From 5796bfb7ec4f9dfd9667c0058709800e999c432b Mon Sep 17 00:00:00 2001 From: skycommand Date: Thu, 24 Sep 2020 11:50:11 +0330 Subject: [PATCH 01/82] Script improvements - Script: Marked each snippet as "PowerShell" instead of plain text. Both GitHub and Microsoft Docs can highlight PowerShell syntax. - Script: Added `#Requires -RunAsAdministrator` because the `Mount-WindowsImage` cmdlet needs it. - Script: Eliminated the path-concatenating code-spaghetti. A mixture of different string-concatenating features was used alongside `Join-Path`! As a result, reading, interpreting, and adopting the path section of the script was a total nightmare. - Script: Replaced all instances of "Write-Host" with "Write-Output". This is a serious change, as PowerShell scripts do not always run attended. Per PowerShell guidelines, `Write-Host` is a last-resort cmdlet. Where possible, `Write-Output` should be used instead. - Script: Changed `"{0:HH:mm:ss}" -f (Get-Date)` into `return "{0:HH:mm:ss}" -f [DateTime]::Now`. It seems not everyone knows that Get-Date's output can be customized, and not always via its parameters. Hence, the former could have unintended consequences. It is also possible to write `Get-Date -Format "HH:mm:ss"` which is neither superior nor inferior. (Well, maybe it costs a few more CPU ticks.) - Markdown Linter: Replaced inline HTML with Markdown - Markdown Linter: Inserted the missing line breaks before each heading --- .../deployment/update/media-dynamic-update.md | 158 +++++++++--------- 1 file changed, 81 insertions(+), 77 deletions(-) diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 8af36e4df1..15715aaf19 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -18,7 +18,7 @@ ms.topic: article **Applies to**: Windows 10 -This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images prior to deployment and includes Windows PowerShell scripts you can use to automate this process. +This topic explains how to acquire and apply Dynamic Update packages to existing Windows 10 images *prior to deployment* and includes Windows PowerShell scripts you can use to automate this process. Volume-licensed media is available for each release of Windows 10 in the Volume Licensing Service Center (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. You can use Dynamic Update to ensure that Windows 10 devices have the latest feature update packages as part of an in-place upgrade while preserving language pack and Features on Demand (FODs) that might have been previously installed. Dynamic Update also eliminates the need to install a separate quality update as part of the in-place upgrade process. @@ -42,8 +42,7 @@ You can obtain Dynamic Update packages from the [Microsoft Update Catalog](https ![Table with columns labeled Title, Products, Classification, Last Updated, Version, and Size and four rows listing various dynamic updates and associated KB articles](images/update-catalog.png) -The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in bold the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. - +The various Dynamic Update packages might not all be present in the results from a single search, so you might have to search with different keywords to find all of the updates. And you'll need to check various parts of the results to be sure you've identified the needed files. This table shows in **bold** the key items to search for or look for in the results. For example, to find the relevant "Setup Dynamic Update," you'll have to check the detailed description for the download by selecting the link in the **Title** column of the search results. |To find this Dynamic Update packages, search for or check the results here--> |Title |Product |Description (select the **Title** link to see **Details**) | |---------|---------|---------|---------| @@ -96,7 +95,6 @@ Optional Components, along with the .Net feature, can be installed offline, howe These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages is stored locally in this folder structure: - |Folder |Description | |---------|---------| |C:\mediaRefresh | Parent folder that contains the PowerShell script | @@ -107,50 +105,52 @@ These examples are for illustration only, and therefore lack error handling. The The script starts by declaring global variables and creating folders to use for mounting images. Then, make a copy of the original media, from \oldMedia to \newMedia, keeping the original media in case there is a script error and it's necessary to start over from a known state. Also, it will provide a comparison of old versus new media to evaluate changes. To ensure that the new media updates, make sure they are not read-only. -``` -function Get-TS { return "{0:HH:mm:ss}" -f (Get-Date) } +``` PowerShell +#Requires -RunAsAdministrator -Write-Host "$(Get-TS): Starting media refresh" +function Get-TS { return "{0:HH:mm:ss}" -f [DateTime]::Now } -# Declare media for FOD and LPs -$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" -$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" +Write-Output "$(Get-TS): Starting media refresh" # Declare language for showcasing adding optional localized components -$LANG = "ja-jp" +$LANG = "ja-jp" $LANG_FONT_CAPABILITY = "jpan" +# Declare media for FOD and LPs +$FOD_ISO_PATH = "C:\mediaRefresh\packages\FOD-PACKAGES_OEM_PT1_amd64fre_MULTI.iso" +$LP_ISO_PATH = "C:\mediaRefresh\packages\CLIENTLANGPACKDVD_OEM_MULTI.iso" + # Declare Dynamic Update packages -$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" -$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" -$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" +$LCU_PATH = "C:\mediaRefresh\packages\LCU.msu" +$SSU_PATH = "C:\mediaRefresh\packages\SSU_DU.msu" +$SETUP_DU_PATH = "C:\mediaRefresh\packages\Setup_DU.cab" $SAFE_OS_DU_PATH = "C:\mediaRefresh\packages\SafeOS_DU.cab" -$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" +$DOTNET_CU_PATH = "C:\mediaRefresh\packages\DotNet_CU.msu" # Declare folders for mounted images and temp files -$WORKING_PATH = "C:\mediaRefresh\temp" -$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" -$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" -$MAIN_OS_MOUNT = $WORKING_PATH + "\MainOSMount" -$WINRE_MOUNT = $WORKING_PATH + "\WinREMount" -$WINPE_MOUNT = $WORKING_PATH + "\WinPEMount" +$MEDIA_OLD_PATH = "C:\mediaRefresh\oldMedia" +$MEDIA_NEW_PATH = "C:\mediaRefresh\newMedia" +$WORKING_PATH = "C:\mediaRefresh\temp" +$MAIN_OS_MOUNT = "C:\mediaRefresh\temp\MainOSMount" +$WINRE_MOUNT = "C:\mediaRefresh\temp\WinREMount" +$WINPE_MOUNT = "C:\mediaRefresh\temp\WinPEMount" # Mount the language pack ISO -Write-Host "$(Get-TS): Mounting LP ISO" +Write-Output "$(Get-TS): Mounting LP ISO" $LP_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter # Declare language related cabs -$WINPE_OC_PATH = Join-Path $LP_ISO_DRIVE_LETTER":" -ChildPath "Windows Preinstallation Environment" | Join-Path -ChildPath "x64" | Join-Path -ChildPath "WinPE_OCs" -$WINPE_OC_LANG_PATH = Join-Path $WINPE_OC_PATH $LANG -$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -name -$WINPE_OC_LP_PATH = Join-Path $WINPE_OC_LANG_PATH "lp.cab" -$WINPE_FONT_SUPPORT_PATH = Join-Path $WINPE_OC_PATH "WinPE-FontSupport-$LANG.cab" -$WINPE_SPEECH_TTS_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS.cab" -$WINPE_SPEECH_TTS_LANG_PATH = Join-Path $WINPE_OC_PATH "WinPE-Speech-TTS-$LANG.cab" -$OS_LP_PATH = $LP_ISO_DRIVE_LETTER + ":\x64\langpacks\" + "Microsoft-Windows-Client-Language-Pack_x64_" + $LANG + ".cab" +$WINPE_OC_PATH = "$LP_ISO_DRIVE_LETTER`:\Windows Preinstallation Environment\x64\WinPE_OCs" +$WINPE_OC_LANG_PATH = "$WINPE_OC_PATH\$LANG" +$WINPE_OC_LANG_CABS = Get-ChildItem $WINPE_OC_LANG_PATH -Name +$WINPE_OC_LP_PATH = "$WINPE_OC_LANG_PATH\lp.cab" +$WINPE_FONT_SUPPORT_PATH = "$WINPE_OC_PATH\WinPE-FontSupport-$LANG.cab" +$WINPE_SPEECH_TTS_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS.cab" +$WINPE_SPEECH_TTS_LANG_PATH = "$WINPE_OC_PATH\WinPE-Speech-TTS-$LANG.cab" +$OS_LP_PATH = "$LP_ISO_DRIVE_LETTER`:\x64\langpacks\Microsoft-Windows-Client-Language-Pack_x64_$LANG.cab" # Mount the Features on Demand ISO -Write-Host "$(Get-TS): Mounting FOD ISO" +Write-Output "$(Get-TS): Mounting FOD ISO" $FOD_ISO_DRIVE_LETTER = (Mount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Get-Volume).DriveLetter $FOD_PATH = $FOD_ISO_DRIVE_LETTER + ":\" @@ -161,10 +161,11 @@ New-Item -ItemType directory -Path $WINRE_MOUNT -ErrorAction stop | Out-Null New-Item -ItemType directory -Path $WINPE_MOUNT -ErrorAction stop | Out-Null # Keep the original media, make a copy of it for the new, updateed media. -Write-Host "$(Get-TS): Copying original media to new media path" +Write-Output "$(Get-TS): Copying original media to new media path" Copy-Item -Path $MEDIA_OLD_PATH"\*" -Destination $MEDIA_NEW_PATH -Force -Recurse -ErrorAction stop | Out-Null Get-ChildItem -Path $MEDIA_NEW_PATH -Recurse | Where-Object { -not $_.PSIsContainer -and $_.IsReadOnly } | ForEach-Object { $_.IsReadOnly = $false } ``` + ### Update WinRE The script assumes that only a single edition is being updated, indicated by Index = 1 (Windows 10 Education Edition). Then the script mounts the image, saves Winre.wim to the working folder, and mounts it. It then applies servicing stack Dynamic Update, since its s are used for updating other s. Since the script is optionally adding Japanese, it adds the language pack to the image, and installs the Japanese versions of all optional packages already installed in Winre.wim. Then, it applies the Safe OS Dynamic Update package. @@ -174,27 +175,27 @@ It finishes by cleaning and exporting the image to reduce the image size. > [!NOTE] > Skip adding the latest cumulative update to Winre.wim because it contains unnecessary s in the recovery environment. The s that are updated and applicable are contained in the safe operating system Dynamic Update package. This also helps to keep the image small. -``` +``` PowerShell # Mount the main operating system, used throughout the script -Write-Host "$(Get-TS): Mounting main OS" +Write-Output "$(Get-TS): Mounting main OS" Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\install.wim" -Index 1 -Path $MAIN_OS_MOUNT -ErrorAction stop| Out-Null # # update Windows Recovery Environment (WinRE) # Copy-Item -Path $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Destination $WORKING_PATH"\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Mounting WinRE" +Write-Output "$(Get-TS): Mounting WinRE" Mount-WindowsImage -ImagePath $WORKING_PATH"\winre.wim" -Index 1 -Path $WINRE_MOUNT -ErrorAction stop | Out-Null # Add servicing stack update -Write-Host "$(Get-TS): Adding package $SSU_PATH" +Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # # Optional: Add the language to recovery environment # # Install lp.cab cab -Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" +Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed @@ -210,7 +211,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -219,7 +220,7 @@ Foreach ($PACKAGE in $WINRE_INSTALLED_OC) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -227,35 +228,36 @@ if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } # Add Safe OS -Write-Host "$(Get-TS): Adding package $SAFE_OS_DU_PATH" -Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null +Write-Output "$(Get-TS): Adding package $SAFE_OS_DU_PATH" +Add-WindowsPackage -Path $WINRE_MOUNT -PackagePath $SAFE_OS_DU_PATH -ErrorAction stop | Out-Null # Perform image cleanup -Write-Host "$(Get-TS): Performing image cleanup on WinRE" +Write-Output "$(Get-TS): Performing image cleanup on WinRE" DISM /image:$WINRE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # Dismount Dismount-WindowsImage -Path $WINRE_MOUNT -Save -ErrorAction stop | Out-Null # Export -Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim" +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\winre2.wim" Export-WindowsImage -SourceImagePath $WORKING_PATH"\winre.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\winre2.wim" -ErrorAction stop | Out-Null Move-Item -Path $WORKING_PATH"\winre2.wim" -Destination $WORKING_PATH"\winre.wim" -Force -ErrorAction stop | Out-Null ``` + ### Update WinPE This script is similar to the one that updates WinRE, but instead it mounts Boot.wim, applies the packages with the latest cumulative update last, and saves. It repeats this for all images inside of Boot.wim, typically two images. It starts by applying the servicing stack Dynamic Update. Since the script is customizing this media with Japanese, it installs the language pack from the WinPE folder on the language pack ISO. Additionally, add font support and text to speech (TTS) support. Since the script is adding a new language, it rebuilds lang.ini, used to identify languages installed in the image. Finally, it cleans and exports Boot.wim, and copies it back to the new media. -``` +``` PowerShell # # update Windows Preinstallation Environment (WinPE) # @@ -266,15 +268,15 @@ $WINPE_IMAGES = Get-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" Foreach ($IMAGE in $WINPE_IMAGES) { # update WinPE - Write-Host "$(Get-TS): Mounting WinPE" + Write-Output "$(Get-TS): Mounting WinPE" Mount-WindowsImage -ImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -Index $IMAGE.ImageIndex -Path $WINPE_MOUNT -ErrorAction stop | Out-Null # Add SSU - Write-Host "$(Get-TS): Adding package $SSU_PATH" + Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # Install lp.cab cab - Write-Host "$(Get-TS): Adding package $WINPE_OC_LP_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_OC_LP_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_OC_LP_PATH -ErrorAction stop | Out-Null # Install language cabs for each optional package installed @@ -291,7 +293,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { $OC_CAB = $PACKAGE.PackageName.Substring(0, $INDEX) + "_" + $LANG + ".cab" if ($WINPE_OC_LANG_CABS.Contains($OC_CAB)) { $OC_CAB_PATH = Join-Path $WINPE_OC_LANG_PATH $OC_CAB - Write-Host "$(Get-TS): Adding package $OC_CAB_PATH" + Write-Output "$(Get-TS): Adding package $OC_CAB_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $OC_CAB_PATH -ErrorAction stop | Out-Null } } @@ -300,7 +302,7 @@ Foreach ($IMAGE in $WINPE_IMAGES) { # Add font support for the new language if ( (Test-Path -Path $WINPE_FONT_SUPPORT_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_FONT_SUPPORT_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_FONT_SUPPORT_PATH -ErrorAction stop | Out-Null } @@ -308,39 +310,40 @@ Foreach ($IMAGE in $WINPE_IMAGES) { if (Test-Path -Path $WINPE_SPEECH_TTS_PATH) { if ( (Test-Path -Path $WINPE_SPEECH_TTS_LANG_PATH) ) { - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_PATH -ErrorAction stop | Out-Null - Write-Host "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" + Write-Output "$(Get-TS): Adding package $WINPE_SPEECH_TTS_LANG_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $WINPE_SPEECH_TTS_LANG_PATH -ErrorAction stop | Out-Null } } # Generates a new Lang.ini file which is used to define the language packs inside the image if ( (Test-Path -Path $WINPE_MOUNT"\sources\lang.ini") ) { - Write-Host "$(Get-TS): Updating lang.ini" + Write-Output "$(Get-TS): Updating lang.ini" DISM /image:$WINPE_MOUNT /Gen-LangINI /distribution:$WINPE_MOUNT | Out-Null - } + } # Add latest cumulative update - Write-Host "$(Get-TS): Adding package $LCU_PATH" + Write-Output "$(Get-TS): Adding package $LCU_PATH" Add-WindowsPackage -Path $WINPE_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Perform image cleanup - Write-Host "$(Get-TS): Performing image cleanup on WinPE" + Write-Output "$(Get-TS): Performing image cleanup on WinPE" DISM /image:$WINPE_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # Dismount Dismount-WindowsImage -Path $WINPE_MOUNT -Save -ErrorAction stop | Out-Null #Export WinPE - Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim" + Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\boot2.wim" Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\boot.wim" -SourceIndex $IMAGE.ImageIndex -DestinationImagePath $WORKING_PATH"\boot2.wim" -ErrorAction stop | Out-Null } Move-Item -Path $WORKING_PATH"\boot2.wim" -Destination $MEDIA_NEW_PATH"\sources\boot.wim" -Force -ErrorAction stop | Out-Null ``` + ### Update the main operating system For this next phase, there is no need to mount the main operating system, since it was already mounted in the previous scripts. This script starts by applying the servicing stack Dynamic Update. Then, it adds Japanese language support and then the Japanese language features. Unlike the Dynamic Update packages, it leverages `Add-WindowsCapability` to add these features. For a full list of such features, and their associated capability name, see [Available Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod). @@ -349,42 +352,42 @@ Now is the time to enable other Optional Components or add other Features on Dem You can install Optional Components, along with the .Net feature, offline, but that will require the device to be restarted. This is why the script installs .Net and Optional Components after cleanup and before export. -``` +``` PowerShell # # update Main OS # # Add servicing stack update -Write-Host "$(Get-TS): Adding package $SSU_PATH" +Write-Output "$(Get-TS): Adding package $SSU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $SSU_PATH -ErrorAction stop | Out-Null # Optional: Add language to main OS -Write-Host "$(Get-TS): Adding package $OS_LP_PATH" +Write-Output "$(Get-TS): Adding package $OS_LP_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $OS_LP_PATH -ErrorAction stop | Out-Null # Optional: Add a Features on Demand to the image -Write-Host "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Fonts.Jpan~~~und-JPAN~0.0.1.0" Add-WindowsCapability -Name "Language.Fonts.$LANG_FONT_CAPABILITY~~~und-$LANG_FONT_CAPABILITY~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Basic~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Basic~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.OCR~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.OCR~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.Handwriting~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Handwriting~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD: Language.TextToSpeech~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.TextToSpeech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" +Write-Output "$(Get-TS): Adding language FOD:Language.Speech~~~$LANG~0.0.1.0" Add-WindowsCapability -Name "Language.Speech~~~$LANG~0.0.1.0" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null # Note: If I wanted to enable additional Features on Demand, I'd add these here. # Add latest cumulative update -Write-Host "$(Get-TS): Adding package $LCU_PATH" +Write-Output "$(Get-TS): Adding package $LCU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop | Out-Null # Copy our updated recovery image from earlier into the main OS @@ -393,7 +396,7 @@ Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $LCU_PATH -ErrorAction stop Copy-Item -Path $WORKING_PATH"\winre.wim" -Destination $MAIN_OS_MOUNT"\windows\system32\recovery\winre.wim" -Force -Recurse -ErrorAction stop | Out-Null # Perform image cleanup -Write-Host "$(Get-TS): Performing image cleanup on main OS" +Write-Output "$(Get-TS): Performing image cleanup on main OS" DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # @@ -402,18 +405,18 @@ DISM /image:$MAIN_OS_MOUNT /cleanup-image /StartComponentCleanup | Out-Null # the image to be booted, and thus if we tried to cleanup after installation, it would fail. # -Write-Host "$(Get-TS): Adding NetFX3~~~~" +Write-Output "$(Get-TS): Adding NetFX3~~~~" Add-WindowsCapability -Name "NetFX3~~~~" -Path $MAIN_OS_MOUNT -Source $FOD_PATH -ErrorAction stop | Out-Null # Add .Net Cumulative Update -Write-Host "$(Get-TS): Adding package $DOTNET_CU_PATH" +Write-Output "$(Get-TS): Adding package $DOTNET_CU_PATH" Add-WindowsPackage -Path $MAIN_OS_MOUNT -PackagePath $DOTNET_CU_PATH -ErrorAction stop | Out-Null # Dismount Dismount-WindowsImage -Path $MAIN_OS_MOUNT -Save -ErrorAction stop | Out-Null # Export -Write-Host "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim" +Write-Output "$(Get-TS): Exporting image to $WORKING_PATH\install2.wim" Export-WindowsImage -SourceImagePath $MEDIA_NEW_PATH"\sources\install.wim" -SourceIndex 1 -DestinationImagePath $WORKING_PATH"\install2.wim" -ErrorAction stop | Out-Null Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sources\install.wim" -Force -ErrorAction stop | Out-Null ``` @@ -422,20 +425,21 @@ Move-Item -Path $WORKING_PATH"\install2.wim" -Destination $MEDIA_NEW_PATH"\sourc This part of the script updates the Setup files. It simply copies the individual files in the Setup Dynamic Update package to the new media. This step brings an updated Setup.exe as needed, along with the latest compatibility database, and replacement component manifests. -``` +``` PowerShell # # update remaining files on media # # Add Setup DU by copy the files from the package into the newMedia -Write-Host "$(Get-TS): Adding package $SETUP_DU_PATH" +Write-Output "$(Get-TS): Adding package $SETUP_DU_PATH" cmd.exe /c $env:SystemRoot\System32\expand.exe $SETUP_DU_PATH -F:* $MEDIA_NEW_PATH"\sources" | Out-Null ``` + ### Finish up As a last step, the script removes the working folder of temporary files, and unmounts our language pack and Features on Demand ISOs. -``` +``` PowerShell # # Perform final cleanup # @@ -444,9 +448,9 @@ As a last step, the script removes the working folder of temporary files, and un Remove-Item -Path $WORKING_PATH -Recurse -Force -ErrorAction stop | Out-Null # Dismount ISO images -Write-Host "$(Get-TS): Dismounting ISO images" +Write-Output "$(Get-TS): Dismounting ISO images" Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null -Write-Host "$(Get-TS): Media refresh completed!" +Write-Output "$(Get-TS): Media refresh completed!" ``` From 4afe4ea26d4f8f5e2423149fe260e32bed085016 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Tue, 29 Sep 2020 20:14:17 +0100 Subject: [PATCH 02/82] updated privacy event files --- ...ndows-diagnostic-events-and-fields-1703.md | 667 ++--- ...ndows-diagnostic-events-and-fields-1709.md | 705 +++--- ...ndows-diagnostic-events-and-fields-1803.md | 1033 ++++---- ...ndows-diagnostic-events-and-fields-1809.md | 1401 +++++++---- ...ndows-diagnostic-events-and-fields-1903.md | 2172 +++++++++-------- ...