Update client.
- **WuId** Unique identifier for the Windows Update client.

View File

@ -6,8 +6,8 @@ ms.technology: itpro-privacy
localizationpriority: high
author: DHB-MSFT
ms.author: danbrown
manager: dougeby
ms.date: 05/28/2020
manager: laurawi
ms.date: 05/23/2023
ms.collection: highpri
ms.topic: reference
---
@ -149,6 +149,29 @@ The following fields are available:
- **SdbEntries** An array of fields that indicates the SDB entries that apply to this file.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileBackupAdd
This event sends true/false compatibility decision data about a file to help keep Windows up to date.
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the appraiser binary generating the events.
- **SdbEntries** Indicates if any matching compat Sdb entries are associated with this application
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileBackupStartSync
This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date.
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
The following fields are available:
- **AppraiserVersion** The version of the appraiser binary generating the events.
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date.
@ -1455,7 +1478,7 @@ The following fields are available:
- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device.
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
@ -1860,7 +1883,7 @@ The following fields are available:
- **UpdateServiceURLConfigured** Retrieves if the device is managed by Windows Server Update Services (WSUS).
- **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates.
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update (WU) updates to other devices on the same network.
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update updates to other devices on the same network.
- **WULCUVersion** Version of the LCU Installed on the machine.
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
@ -2164,7 +2187,6 @@ The following fields are available:
- **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
- **xid** A list of base10-encoded XBOX User IDs.
## Common data fields
### Ms.Device.DeviceInventoryChange
@ -3432,12 +3454,6 @@ The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
This event provides basic information about active memory slots on the device.
@ -6274,6 +6290,7 @@ The following fields are available:
- **uptimeMinutes** Duration USO for up for in the current boot session.
- **wilActivity** Wil Activity related information.
### Microsoft.Windows.Update.WUClientExt.UUSLoadModuleFailed
This is the UUSLoadModule failed event and is used to track the failure of loading an undocked component. The data collected with this event is used to help keep Windows up to date and secure.
@ -6574,6 +6591,8 @@ The following fields are available:
This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date.
### Microsoft.Windows.UpdateReserveManager.TurnOffReserves
This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date.
@ -6599,4 +6618,4 @@ The following fields are available:
- **Disposition** The parameter for the hard reserve adjustment function.
- **Flags** The flags passed to the hard reserve adjustment function.
- **PendingHardReserveAdjustment** The final change to the hard reserve size.
- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve.
- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve.

View File

@ -6,8 +6,8 @@ ms.technology: itpro-privacy
localizationpriority: high
author: DHB-MSFT
ms.author: danbrown
manager: dougeby
ms.date: 05/28/2020
manager: laurawi
ms.date: 05/23/2023
ms.collection: highpri
ms.topic: reference
---
@ -393,7 +393,7 @@ The following fields are available:
- **DecisionSystemDiskSize_CO21H2Setup** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_CU22H2Setup** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_CU23H2Setup** The count of the number of this particular object type present on this device.
- **DecisionSystemDiskSize_NI22H2Setup** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_NI22H2Setup** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_RS1** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_RS2** The total number of objects of this type present on this device.
- **DecisionSystemDiskSize_RS3** The total number of objects of this type present on this device.
@ -2422,7 +2422,7 @@ The following fields are available:
- **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades.
- **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded Windows Update updates to other devices on the same network.
- **WULCUVersion** Version of the LCU Installed on the machine.
- **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier.
- **WUMachineId** Retrieves the Windows Update Machine Identifier.
- **WUPauseState** Retrieves Windows Update setting to determine if updates are paused.
- **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
@ -2474,7 +2474,6 @@ The following fields are available:
- **wilActivity** Contains the thread ID used to match the begin and end events, and for the end event also a HResult indicating sucess or failure.
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.HvciScanGetResultFailed
Fires when driver scanning fails to get results.
@ -3114,6 +3113,37 @@ The following fields are available:
## Direct to update events
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability
This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date.
The following fields are available:
- **ApplicabilityResult** Result of CheckApplicability function.
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
- **IsCTA** If device has the CTA regkey set.
- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the AAD (Azure Active Directory) domain.
- **IsDeviceADDomainJoined** Indicates whether the device is logged in to the AD (Active Directory) domain.
- **IsDeviceCloverTrail** Indicates whether the device has a Clover Trail system installed.
- **IsDeviceDiskSpaceLow** If device disk space is low.
- **IsDeviceEnterpriseSku** If device is an Enterprise SKU.
- **IsDeviceFeatureUpdatingPaused** Indicates whether Feature Update is paused on the device.
- **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network.
- **IsDeviceOobeBlocked** Indicates whether the OOBE (Out of Box Experience) is blocked on the device.
- **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device.
- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date.
- **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated.
- **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications.
- **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services).
- **IsDeviceWUFBManaged** If device is WUfB managed.
- **IsDeviceZeroExhaust** Indicates whether the device subscribes to the Zero Exhaust policy to minimize connections from Windows to Microsoft.
- **IsGreaterThanMaxRetry** Indicates whether the DTU (Direct to Update) service has exceeded its maximum retry count.
- **IsVolumeLicensed** Indicates whether a volume license was used to authenticate the operating system or applications on the device.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure
This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date.
@ -3190,6 +3220,19 @@ The following fields are available:
- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure
This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date.
The following fields are available:
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess
This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date.
@ -3253,6 +3296,18 @@ The following fields are available:
- **hResult** HRESULT of the failure.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess
This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date.
The following fields are available:
- **CampaignID** Campaign ID being run.
- **ClientID** Client ID being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack
This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date.
@ -3525,6 +3580,25 @@ The following fields are available:
- **State** State of the workflow.
### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEvaluation
This event indicates that Applicability DLL ran a set of applicability tests. The data collected with this event is used to help keep Windows up to date and performing properly.
The following fields are available:
- **Action** The enumeration code of action that was handled.
- **ActiveTestExpectedResults** Bitmask of expected results of applicability tests.
- **ActiveTestResults** The bitmask results of applicability tests.
- **ActiveTestsRun** The bitmask of applicability tests that were run.
- **CampaignID** The ID of the campaign being run.
- **ClientID** The ID of the client being run.
- **CoordinatorVersion** The coordinator version of Direct To Update.
- **CV** Correlation vector.
- **FullTestResults** The bitmask of results of applicability tests.
- **FullTestsRun** The bitmask of applicability tests that were run.
- **SuppressedTests** The bitmask of applicability tests that were unable to run due to suppression caused by the configuration settings.
### Microsoft.Windows.DirectToUpdate.DTUNotificationUXEvaluationError
This event indicates that Applicability DLL failed on a test. The data collected with this event is used to help keep Windows up to date and performing properly.
@ -3539,6 +3613,20 @@ The following fields are available:
- **HRESULT** An error (if any) that occurred.
### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExit
This event indicates that DTUNotificationUX has finished execution. The data collected with this event is used to help keep Windows up to date and performing properly.
The following fields are available:
- **CampaignID** The ID of the campaign being run.
- **ClientID** The ID of the client being run.
- **CoordinatorVersion** Coordinator version of DTU.
- **CV** Correlation vector.
- **HRESULTCausingExit** HRESULT Causing an abnormal exit, or S_OK for normal exits.
- **ProcessExitCode** The exit code that DTUNotificationUX returns to DTUCoordinator.
### Microsoft.Windows.DirectToUpdate.DTUNotificationUXExitingState
This event indicates that DTUNotificationUX has stopped processing a workflow state. The data collected with this event is used to help keep Windows up to date and performing properly.
@ -3753,7 +3841,7 @@ The following fields are available:
- **FlightId** The ID of the Windows Insider build the device received.
- **InstallDate** The date the driver was installed.
- **InstallFlags** The driver installation flags.
- **OptionalData** Metadata specific to Windows Update (WU) associated with the driver (flight IDs, recovery IDs, etc.)
- **OptionalData** Metadata specific to Windows Update associated with the driver (flight IDs, recovery IDs, etc.)
- **RebootRequired** Indicates whether a reboot is required after the installation.
- **RollbackPossible** Indicates whether this driver can be rolled back.
- **WuTargetedHardwareId** Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
@ -4710,12 +4798,6 @@ The following fields are available:
- **InventoryVersion** The version of the inventory file generating the events.
### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly.
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd
This event provides basic information about active memory slots on the device.
@ -8722,7 +8804,6 @@ The following fields are available:
- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics.
### Microsoft.Windows.Update.Orchestrator.DeferRestart
This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date.
@ -9012,7 +9093,7 @@ The following fields are available:
- **updaterCmdLine** The command line requested by the updater.
- **updaterId** The ID of the updater that requested the work.
- **wuDeviceid** Windows Update device ID.
- **wuDeviceid** Windows Update device ID.
### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkNonSystem
@ -9359,7 +9440,7 @@ The following fields are available:
- **PresentationCount** Number of times the interaction campaign has been presented.
- **ResultId** The result ID currently recorded for the interaction campaign.
- **StateCreationTime** Time the state was created.
- **StateModificationTime** Time the state was last modified.
- **StateModificationTime** Time the state was last modified.
- **ThrottlingRoll** Randomly generated throttling roll for the interaction campaign.