-diagnostic-data-events-and-fields-2004.md | 186 +- 6 files changed, 3542 insertions(+), 2622 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index fc3ba2d75a..fa4db33c8a 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/29/2020 ms.reviewer: --- @@ -47,7 +47,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -81,7 +81,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -This event sends compatibility information about a file to help keep Windows up-to-date. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -97,7 +97,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -108,7 +108,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -136,7 +136,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -147,7 +147,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -167,7 +167,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +178,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -198,7 +198,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -209,7 +209,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -229,7 +229,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -240,7 +240,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -260,7 +260,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -271,7 +271,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -292,7 +292,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -303,7 +303,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -341,7 +341,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -352,7 +352,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -386,7 +386,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -397,7 +397,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -This event indicates that the DecisionDevicePnp object is no longer present. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -422,7 +422,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -433,7 +433,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,7 +459,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -470,7 +470,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -492,7 +492,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -503,7 +503,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -527,7 +527,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -538,7 +538,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -564,7 +564,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -575,7 +575,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -619,7 +619,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning -This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. +This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -643,7 +643,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -666,7 +666,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -677,7 +677,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -710,7 +710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -737,7 +737,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -748,7 +748,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -759,7 +759,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -772,7 +772,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -783,7 +783,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -794,7 +794,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -819,7 +819,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -830,7 +830,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -841,7 +841,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -871,7 +871,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -882,7 +882,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -904,7 +904,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -915,7 +915,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -937,7 +937,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -948,7 +948,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -971,7 +971,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +982,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1004,7 +1004,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1015,7 +1015,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1037,7 +1037,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1048,7 +1048,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1070,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1081,7 +1081,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1103,7 +1103,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1114,7 +1114,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1136,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1147,7 +1147,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1173,7 +1173,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1184,7 +1184,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1247,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1258,7 +1258,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1271,7 +1271,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1281,7 +1281,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1292,19 +1292,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1321,14 +1311,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. - **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier. ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1340,7 +1330,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1355,7 +1345,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1391,7 +1381,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1401,7 +1391,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1424,7 +1414,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1456,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1482,13 +1472,13 @@ The following fields are available: ### Census.Security -Provides information on several important data points about security settings. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1505,7 +1495,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1516,7 +1506,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1526,7 +1516,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1548,7 +1538,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1551,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1574,7 +1564,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1769,7 +1759,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. @@ -1868,7 +1858,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1887,7 +1877,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1906,7 +1896,7 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2168,7 +2158,7 @@ The following fields are available: ### ChecksumDictionary -The list of values sent by each object type. +This event provides the list of values sent by each object type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2178,7 +2168,7 @@ The following fields are available: ### COMPID -This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. +This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2188,7 +2178,7 @@ The following fields are available: ### HWID -This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. +This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2198,7 +2188,7 @@ The following fields are available: ### InstallDateArpLastModified -This event indicates the date the add/remove program (ARP) entry was last modified by an update. +This event indicates the date the add/remove program (ARP) entry was last modified by an update. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2208,7 +2198,7 @@ The following fields are available: ### InstallDateFromLinkFile -This event provides the application installation date from the linked file. +This event provides the application installation date from the linked file. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2218,7 +2208,7 @@ The following fields are available: ### InstallDateMsi -The install date from the Microsoft installer (MSI) database. +This event provides the install date from the Microsoft installer (MSI) database. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2228,7 +2218,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2254,7 +2244,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2266,7 +2256,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2283,7 +2273,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,31 +2302,31 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2347,7 +2337,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2358,7 +2348,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2382,7 +2372,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2393,7 +2383,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2404,7 +2394,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2433,7 +2423,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2444,7 +2434,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2457,7 +2447,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2468,7 +2458,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2477,9 +2467,48 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event represents the basic metadata about a plug and play (PNP) device and its associated driver. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device class unique identifier of the driver package loaded on the device. +- **COMPID** The list of “Compatible IDs” for this device. See [COMPID](#compid). +- **ContainerId** The system-supplied unique identifier that specifies which group(s) the device(s) installed on the parent (main) device belong to. +- **Description** The description of the device. +- **DeviceState** Identifies the current state of the parent (main) device. +- **DriverId** The unique identifier for the installed driver. +- **DriverName** The name of the driver image file. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **DriverVerDate** The date of the driver loaded for the device +- **DriverVerVersion** The version of the driver loaded for the device +- **Enumerator** Identifies the bus that enumerated the device. +- **HWID** A list of hardware IDs for the device. See [HWID](#hwid). +- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InventoryVersion** The version number of the inventory process generating the events. +- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. +- **LowerFilters** The identifiers of the Lower filters installed for the device. +- **Manufacturer** The manufacturer of the device. +- **MatchingID** The Hardware ID or Compatible ID that Windows uses to install a device instance. +- **Model** Identifies the model of the device. +- **objectInstanceId** Deprecated. The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 +- **ParentId** The Device Instance ID of the parent of the device. +- **ProblemCode** The error code currently returned by the device, if applicable. +- **Provider** Identifies the device provider. +- **Service** The name of the device service. +- **STACKID** The list of hardware IDs for the stack. See [STACKID](#stackid). +- **UpperClassFilters** The identifiers of the Upper Class filters installed for the device. +- **UpperFilters** The identifiers of the Upper filters installed for the device. + + ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2490,7 +2519,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2501,19 +2530,19 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2540,7 +2569,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2551,7 +2580,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2562,7 +2591,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2581,7 +2610,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2592,7 +2621,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2601,9 +2630,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2630,7 +2667,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2642,115 +2679,121 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2760,7 +2803,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2772,7 +2815,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2780,7 +2823,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2788,7 +2831,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2796,7 +2839,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### STACKID -This event provides the internal compatible ID for the stack. +This event provides the internal compatible ID for the stack. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2818,7 +2861,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2843,7 +2886,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. +This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2868,15 +2911,21 @@ The following fields are available: ## Migration events +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -2884,7 +2933,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2897,7 +2946,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2909,7 +2958,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,7 +2974,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2938,7 +2987,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2948,7 +2997,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OfficeRegistration -This event indicates the status of the OneDrive integration with Microsoft Office. +This event indicates the status of the OneDrive integration with Microsoft Office. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2957,7 +3006,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2967,7 +3016,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.RepairResult -The event determines the result of the installation repair. +The event determines the result of the installation repair. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2976,7 +3025,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult -This event indicates the status when downloading the OneDrive setup file. +This event indicates the status when downloading the OneDrive setup file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2985,7 +3034,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2996,7 +3045,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateTierReg -This event determines status of the update tier registry values. +This event determines status of the update tier registry values. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3006,7 +3055,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3015,18 +3064,26 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + + + ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3043,7 +3100,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3055,7 +3112,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3067,7 +3124,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3079,7 +3136,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3093,7 +3150,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3141,7 +3198,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3268,7 +3325,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent -This event indicates that an unexpected error occurred during an update and provides information to help address the issue. +This event indicates that an unexpected error occurred during an update and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3282,7 +3339,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Error -This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. +This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3293,7 +3350,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.FallbackError -This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. +This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3303,7 +3360,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent -This event occurs when the Notify User task executes and provides information about the cause of the notification. +This event occurs when the Notify User task executes and provides information about the cause of the notification. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3319,7 +3376,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId -This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. +This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3331,7 +3388,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId -This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. +This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3343,7 +3400,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed -This event tracks the health of key update (Remediation) services and whether they are enabled. +This event tracks the health of key update (Remediation) services and whether they are enabled. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3382,7 +3439,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Started -deny +This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3452,7 +3509,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. @@ -3473,7 +3530,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DownloadServiceProgress -This event indicates the progress of the downloader in 1% increments. +This event indicates the progress of the downloader in 1% increments. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3574,7 +3631,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3637,7 +3694,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3648,7 +3705,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3662,7 +3719,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3693,7 +3750,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3797,7 +3854,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3813,7 +3870,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3828,7 +3885,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3839,7 +3896,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3848,7 +3905,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3916,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3872,7 +3929,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3897,7 +3954,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3913,7 +3970,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3935,7 +3992,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3946,7 +4003,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3955,7 +4012,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3966,7 +4023,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3979,7 +4036,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4070,7 +4127,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4095,7 +4152,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4122,19 +4179,19 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. @@ -4142,7 +4199,7 @@ This event reports the status of an action following a reboot, should one have b ### SoftwareUpdateClientTelemetry.CheckForUpdates -This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4339,7 +4396,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4361,7 +4418,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4466,7 +4523,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.SLSDiscovery -This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4482,7 +4539,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4497,7 +4554,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4529,7 +4586,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4540,7 +4597,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4553,7 +4610,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4564,7 +4621,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4575,7 +4632,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4585,7 +4642,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4599,7 +4656,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4612,7 +4669,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4639,7 +4696,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4655,7 +4712,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4673,7 +4730,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4689,7 +4746,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4705,7 +4762,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4720,7 +4777,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4737,7 +4794,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4753,7 +4810,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4784,7 +4841,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4804,7 +4861,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4822,7 +4879,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4838,7 +4895,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4864,13 +4921,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4886,13 +4943,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,13 +4978,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -4975,7 +5032,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5122,19 +5179,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. @@ -5222,7 +5279,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5635,7 +5692,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5660,7 +5717,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5699,7 +5756,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5717,7 +5774,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5749,7 +5806,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5770,7 +5827,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5826,7 +5883,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5850,7 +5907,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5865,7 +5922,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5880,7 +5937,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5895,7 +5952,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5910,7 +5967,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5925,7 +5982,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5940,7 +5997,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5955,7 +6012,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5970,7 +6027,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5980,7 +6037,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5991,7 +6048,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6010,7 +6067,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6028,7 +6085,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6043,7 +6100,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6060,7 +6117,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6085,7 +6142,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6097,7 +6154,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6109,7 +6166,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6125,7 +6182,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6137,7 +6194,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6146,7 +6203,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6166,7 +6223,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6178,7 +6235,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6190,7 +6247,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6206,7 +6263,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6219,7 +6276,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6234,7 +6291,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6244,7 +6301,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6257,7 +6314,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6293,7 +6350,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6315,7 +6372,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6324,7 +6381,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6342,7 +6399,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot -This event is sent when a toast notification is shown to the user about scheduling a device restart. +This event is sent when a toast notification is shown to the user about scheduling a device restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6351,7 +6408,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6371,7 +6428,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6395,7 +6452,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS Updates. +This event sends data specific to the FixupEditionId mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -6403,25 +6460,25 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 6c91cf051e..959e63868e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/29/2020 ms.reviewer: --- @@ -47,7 +47,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -Invalid Signature - This event is superseded by an event that contains additional fields. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -89,7 +89,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -107,7 +107,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -118,7 +118,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -145,7 +145,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -156,7 +156,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +178,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -189,7 +189,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -211,7 +211,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -222,7 +222,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -244,7 +244,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -255,7 +255,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -277,7 +277,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -288,7 +288,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -310,7 +310,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -321,7 +321,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -361,7 +361,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -372,7 +372,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -409,7 +409,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -420,7 +420,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -447,7 +447,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -458,7 +458,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -486,7 +486,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -497,7 +497,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -521,7 +521,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -532,7 +532,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -558,7 +558,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -569,7 +569,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -633,7 +633,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -644,7 +644,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -669,7 +669,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -698,7 +698,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -709,7 +709,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +733,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -744,7 +744,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -773,7 +773,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -784,7 +784,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -795,7 +795,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -810,7 +810,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +821,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +832,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -857,7 +857,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -868,7 +868,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -879,7 +879,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -912,7 +912,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -923,7 +923,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -947,7 +947,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -958,7 +958,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +982,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -993,7 +993,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1018,7 +1018,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1029,7 +1029,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1053,7 +1053,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1064,7 +1064,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1088,7 +1088,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1099,7 +1099,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1123,7 +1123,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1134,7 +1134,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1158,7 +1158,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1169,7 +1169,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1193,7 +1193,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1204,7 +1204,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1232,7 +1232,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1243,7 +1243,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1306,7 +1306,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1317,7 +1317,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1330,7 +1330,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1348,7 +1348,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1359,19 +1359,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1389,14 +1379,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1408,7 +1398,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1423,7 +1413,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1464,7 +1454,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1474,7 +1464,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1497,7 +1487,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1539,7 +1529,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1551,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1578,7 +1568,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1595,7 +1585,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1606,7 +1596,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1616,7 +1606,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1637,7 +1627,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1650,7 +1640,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1665,7 +1655,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1888,7 +1878,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -1958,19 +1948,19 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2016,6 +2006,25 @@ This event is triggered when UTC determines it needs to send information about p ## DxgKernelTelemetry events +### DxgKrnlTelemetry.BddDiag + +This event records Microsoft basic display driver diagnostic information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BiosFlags** Bitwise flags that contain graphics related firmware information on the device such as the system was booted with display or not, system was using VBIOS or UEFI GOP, and VBIOS has a valid display mode list or not. +- **CurrentMode** Information about the current display mode such as the resolution, rotation, and scaling. +- **DefaultModeReason** Numeric value indicating the reason that the Microsoft Basic Display Driver is in use. +- **DefaultModeResolution** Default resolution that Microsoft Basic Display Driver detected. +- **DefaultResolutionProvider** Numeric value indicating the source of the default resolution. +- **Flags** Bitwise flags containing Microsoft Basic Display Driver related information such as if it is running because there is no graphics driver or user PnP stopped the graphics driver, it has valid EDID or not on the connected monitor and where the EDID was from, it is running at gray scale mode or not, it is running without display or not. +- **HeadlessReason** Numeric value indicating why there is no display. +- **LogAssertionCount** Number of assertions that were encountered before this event was recorded. +- **LogErrorCount** Number of errors that were encountered before this event was recorded. +- **MonitorPowerState** Current power state of the monitor. +- **Version** Version of the schema for this event. + + ### DxgKrnlTelemetry.GPUAdapterInventoryV2 This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. @@ -2169,7 +2178,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2179,7 +2188,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2223,7 +2232,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2250,7 +2259,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2260,7 +2269,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2289,7 +2298,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2301,7 +2310,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,7 +2321,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2326,7 +2335,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2337,7 +2346,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2348,7 +2357,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2359,7 +2368,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2383,7 +2392,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2394,7 +2403,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2405,7 +2414,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2435,7 +2444,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2446,7 +2455,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2459,7 +2468,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2470,7 +2479,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2502,7 +2511,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -2520,7 +2529,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2531,7 +2540,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2542,7 +2551,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2555,7 +2564,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2566,7 +2575,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2593,7 +2602,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2604,7 +2613,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2615,7 +2624,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2635,7 +2644,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2646,7 +2655,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2655,9 +2664,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2684,7 +2701,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2696,7 +2713,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2730,7 +2747,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2738,7 +2755,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2749,7 +2766,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -This event provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2767,7 +2784,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2778,7 +2795,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -This event includes the Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2804,7 +2821,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2815,7 +2832,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -Provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2830,7 +2847,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2838,7 +2855,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2849,7 +2866,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -This event list all installed Office products +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2864,7 +2881,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2875,7 +2892,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2889,7 +2906,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2900,7 +2917,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2931,7 +2948,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2939,7 +2956,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2950,7 +2967,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2958,7 +2975,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2969,7 +2986,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2980,7 +2997,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2995,7 +3012,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3003,7 +3020,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3011,7 +3028,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3021,7 +3038,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3032,7 +3049,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3040,7 +3057,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3060,7 +3077,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3087,19 +3104,19 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -3107,7 +3124,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3120,7 +3137,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3132,7 +3149,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3148,7 +3165,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3161,7 +3178,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3171,7 +3188,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3181,7 +3198,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3192,7 +3209,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3201,18 +3218,36 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3229,7 +3264,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3241,7 +3276,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3253,7 +3288,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3265,7 +3300,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3279,7 +3314,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3326,7 +3361,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3362,7 +3397,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -3499,7 +3534,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -3530,7 +3565,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3594,7 +3629,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3657,7 +3692,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3668,7 +3703,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3682,7 +3717,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3783,7 +3818,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3799,7 +3834,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3814,7 +3849,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -Error occurred during execution of the plugin. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3825,7 +3860,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3835,7 +3870,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3846,7 +3881,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3894,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3884,7 +3919,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3900,7 +3935,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3922,7 +3957,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3933,7 +3968,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3943,7 +3978,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3954,7 +3989,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3967,7 +4002,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4056,7 +4091,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4081,7 +4116,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4108,7 +4143,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4126,7 +4161,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4142,7 +4177,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4157,7 +4192,7 @@ The following fields are available: ### SIHEngineTelemetry.ServiceStateChange -This event reports the status of attempts to stop or start a service as part of executing an action. +This event reports the status of attempts to stop or start a service as part of executing an action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4174,7 +4209,7 @@ The following fields are available: ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4191,7 +4226,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4274,7 +4309,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -4305,7 +4340,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -4382,7 +4417,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4404,7 +4439,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4504,7 +4539,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4519,7 +4554,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4551,7 +4586,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4562,7 +4597,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4575,7 +4610,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4587,7 +4622,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4598,7 +4633,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4608,7 +4643,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4622,7 +4657,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4636,7 +4671,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4663,7 +4698,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4679,7 +4714,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4697,7 +4732,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4713,7 +4748,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4729,7 +4764,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4744,7 +4779,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4761,7 +4796,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4777,7 +4812,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4809,7 +4844,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4829,7 +4864,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4845,7 +4880,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4863,7 +4898,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4879,7 +4914,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4895,7 +4930,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,7 +4956,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4941,7 +4976,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4957,7 +4992,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4975,7 +5010,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4992,7 +5027,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5015,7 +5050,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5062,7 +5097,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5078,7 +5113,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5094,7 +5129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5111,7 +5146,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5127,7 +5162,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5152,13 +5187,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -5206,7 +5241,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5354,19 +5389,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5406,16 +5441,25 @@ The following fields are available: ### Microsoft.Windows.WaaSAssessment.Error -This event returns the name of the missing setting needed to determine the Operating System build age. +This event returns the name of the missing setting needed to determine the Operating System build age. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String. +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. + + ### Microsoft.Windows.WaaSMedic.RemediationFailed -This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5427,7 +5471,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.Summary -This event provides the results of the WaaSMedic diagnostic run +This event provides the results of the WaaSMedic diagnostic run. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5446,7 +5490,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.SummaryEvent -This event provides the results from the WaaSMedic engine +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5488,7 +5532,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5882,7 +5926,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5915,7 +5959,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5963,7 +6007,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5983,7 +6027,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6020,7 +6064,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6043,7 +6087,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6059,7 +6103,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6075,7 +6119,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6102,7 +6146,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6120,7 +6164,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6136,7 +6180,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6151,49 +6195,49 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -6211,25 +6255,25 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot -This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6239,7 +6283,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6251,7 +6295,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6270,7 +6314,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6286,7 +6330,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6303,7 +6347,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6319,7 +6363,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6330,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6347,7 +6391,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6372,7 +6416,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6385,7 +6429,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6397,7 +6441,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6414,13 +6458,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6429,7 +6473,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6448,7 +6492,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6460,7 +6504,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6470,7 +6514,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6484,9 +6528,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event indicates the data sent when the device pauses an in-progress update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6499,7 +6554,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6514,7 +6569,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6524,7 +6579,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6566,7 +6621,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6580,9 +6635,21 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event indicates that USO determined UUP needs to fall back. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6604,7 +6671,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6613,7 +6680,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6622,7 +6689,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6641,13 +6708,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6657,7 +6724,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6678,7 +6745,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,25 +6771,25 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 38c6834c3d..546e1a123f 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/29/2020 ms.reviewer: --- @@ -47,7 +47,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -123,7 +123,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -141,7 +141,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -152,7 +152,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +256,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +278,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +289,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +311,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +322,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -344,7 +344,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -355,7 +355,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -396,7 +396,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -407,7 +407,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -445,7 +445,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -456,7 +456,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -484,7 +484,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,7 +495,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -523,7 +523,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -534,7 +534,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -596,7 +596,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +607,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +635,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -646,7 +646,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +671,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +682,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -707,7 +707,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +736,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +747,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +771,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +782,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +811,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,7 +822,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -833,7 +833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -848,7 +848,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -859,7 +859,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -870,7 +870,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -895,7 +895,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -906,7 +906,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -917,7 +917,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -949,7 +949,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +960,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -984,7 +984,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -995,7 +995,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1019,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1030,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1055,7 +1055,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1066,7 +1066,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1090,7 +1090,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1101,7 +1101,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1125,7 +1125,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1136,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1160,7 +1160,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1171,7 +1171,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1195,7 +1195,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1206,7 +1206,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1230,13 +1230,13 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusEndSync -This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. +This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. The data collected with this event is used to help keep Windows up to date. ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1247,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1275,7 +1275,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,7 +1286,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1351,7 +1351,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1375,7 +1375,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1393,7 +1393,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1405,7 +1405,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1416,19 +1416,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1447,14 +1437,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1456,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1481,7 +1471,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1522,7 +1512,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1532,7 +1522,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1555,7 +1545,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1597,7 +1587,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1641,7 +1631,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1664,7 +1654,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1682,7 +1672,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1699,7 +1689,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1710,7 +1700,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1710,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1741,7 +1731,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1754,7 +1744,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1798,7 +1788,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1813,7 +1803,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2030,7 +2020,7 @@ The following fields are available: ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2066,7 +2056,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2193,7 +2183,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2207,7 +2197,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Initialize -This event indicates that the Deployment 360 APIs have been initialized for use. +This event indicates that the Deployment 360 APIs have been initialized for use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2220,7 +2210,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2233,7 +2223,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2247,7 +2237,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2261,7 +2251,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2280,7 +2270,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2312,6 +2302,21 @@ The following fields are available: - **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** The network state of the device. +- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. +- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. + + ### TelClientSynthetic.HeartBeat_5 This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. @@ -2402,7 +2407,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -This event indicates that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2415,7 +2420,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2428,7 +2433,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2441,7 +2446,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2453,7 +2458,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2466,7 +2471,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2478,7 +2483,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2491,7 +2496,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2504,7 +2509,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2516,7 +2521,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2529,7 +2534,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2541,7 +2546,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2554,7 +2559,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2566,7 +2571,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2579,7 +2584,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2592,7 +2597,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2604,7 +2609,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2630,7 +2635,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2655,7 +2660,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2668,7 +2673,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2681,7 +2686,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2693,7 +2698,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2707,7 +2712,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2720,7 +2725,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2733,7 +2738,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2747,7 +2752,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2760,7 +2765,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2773,7 +2778,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2787,7 +2792,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2800,7 +2805,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded -This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2812,7 +2817,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2826,7 +2831,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2838,7 +2843,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2851,7 +2856,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2863,7 +2868,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2877,7 +2882,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2890,7 +2895,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2903,7 +2908,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2915,7 +2920,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2928,7 +2933,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2940,7 +2945,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2953,7 +2958,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3127,7 +3132,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3137,7 +3142,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3179,7 +3184,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3213,7 +3218,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3223,7 +3228,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3252,7 +3257,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3264,7 +3269,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3275,7 +3280,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3288,7 +3293,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3299,7 +3304,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3310,7 +3315,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3321,7 +3326,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3345,7 +3350,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3356,7 +3361,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3367,7 +3372,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3397,7 +3402,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3408,7 +3413,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3421,7 +3426,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3432,7 +3437,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3464,7 +3469,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. @@ -3482,7 +3487,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3493,7 +3498,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3504,7 +3509,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3517,7 +3522,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3528,7 +3533,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3555,7 +3560,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3566,7 +3571,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3577,7 +3582,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3597,7 +3602,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3608,7 +3613,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3617,9 +3622,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3649,7 +3662,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,9 +3674,17 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3696,7 +3717,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3707,7 +3728,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3718,7 +3739,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3736,7 +3757,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3747,7 +3768,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3773,7 +3794,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3784,7 +3805,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3799,7 +3820,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3810,7 +3831,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3821,7 +3842,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3836,7 +3857,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3847,7 +3868,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3861,7 +3882,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3872,7 +3893,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3904,7 +3925,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3912,7 +3933,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3923,7 +3944,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3931,7 +3952,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3942,7 +3963,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3953,7 +3974,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3968,7 +3989,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3976,7 +3997,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3984,7 +4005,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3994,7 +4015,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4005,7 +4026,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4013,7 +4034,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4033,7 +4054,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4062,7 +4083,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event indicates an OS state change. +This event indicates an OS state change. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4183,7 +4204,104 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4203,6 +4321,8 @@ The following fields are available: - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. - **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. @@ -4250,49 +4370,26 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. - - -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -4300,7 +4397,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4375,7 +4472,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4388,7 +4485,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4400,7 +4497,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4416,7 +4513,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4429,7 +4526,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4439,7 +4536,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4449,7 +4546,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4460,7 +4557,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4469,18 +4566,36 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4492,7 +4607,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentPrep -This event is used to determine whether the user needs to see the privacy consent experience or not. +This event is used to determine whether the user needs to see the privacy consent experience or not. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4502,7 +4617,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4515,7 +4630,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.wilActivity -This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. +This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4539,7 +4654,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4556,7 +4671,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -4568,7 +4683,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4580,7 +4695,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4592,7 +4707,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4606,7 +4721,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -4654,7 +4769,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -4690,7 +4805,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -4831,7 +4946,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -4863,7 +4978,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4932,7 +5047,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4995,7 +5110,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5006,7 +5121,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5080,7 +5195,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5096,7 +5211,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5111,7 +5226,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5124,7 +5239,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5140,7 +5255,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5162,7 +5277,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5239,7 +5354,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5264,7 +5379,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5289,15 +5404,45 @@ The following fields are available: ## SIH events +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5318,7 +5463,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5401,7 +5546,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5431,7 +5576,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5505,7 +5650,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5527,7 +5672,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5623,7 +5768,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5638,7 +5783,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5671,7 +5816,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5682,7 +5827,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -5695,7 +5840,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5706,7 +5851,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5718,7 +5863,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5728,7 +5873,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5741,7 +5886,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5754,7 +5899,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5771,7 +5916,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5787,7 +5932,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5819,7 +5964,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5839,7 +5984,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5855,7 +6000,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5873,7 +6018,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5891,7 +6036,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5907,7 +6052,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5933,7 +6078,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5953,7 +6098,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5969,7 +6114,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5987,7 +6132,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6003,13 +6148,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6032,7 +6177,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6079,7 +6224,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6095,7 +6240,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6111,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6128,7 +6273,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6144,7 +6289,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6177,7 +6322,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6187,7 +6332,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6245,7 +6390,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6409,7 +6554,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6434,7 +6579,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6453,7 +6598,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6492,9 +6637,45 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,7 +6728,7 @@ The following fields are available: ### Microsoft.Windows.WER.MTT.Value -This event is used for differential privacy. +This event is used for differential privacy to help keep Windows up to date. The following fields are available: @@ -6953,7 +7134,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6968,7 +7149,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6982,19 +7163,19 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded -This event sends basic telemetry on the success of the rollback of feature updates. +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed -This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7009,7 +7190,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable -This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7023,13 +7204,13 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted -This event indicates that the Quality Rollback process has started. +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded -This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. @@ -7037,7 +7218,7 @@ This event sends basic telemetry on the success of the rollback of the Quality/L ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7069,7 +7250,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7118,7 +7299,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7138,7 +7319,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7177,7 +7358,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7199,7 +7380,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7215,7 +7396,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7239,7 +7420,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7436,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7282,7 +7463,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7300,7 +7481,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7316,7 +7497,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7331,7 +7512,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7357,7 +7538,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7373,7 +7554,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7389,7 +7570,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7405,7 +7586,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7421,7 +7602,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7437,7 +7618,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7453,7 +7634,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7469,7 +7650,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7485,7 +7666,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7507,7 +7688,7 @@ This event is sent when a second reminder dialog is displayed during Enhanced En ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7526,7 +7707,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7537,7 +7718,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7550,7 +7731,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7563,7 +7744,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7573,7 +7754,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7592,7 +7773,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7614,7 +7795,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -7627,7 +7808,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7643,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7660,7 +7841,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7669,7 +7850,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7678,7 +7859,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7689,7 +7870,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Escalation -This event is sent when USO takes an Escalation action on a device. +This event is sent when USO takes an Escalation action on a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7702,7 +7883,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7719,7 +7900,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed -USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. +USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7911,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7746,7 +7927,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7938,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7774,7 +7955,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7799,7 +7980,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7812,7 +7993,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7822,9 +8003,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data to device when Oobe Update download is in progress. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An update ID. +- **updateScenarioType** A type of update scenario. +- **wuDeviceid** A device ID associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -7841,7 +8035,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7853,7 +8047,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7862,7 +8056,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Progress -This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. +This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7880,7 +8074,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7899,7 +8093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7911,7 +8105,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7921,7 +8115,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7939,7 +8133,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -7952,7 +8146,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -7965,7 +8159,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7981,7 +8175,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7993,7 +8187,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8003,9 +8197,20 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event sends data when a device pauses an in-progress update, to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8018,7 +8223,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8033,7 +8238,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8043,7 +8248,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -8079,9 +8284,21 @@ The following fields are available: - **wuDeviceid** Unique ID for Device +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8103,7 +8320,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8112,7 +8329,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8121,7 +8338,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8140,13 +8357,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8156,7 +8373,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8177,7 +8394,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8201,7 +8418,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8223,7 +8440,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8248,37 +8465,37 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 8be2e02435..74ff710523 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/29/2020 ms.reviewer: --- @@ -303,7 +303,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -594,7 +594,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -612,7 +612,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -623,7 +623,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -655,7 +655,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -666,7 +666,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -688,7 +688,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,7 +722,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +733,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -755,7 +755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -766,7 +766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -788,7 +788,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -799,7 +799,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +821,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +832,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -873,7 +873,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -884,7 +884,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -922,7 +922,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -933,7 +933,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -962,7 +962,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -973,7 +973,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1003,7 +1003,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1014,7 +1014,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1039,7 +1039,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1050,7 +1050,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1076,7 +1076,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1087,7 +1087,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1115,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1126,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1151,7 +1151,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1162,7 +1162,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1187,7 +1187,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1216,7 +1216,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1227,7 +1227,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1251,7 +1251,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1262,7 +1262,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1291,7 +1291,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1302,7 +1302,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1313,7 +1313,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1332,7 +1332,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1343,7 +1343,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1354,7 +1354,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1379,7 +1379,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1390,7 +1390,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1401,7 +1401,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1435,7 +1435,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1446,7 +1446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1470,7 +1470,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1481,7 +1481,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1505,7 +1505,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1516,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1541,7 +1541,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1552,7 +1552,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,7 +1576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1587,7 +1587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1611,7 +1611,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1622,7 +1622,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1646,7 +1646,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1657,7 +1657,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1681,7 +1681,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1692,7 +1692,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1716,7 +1716,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1727,7 +1727,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1755,7 +1755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1766,7 +1766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1833,7 +1833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1844,7 +1844,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1857,7 +1857,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1875,7 +1875,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1889,7 +1889,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1914,7 +1914,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1932,7 +1932,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1943,7 +1943,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1954,19 +1954,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1985,14 +1975,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2004,7 +1994,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2019,7 +2009,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2062,7 +2052,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2072,7 +2062,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2095,7 +2085,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2137,7 +2127,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2183,7 +2173,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2206,7 +2196,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2224,7 +2214,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2243,7 +2233,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2255,7 +2245,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2268,7 +2258,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2289,7 +2279,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2302,7 +2292,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2348,7 +2338,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2364,7 +2354,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2470,7 +2460,6 @@ The following fields are available: - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). - **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser). @@ -2483,14 +2472,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.os @@ -2571,26 +2552,11 @@ The following fields are available: - **xid** A list of base10-encoded XBOX User IDs. -## Common data fields - -### Ms.Device.DeviceInventoryChange - -Describes the installation state for all hardware and software components available on a particular device. - -The following fields are available: - -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. - - ## Compatibility events ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2626,7 +2592,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2763,7 +2729,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2777,7 +2743,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2790,7 +2756,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2804,7 +2770,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2818,7 +2784,7 @@ The following fields are available: ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2887,7 +2853,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2906,7 +2872,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,15 +2891,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -3089,7 +3055,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -Event to indicate that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3105,7 +3071,7 @@ The following fields are available: - **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network. - **IsDeviceOobeBlocked** Indicates whether user approval is required to install updates on the device. - **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device. -- **IsDeviceSccmManaged** Indicates whether the device is running the Configuration Manager client to keep the operating system and applications up to date. +- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date. - **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated. - **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications. - **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services). @@ -3116,7 +3082,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3129,7 +3095,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3142,7 +3108,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3154,7 +3120,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3167,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3179,7 +3145,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3192,7 +3158,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3205,7 +3171,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3217,7 +3183,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3230,7 +3196,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3242,7 +3208,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3255,7 +3221,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3267,7 +3233,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3280,7 +3246,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3293,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3305,7 +3271,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3318,7 +3284,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3330,7 +3296,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3343,7 +3309,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3356,7 +3322,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3368,7 +3334,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3382,7 +3348,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3395,7 +3361,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3408,7 +3374,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3422,7 +3388,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3435,7 +3401,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3449,7 +3415,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3462,7 +3428,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3476,7 +3442,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3488,7 +3454,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3501,7 +3467,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3513,7 +3479,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3527,7 +3493,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3540,7 +3506,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3553,7 +3519,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3565,7 +3531,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3577,7 +3543,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3590,7 +3556,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3604,7 +3570,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3613,16 +3579,49 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **dismPendingInstallPackageName** The name of the pending package. +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3634,7 +3633,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3645,7 +3644,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3699,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3718,7 +3717,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3910,7 +3909,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3952,7 +3951,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4005,7 +4004,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4013,9 +4012,27 @@ The following fields are available: - **devinv** The file version of the Device inventory component. +### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd + +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **CatalogSigners** Signers from catalog. Each signer starts with Chain. +- **DigestAlgorithm** The pseudonymizing (hashing) algorithm used when the file or package was signed. +- **DriverPackageStrongName** Optional. Available only if FileSigningInfo is collected on a driver package. +- **EmbeddedSigners** Embedded signers. Each signer starts with Chain. +- **FileName** The file name of the file whose signatures are listed. +- **FileType** Either exe or sys, depending on if a driver package or application executable. +- **InventoryVersion** The version of the inventory file generating the events. +- **Thumbprint** Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma. + + ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4044,7 +4061,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4056,7 +4073,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4067,7 +4084,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4080,7 +4097,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4091,7 +4108,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4102,7 +4119,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4113,7 +4130,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4154,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4148,7 +4165,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4159,7 +4176,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4189,7 +4206,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4200,7 +4217,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4215,7 +4232,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4226,9 +4243,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). The following fields are available: @@ -4282,7 +4299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4293,7 +4310,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4304,7 +4321,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4317,9 +4334,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.De~ice.DeviceInventoryChange](#msde~icedeviceinventorychange). The following fields are available: @@ -4328,7 +4345,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4355,7 +4372,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4366,7 +4383,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4377,7 +4394,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4399,7 +4416,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4410,7 +4427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4437,21 +4454,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4484,7 +4534,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4495,7 +4545,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4506,7 +4556,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4524,7 +4574,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4535,7 +4585,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4561,7 +4611,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4572,7 +4622,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4587,7 +4637,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4598,7 +4648,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4609,7 +4659,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4624,7 +4674,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4635,7 +4685,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4649,7 +4699,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4660,7 +4710,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4692,7 +4742,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4703,7 +4753,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4715,7 +4765,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4726,7 +4776,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4737,7 +4787,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4748,7 +4798,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4763,7 +4813,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4771,7 +4821,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4779,7 +4829,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4790,9 +4840,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChangd](#msdevicedeviceinventorychangd). The following fields are available: @@ -4802,7 +4852,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4810,7 +4860,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4818,19 +4868,9 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ## Kernel events -### IO - -This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup. - -The following fields are available: - -- **BytesRead** The total number of bytes read from or read by the OS upon system startup. -- **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4861,7 +4901,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4886,7 +4926,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4901,7 +4941,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4949,6 +4989,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -4974,6 +5015,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -5021,24 +5063,24 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. -- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). -- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. -- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. -- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). -- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. -- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. @@ -5046,24 +5088,24 @@ The following fields are available: - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. -- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). -- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. - **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. -- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. -- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. -- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. -- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -5073,26 +5115,52 @@ The following fields are available: - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. -- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. - **osVersion** The primary version of the operating system. '' if unknown. Default: ''. - **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. - **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. -- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. - **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. - **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. -- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -5166,7 +5234,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5178,7 +5246,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5189,7 +5257,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5203,7 +5271,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -5277,7 +5345,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5290,7 +5358,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5302,7 +5370,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5318,7 +5386,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5331,7 +5399,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5341,7 +5409,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5351,7 +5419,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5362,7 +5430,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5371,7 +5439,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5379,11 +5447,112 @@ The following fields are available: - **winInetError** The HResult of the operation. +## Other events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM. + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5395,7 +5564,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5409,26 +5578,11 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. - **threadId** The ID of the thread on which the activity is executing. @@ -5436,7 +5590,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5453,7 +5607,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5470,7 +5624,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5487,7 +5641,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5507,7 +5661,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5662,7 +5816,7 @@ The following fields are available: - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. - **RemediationShellDeviceProSku** Indicates whether a Windows 10 Professional edition is detected. - **RemediationShellDeviceQualityUpdatesPaused** Indicates whether Quality Updates are paused on the device. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceSedimentMutexInUse** Indicates whether the Sediment Pack mutual exclusion object (mutex) is in use. - **RemediationShellDeviceSetupMutexInUse** Indicates whether device setup is in progress. - **RemediationShellDeviceWuRegistryBlocked** Indicates whether the Windows Update is blocked on the device via the registry. @@ -5874,7 +6028,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5912,7 +6066,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5930,7 +6084,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5945,7 +6099,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5958,7 +6112,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5976,7 +6130,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6000,7 +6154,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6021,6 +6175,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -6054,7 +6209,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6078,7 +6233,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6098,7 +6253,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6119,7 +6274,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -6204,7 +6359,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -6235,7 +6390,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -6326,7 +6481,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6348,7 +6503,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6423,6 +6578,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -6452,7 +6608,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6479,6 +6635,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6497,7 +6654,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6513,7 +6670,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6557,7 +6714,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6572,7 +6729,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6633,7 +6790,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6651,7 +6808,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6667,7 +6824,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,7 +6861,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6724,7 +6881,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6740,7 +6897,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6758,7 +6915,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6776,7 +6933,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6793,7 +6950,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6819,7 +6976,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6839,7 +6996,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6855,7 +7012,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6873,7 +7030,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6882,14 +7039,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6908,7 +7067,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6932,7 +7091,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6948,7 +7107,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6964,7 +7123,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6998,7 +7157,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7008,7 +7167,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7066,7 +7225,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7230,7 +7389,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7414,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7274,7 +7433,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7313,9 +7472,65 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.DetectionsOnlyFailed + +Failed to apply the named diagnostic. + +The following fields are available: + +- **hResult** The error code from attempting the diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.RemediationsOnlyFailed + +This event indicates that some plugins failed to complete remediation. This data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **hResult** A resulting error code. +- **versionString** The string for which plugins failed. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7364,18 +7579,6 @@ The following fields are available: - **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise - **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). -### Value - -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. - -The following fields are available: - -- **Algorithm** The algorithm used to preserve privacy. -- **DPRange** The upper bound of the range being measured. -- **DPValue** The randomized response returned by the client. -- **Epsilon** The level of privacy to be applied. -- **HistType** The histogram type if the algorithm is a histogram algorithm. -- **PertProb** The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”. ## Windows Error Reporting MTT events @@ -7776,7 +7979,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7791,7 +7994,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7807,7 +8010,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. +This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7825,15 +8028,29 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7867,7 +8084,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7922,7 +8139,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7942,7 +8159,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7978,7 +8195,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8000,7 +8217,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8016,7 +8233,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8040,7 +8257,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8056,7 +8273,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8083,7 +8300,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8101,7 +8318,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8117,7 +8334,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8132,7 +8349,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8158,7 +8375,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8174,7 +8391,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8407,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8206,7 +8423,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8222,7 +8439,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8238,7 +8455,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. +This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8254,7 +8471,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -8272,9 +8489,18 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8283,9 +8509,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot + +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **isOnAC** The power source for AC or battery power. +- **scanTriggerSource** The source of a triggered scan. + + ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8297,7 +8533,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8309,7 +8545,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8319,7 +8555,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8338,7 +8574,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8380,7 +8616,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -8393,7 +8629,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8409,7 +8645,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8426,7 +8662,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8435,7 +8671,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8444,7 +8680,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8455,7 +8691,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8472,7 +8708,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8482,7 +8718,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8499,7 +8735,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8516,7 +8752,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8542,7 +8778,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8556,7 +8792,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8566,9 +8802,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data when Oobe Update download is in progress, to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An ID associated with an update. +- **updateScenarioType** A type of USO session. +- **wuDeviceid** A device Id associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -8585,7 +8834,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8594,7 +8843,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8613,7 +8862,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8625,7 +8874,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8637,7 +8886,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8656,7 +8905,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8669,7 +8918,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8682,7 +8931,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8692,7 +8941,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8708,7 +8957,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8720,7 +8969,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8732,7 +8981,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8742,7 +8991,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8755,7 +9004,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8770,7 +9019,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8780,7 +9029,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8796,7 +9045,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8818,7 +9067,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8827,7 +9076,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8847,7 +9096,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8857,7 +9106,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8875,9 +9124,192 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that updates have been blocked requiring intervention. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the required UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the device has completed the reboot after installing expected update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus -This event is received when there is status on a push notification. +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8891,11 +9323,33 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8919,7 +9373,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8941,7 +9395,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8962,11 +9416,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8976,7 +9451,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8989,7 +9464,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9004,7 +9479,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9014,13 +9489,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index adb454d3a2..3769fda3cd 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/29/2020 --- @@ -266,7 +266,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -486,6 +486,7 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_21H1** The count of the number of this particular object type present on this device. - **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. @@ -530,7 +531,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -548,7 +549,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -578,12 +579,7 @@ The following fields are available: - **ActiveNetworkConnection** Indicates whether the device is an active network device. - **AppraiserVersion** The version of the appraiser file generating the events. -- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. -- **CosDeviceSolution** An enumeration that indicates how a driver on the target operating system is available. -- **CosDeviceSolutionUrl** Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string -- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. - **IsBootCritical** Indicates whether the device boot is critical. -- **UplevelInboxDriver** Indicates whether there is a driver uplevel for this device. - **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. - **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. - **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. @@ -591,7 +587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -602,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -624,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +631,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -656,9 +652,20 @@ The following fields are available: - **ResolveAttempted** This will always be an empty string when sending diagnostic data. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -678,9 +685,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -700,9 +718,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,9 +751,20 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -765,7 +805,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -776,7 +816,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -814,7 +854,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -825,7 +865,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -847,14 +887,13 @@ The following fields are available: - **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? - **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? - **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? -- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. - **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? - **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -865,7 +904,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -893,9 +932,20 @@ The following fields are available: - **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -920,7 +970,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -944,9 +994,20 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -972,9 +1033,20 @@ The following fields are available: - **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -997,9 +1069,9 @@ The following fields are available: - **HasBiosBlock** Does the device have a BIOS block? -### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1008,6 +1080,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTestAdd + +This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser binary generating the events. +- **TestDecisionDataPoint1** Test data point 1. +- **TestDecisionDataPoint2** Test data point 2. + + ### Microsoft.Windows.Appraiser.General.DecisionTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1046,7 +1142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1075,7 +1171,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1086,7 +1182,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1110,7 +1206,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1121,7 +1217,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1150,7 +1246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1161,7 +1257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1172,7 +1268,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1185,9 +1281,20 @@ The following fields are available: - **Model** The model field from Win32_ComputerSystem. +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove + +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1198,7 +1305,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync -This event indicates that a full set of InventorySystemProcessorAdd events has been sent. +This event indicates that a full set of InventorySystemProcessorAdd events has been sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1209,7 +1316,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync -This event indicates that a new set of InventorySystemProcessorAdd events will be sent. +This event indicates that a new set of InventorySystemProcessorAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1218,6 +1325,19 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. +### Microsoft.Windows.Appraiser.General.InventoryTestAdd + +This event provides diagnostic data for testing event adds. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the component sending the data. +- **TestInvDataPoint1** Test inventory data point 1. +- **TestInvDataPoint2** Test inventory data point 2. + + ### Microsoft.Windows.Appraiser.General.InventoryTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1242,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1267,7 +1387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1278,7 +1398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1289,7 +1409,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1321,9 +1441,20 @@ The following fields are available: - **virtualKB** The amount of virtual memory (in KB). +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1345,9 +1476,20 @@ The following fields are available: - **CompareExchange128Support** Does the CPU support CompareExchange128? +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1369,9 +1511,20 @@ The following fields are available: - **LahfSahfSupport** Does the CPU support LAHF/SAHF? +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1394,9 +1547,20 @@ The following fields are available: - **NXProcessorSupport** Does the processor support NX? +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1418,9 +1582,20 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1442,9 +1617,20 @@ The following fields are available: - **SSE2ProcessorSupport** Does the processor support SSE2? +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1466,9 +1652,20 @@ The following fields are available: - **MaximumTouches** The maximum number of touch points supported by the device hardware. +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1490,9 +1687,20 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1724,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1527,7 +1735,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1553,9 +1761,20 @@ The following fields are available: - **WlanNativeDriver** Does the device have a non-emulated WLAN driver? +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,6 +1795,8 @@ The following fields are available: - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. - **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. @@ -1619,9 +1840,20 @@ The following fields are available: - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1634,7 +1866,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1652,7 +1884,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1666,7 +1898,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1702,7 +1934,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1952,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1731,7 +1963,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1742,19 +1974,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1774,14 +1996,14 @@ The following fields are available: - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1793,7 +2015,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1809,7 +2031,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1853,7 +2075,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1863,7 +2085,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1886,7 +2108,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1928,7 +2150,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1974,7 +2196,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1997,7 +2219,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2010,6 +2232,7 @@ The following fields are available: - **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. - **SModeState** The Windows S mode trail state. - **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). - **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). @@ -2019,7 +2242,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2038,7 +2261,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2050,7 +2273,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2064,7 +2287,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2085,7 +2308,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2098,7 +2321,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2144,7 +2367,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2153,14 +2376,16 @@ The following fields are available: - **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. - **IsVDI** Is the device using Virtual Desktop Infrastructure? - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. - **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2169,6 +2394,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? @@ -2185,6 +2411,7 @@ The following fields are available: - **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. - **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. - **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. - **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. - **WUPauseState** Retrieves WU setting to determine if updates are paused. - **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). @@ -2243,7 +2470,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2255,14 +2481,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2403,7 +2621,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2546,7 +2764,7 @@ This event reports the results of deferring Windows Content to keep Windows up t ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2617,7 +2835,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2635,7 +2853,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2653,15 +2871,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2885,7 +3103,7 @@ This event is a low latency health alert that is part of the 4Nines device healt ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2901,7 +3119,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2910,7 +3128,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2919,7 +3137,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2928,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMUninstallLCU -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2937,7 +3155,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2952,7 +3170,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionStart -The SRT Repair Action Start event sends information to report repair operation started for given plug-in. +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2961,7 +3179,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2973,7 +3191,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2984,7 +3202,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3041,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3060,7 +3278,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3247,7 +3465,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3257,7 +3475,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3293,7 +3511,7 @@ The following fields are available: ### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated -This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3305,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated -This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3318,13 +3536,13 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming -This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. ### TraceLoggingOasisUsbHostApiProvider.DeviceInformation -This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3366,7 +3584,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3407,7 +3625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3417,7 +3635,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3435,9 +3653,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInven|oryChange](#msdevicedeviceinven|orychange). The following fields are available: @@ -3448,6 +3666,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. @@ -3464,7 +3683,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3476,7 +3695,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3513,7 +3732,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3526,7 +3745,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3537,9 +3756,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DmviceInventoryChange](#msdevicedmviceinventorychange). The following fields are available: @@ -3548,9 +3767,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device,DeviceInventoryChange](#msdevice,deviceinventorychange). The following fields are available: @@ -3559,7 +3778,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3583,7 +3802,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3594,7 +3813,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3605,7 +3824,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3635,7 +3854,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3646,7 +3865,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,7 +3880,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3672,7 +3891,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3710,7 +3929,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device @@ -3728,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3739,7 +3958,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3750,7 +3969,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3763,7 +3982,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3774,7 +3993,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3801,7 +4020,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3812,7 +4031,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3823,7 +4042,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3845,7 +4064,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3856,7 +4075,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3883,9 +4102,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3918,7 +4182,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3929,7 +4193,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3940,7 +4204,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3958,7 +4222,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3969,7 +4233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3995,7 +4259,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4006,7 +4270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4021,7 +4285,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4032,7 +4296,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4043,7 +4307,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4058,7 +4322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4069,7 +4333,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4083,7 +4347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4094,7 +4358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4126,7 +4390,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4401,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4149,7 +4413,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4160,7 +4424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4171,7 +4435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4182,7 +4446,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4197,7 +4461,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4205,7 +4469,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4213,7 +4477,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4224,7 +4488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4235,7 +4499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4243,7 +4507,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4251,7 +4515,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4261,7 +4525,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted -This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. +This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. The data collected with this event is used to keep Windows performing properly. @@ -4279,7 +4543,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4310,7 +4574,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4335,7 +4599,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4348,7 +4612,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4363,7 +4627,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown -This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4484,7 +4748,7 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4584,7 +4848,7 @@ The following fields are available: ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4651,36 +4915,14 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4692,7 +4934,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4703,7 +4945,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4717,7 +4959,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4791,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded -This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4809,7 +5051,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4823,11 +5065,403 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. +## Other events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4839,7 +5473,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4851,672 +5485,11 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Push Button Reset events - -### Microsoft.Windows.PBR.BitLockerWipeFinished - -This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe. - -The following fields are available: - -- **error** The error code if there were any issues during the BitLocker wipe. -- **sessionID** This is the session ID. -- **succeeded** Indicates the BitLocker wipe successful completed. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.BootState - -This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful. - -The following fields are available: - -- **BsdSummaryInfo** Summary of the last boot. -- **sessionID** The ID of the push-button reset session. -- **timestamp** The timestamp of the boot state. - - -### Microsoft.Windows.PBR.ClearTPMStarted - -This event sends basic data about the recovery operation on the device to allow investigation. - -The following fields are available: - -- **sessionID** The ID for this push-button restart session. -- **timestamp** The time when the Trusted Platform Module will be erased. - - -### Microsoft.Windows.PBR.ClientInfo - -This event indicates whether push-button reset (PBR) was initiated while the device was online or offline. - -The following fields are available: - -- **name** Name of the user interface entry point. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The time when this event occurred. - - -### Microsoft.Windows.PBR.Completed - -This event sends data about the recovery operation on the device to allow for investigation. - -The following fields are available: - -- **sessionID** The ID of the push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.DataVolumeCount - -This event provides the number of additional data volumes that the push-button reset operation has detected. - -The following fields are available: - -- **count** The number of attached data drives. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.DiskSpaceRequired - -This event sends the peak disk usage required for the push-button reset operation. - -The following fields are available: - -- **numBytes** The number of bytes required for the reset operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.EnterAPI - -This event is sent at the beginning of each push-button reset (PRB) operation. - -The following fields are available: - -- **apiName** Name of the API command that is about to execute. -- **sessionID** The session ID. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.EnteredOOBE - -This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.LeaveAPI - -This event is sent when the push-button reset operation is complete. - -The following fields are available: - -- **apiName** Name of the API command that completed. -- **errorCode** Error code if an error occurred during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation is successfully completed. -- **success** Indicates whether the API call was successful. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionFinished - -This event is sent when the OEM extensibility scripts have completed. - -The following fields are available: - -- **exitCode** The exit code from OEM extensibility scripts to push-button reset. -- **param** Parameters used for the OEM extensibility script. -- **phase** Name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the OEM extensibility script executed successfully. -- **timedOut** Indicates whether the OEM extensibility script timed out. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionStarted - -This event is sent when the OEM extensibility scripts start to execute. - -The following fields are available: - -- **param** The parameters used by the OEM extensibility script. -- **phase** The name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteFinished - -This event is sent at the end of a push-button reset (PBR) operation. - -The following fields are available: - -- **error** Indicates the result code of the event. -- **index** The operation index. -- **operation** The name of the operation. -- **phase** The name of the operation phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteStarted - -This event is sent at the beginning of a push-button reset operation. - -The following fields are available: - -- **index** The index of this operation. -- **operation** The name of this operation. -- **phase** The phase of this operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. -- **weight** The weight of the operation used to distribute the change in percentage. - - -### Microsoft.Windows.PBR.OperationQueueConstructFinished - -This event is sent when construction of the operation queue for push-button reset is finished. - -The following fields are available: - -- **error** The result code for operation queue construction. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationQueueConstructStarted - -This event is sent when construction of the operation queue for push-button reset is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.PBRClearTPMFailed - -This event is sent when there was a failure while clearing the Trusted Platform Module (TPM). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed - -This event is sent when the push-button reset operation fails to construct a new copy of the operating system. - -The following fields are available: - -- **HRESULT** Indicates the result code of the event. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The last Setup Platform operation. -- **SPPhase** The last phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionSucceed - -This event is sent when the push-button reset operation succeeds in constructing a new copy of the operating system. - -The following fields are available: - -- **CBSPackageCount** The Component Based Servicing package count. -- **CustomizationPackageCount** The Customization package count. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFailed - -This event is sent when the push-button reset operation fails and rolls back to the previous state. - -The following fields are available: - -- **ErrorType** The result code for the push-button reset error. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalUserSelection - -This event is sent when the user makes the final selection in the user interface. - -The following fields are available: - -- **PBREraseData** Indicates whether the option to erase data is selected. -- **PBRRecoveryStrategy** The recovery strategy for the push-button reset operation. -- **PBRRepartitionDisk** Indicates whether the user has selected the option to repartition the disk. -- **PBRVariation** Indicates the push-button reset type. -- **PBRWipeDataDrives** Indicates whether the option to wipe the data drives is selected. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFormatOSVolumeSucceed - -This event is sent when the operation to format the operating system volume succeeds during push-button reset (PBR). - -The following fields are available: - -- **JustDeleteFiles** Indicates whether disk formatting was skipped. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRIOCTLErasureSucceed - -This event is sent when the erasure operation succeeds during push-button reset (PBR). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRLayoutImageFailed - -This event is sent when push-button reset fails to create a new image of Windows. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM1Failed - -This event is sent when the first OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReachedOOBE - -This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReconstructionInitiated - -This event returns data when a PBR (Push Button Reset) reconstruction operation begins. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecks - -This event returns data when PBR (Push Button Reset) requirement checks begin. - -The following fields are available: - -- **DeploymentType** The type of deployment. -- **InstallType** The type of installation. -- **PBRType** The type of push-button reset. -- **SessionID** The ID for this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksFailed - -This event returns data when PBR (Push Button Reset) requirement checks fail. - -The following fields are available: - -- **DiskSpaceAvailable** The disk space available for the push-button reset. -- **DiskSpaceRequired** The disk space required for the push-button reset. -- **ErrorType** The type of error that occurred during the requirement checks phase of the push-button reset operation. -- **PBRImageVersion** The image version of the push-button reset tool. -- **PBRRecoveryStrategy** The recovery strategy for this phase of push-button reset. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **PBRType** The type of push-button reset specified by the user interface. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksPassed - -This event returns data when PBR (Push Button Reset) requirement checks are passed. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRImageType** The push-button reset image type. -- **PBRImageVersion** The version of the push-button reset image. -- **PBRRecoveryStrategy** The push-button reset recovery strategy. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRSucceed - -This event returns data when PBR (Push Button Reset) succeeds. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PhaseFinished - -This event returns data when a phase of PBR (Push Button Reset) has completed. - -The following fields are available: - -- **error** The result code for this phase of push-button reset. -- **phase** The name of this push-button reset phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether this phase of push-button reset executed successfully. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.PhaseStarted - -This event is sent when a phase of the push-button reset (PBR) operation starts. - -The following fields are available: - -- **phase** The name of this phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.ReconstructionInfo - -This event returns data about the PBR (Push Button Reset) reconstruction. - -The following fields are available: - -- **numPackagesAbandoned** The number of packages that were abandoned during the reconstruction operation of push-button reset. -- **numPackagesFailed** The number of packages that failed during the reconstruction operation of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **slowMode** The mode of reconstruction. -- **targetVersion** The target version of the OS for the reconstruction. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ResetOptions - -This event returns data about the PBR (Push Button Reset) reset options selected by the user. - -The following fields are available: - -- **overwriteSpace** Indicates whether the option was selected to erase data during push-button reset. -- **preserveWorkplace** Indicates whether the option was selected to reserve the workplace during push-button reset. -- **scenario** The selected scenario for the push-button on reset operation. -- **sessionID** The ID of this push-button on reset session. -- **timestamp** The timestamp of this push-button on reset event. -- **usePayload** Indicates whether Cloud PBR or Reconstruction was used. -- **wipeData** Indicates whether the option was selected to wipe additional drives during push-button reset. - - -### Microsoft.Windows.PBR.RetryQueued - -This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot. - -The following fields are available: - -- **attempt** The number of retry attempts that were made -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnedToOldOS - -This event returns data after PBR (Push Button Reset) has completed the rollback. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed - -This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery). - -The following fields are available: - -- **errorCode** The error that occurred while scheduling the task. -- **sessionID** The ID of this push-button reset session. -- **taskName** The name of the task. -- **timestamp** The ID of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackFinished - -This event returns data when the PBR (Push Button Reset) rollback completes. - -The following fields are available: - -- **error** Any errors that occurred during rollback to the old operating system. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the rollback succeeded. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackStarted - -This event returns data when the PBR (Push Button Reset) rollback begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ScenarioNotSupported - -This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device. - -The following fields are available: - -- **errorCode** The error that occurred. -- **reason** The reason why this push-button reset scenario is not supported. -- **sessionID** The ID for this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionCreated - -This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionResumed - -This event returns data when the PRB (Push Button Reset) session is resumed after reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionSaved - -This event returns data when the PRB (Push Button Reset) session is suspended between reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteFinished - -This event returns data when the PBR (Push Button Reset) setup finishes. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **systemState** Information about the system state of the Setup Platform operation. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteStarted - -This event returns data when the PBR (Push Button Reset) setup starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupFinalizeStarted - -This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupOperationFailed - -This event returns data when a PRB (Push Button Reset) setup operation fails. - -The following fields are available: - -- **errorCode** An error that occurred during the setup phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **setupExecutionOperation** The name of the Setup Platform operation. -- **setupExecutionPhase** The phase of the setup operation that failed. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoField - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user. - -The following fields are available: - -- **name** Name of the system information field. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. -- **value** The system information field value. - - -### Microsoft.Windows.PBR.SystemInfoListItem - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user. - -The following fields are available: - -- **index** The index number associated with the system information item. -- **name** The name of the list of system information items. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. -- **value** The value of the system information item. - - -### Microsoft.Windows.PBR.SystemInfoSenseFinished - -This event returns data when System Info Sense is finished. - -The following fields are available: - -- **error** The error code if an error occurred while querying for system information. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the query for system information was successful. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoSenseStarted - -This event returns data when System Info Sense is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset event. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning - -This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserCancel - -This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface. - -The following fields are available: - -- **pageID** The page ID for the page the user canceled. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserConfirmStart - -This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallFinished - -This event returns data when WinRE (Windows Recovery) installation is complete. - -The following fields are available: - -- **errorCode** Any error that occurred during the Windows Recovery Environment (WinRE) installation. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallStarted - -This event returns data when WinRE (Windows Recovery) installation starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - ## Quality Update Assistant events ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5532,7 +5505,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5547,7 +5520,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5566,7 +5539,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5591,7 +5564,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5623,6 +5596,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5649,6 +5623,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -5656,7 +5631,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5743,7 +5718,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5774,7 +5749,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5865,7 +5840,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5887,7 +5862,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5990,7 +5965,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6037,7 +6012,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6053,7 +6028,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6080,6 +6055,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6098,7 +6074,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6113,7 +6089,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6146,13 +6122,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallCancel -This event indicates the customer has cancelled uninstallation of Windows. +This event indicates the customer has cancelled uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallError -This event sends an error code when the Windows uninstallation fails. +This event sends an error code when the Windows uninstallation fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6161,19 +6137,19 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallReboot -This event is sent to signal an upcoming reboot during uninstallation of Windows. +This event is sent to signal an upcoming reboot during uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallStart -This event indicates that the Windows uninstallation has started. +This event indicates that the Windows uninstallation has started. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallUnavailable -This event sends diagnostic data when the Windows uninstallation is not available. +This event sends diagnostic data when the Windows uninstallation is not available. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6185,13 +6161,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.HasPendingActions -This event is sent when users have actions that will block the uninstall of the latest quality update. +This event is sent when users have actions that will block the uninstall of the latest quality update. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled -This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. +This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6200,7 +6176,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.LCUUninstall -This event is sent when the latest cumulative Windows update was uninstalled on a device. +This event is sent when the latest cumulative Windows update was uninstalled on a device. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6211,7 +6187,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRBlockedByPolicy -This event is sent when a push-button reset operation is blocked by the System Administrator. +This event is sent when a push-button reset operation is blocked by the System Administrator. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6221,7 +6197,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitFailed -This event signals a failed handoff between two recovery binaries. +This event signals a failed handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6230,7 +6206,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitSucceed -This event signals successful handoff between two recovery binaries. +This event signals successful handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6239,7 +6215,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRFailedOffline -This event reports the error code when recovery fails. +This event reports the error code when recovery fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6250,7 +6226,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.EsimPresentCheck -This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). +This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6261,7 +6237,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption -This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. +This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6273,7 +6249,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.RepairNeeded -This event provides information about whether a system reset needs repair. +This event provides information about whether a system reset needs repair. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6285,7 +6261,7 @@ The following fields are available: ### Microsoft.Windows.UEFI.ESRT -This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date. +This event sends basic data during boot about the firmware loaded or recently installed on the machine. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -6313,7 +6289,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6331,10 +6307,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **FlightId** Unique ID for each flight. - **ObjectId** Unique value for each Update Agent mode. @@ -6347,13 +6324,18 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean indicating whether a cancel was requested. - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -6384,10 +6366,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether a cancel was requested. - **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). - **ElapsedTickCount** Time taken for expand phase. - **EndFreeSpace** Free space after expand phase. @@ -6405,7 +6388,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6423,10 +6406,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean to indicate whether a cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). @@ -6441,7 +6425,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6458,7 +6442,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6484,7 +6468,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6504,7 +6488,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6520,7 +6504,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6538,7 +6522,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,14 +6531,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6573,7 +6559,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6596,7 +6582,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6629,7 +6615,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6639,7 +6625,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6697,7 +6683,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6861,7 +6847,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6886,7 +6872,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6905,7 +6891,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6944,9 +6930,35 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6997,7 +7009,7 @@ The following fields are available: ### Value -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7024,7 +7036,7 @@ The following fields are available: ### WheaProvider.WheaErrorRecord -This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -7045,7 +7057,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion -This event provides information about the datastore migration and whether it was successful. +This event provides information about the datastore migration and whether it was successful. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7056,7 +7068,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.GetCallerViaWdsp -This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. +This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. The data collected with this event is used to help keep Windows secure and performing properly. The following fields are available: @@ -7466,7 +7478,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7482,7 +7494,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7497,7 +7509,44 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. @@ -7505,7 +7554,7 @@ This event sends basic information indicating that Feature Rollback has started. ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7539,7 +7588,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7595,7 +7644,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7615,7 +7664,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7652,7 +7701,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7674,7 +7723,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7690,7 +7739,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7714,7 +7763,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7779,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7806,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7775,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7791,7 +7840,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7806,7 +7855,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7832,7 +7881,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7849,7 +7898,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7866,7 +7915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7883,7 +7932,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7900,7 +7949,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7918,9 +7967,36 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureCount** Number of failures. +- **failureId** Id of the failure. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **fileName** Source code file name where the error occurred. +- **function** Function where the failure occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source code file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **PartA_PrivTags** Privacy tags. +- **threadId** Identifier of the thread the error occurred on. +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7931,7 +8007,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7943,7 +8019,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7955,7 +8031,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7974,7 +8050,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8016,7 +8092,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8032,7 +8108,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8047,9 +8123,30 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DTUEnabled + +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wuDeviceid** Device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DTUInitiated + +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **dtuErrorCode** Return code from creating the DTU Com Server. +- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on. +- **utilizeDtuOverWu** Whether DTU should be utilized over Windows Update. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8066,7 +8163,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8076,7 +8173,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8093,7 +8190,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8110,7 +8207,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8136,7 +8233,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8150,7 +8247,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8162,7 +8259,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8171,7 +8268,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8287,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8202,7 +8299,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8214,7 +8311,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8231,7 +8328,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8244,7 +8341,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8257,7 +8354,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8267,7 +8364,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8283,7 +8380,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8293,9 +8390,21 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel + +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature -This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8306,7 +8415,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd -This event indicates a critical error with the callback binary requested by the updater. +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8317,7 +8426,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8337,7 +8446,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8350,7 +8459,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed -This event is sent when an updater failed to execute the registered callback. +This event is sent when an updater failed to execute the registered callback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8362,7 +8471,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8388,7 +8497,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8398,7 +8507,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8414,7 +8523,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8436,7 +8545,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8445,7 +8554,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8465,7 +8574,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8485,7 +8594,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8512,7 +8621,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8536,7 +8645,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8558,7 +8667,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8579,11 +8688,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.BeginScenario -This event is sent when the Update Reserve Manager is called to begin a scenario. +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8599,7 +8729,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ClearReserve -This event is sent when the Update Reserve Manager clears one of the reserves. +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8610,7 +8740,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8620,7 +8750,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.EndScenario -This event is sent when the Update Reserve Manager ends an active scenario. +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8636,7 +8766,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8649,7 +8779,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeReserves -This event is sent when reserves are initialized on the device. +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8678,7 +8808,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8693,7 +8823,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8703,7 +8833,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy -This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8714,13 +8844,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.TurnOffReserves -This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8735,7 +8865,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index da656fd6ef..6dba7d4e7e 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 08/31/2020 +ms.date: 09/29/2020 --- @@ -37,7 +37,6 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -1166,14 +1165,6 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? -### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWEndSync - -Deprecated in RS3. This event indicates that a full set of SystemProcessorPrefetchWAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1257,14 +1248,6 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. -### Microsoft.Windows.Appraiser.General.SystemWimEndSync - -Deprecated in RS3. This event indicates that a full set of SystemWimAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemWimStartSync This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1409,23 +1392,6 @@ The following fields are available: ## Audio endpoint events -### MicArrayGeometry - -This event provides information about the layout of the individual microphone elements in the microphone array. - -The following fields are available: - -- **MicCoords** The location and orientation of the microphone element. -- **usFrequencyBandHi** The high end of the frequency range for the microphone. -- **usFrequencyBandLo** The low end of the frequency range for the microphone. -- **usMicArrayType** The type of the microphone array. -- **usNumberOfMicrophones** The number of microphones in the array. -- **usVersion** The version of the microphone array specification. -- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). -- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). -- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). -- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). - ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -2005,7 +1971,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2017,14 +1982,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2123,19 +2080,6 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common Data Fields - -### Ms.Device.DeviceInventoryChange - -Describes the installation state for all hardware and software components available on a particular device. - -The following fields are available: - -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Component-based servicing events @@ -3167,6 +3111,7 @@ The following fields are available: - **Categories** A comma separated list of functional categories in which the container belongs. - **DiscoveryMethod** The discovery method for the device container. - **FriendlyName** The name of the device container. +- **Icon** Deprecated in RS3. The path or index to the icon file. - **InventoryVersion** The version of the inventory file generating the events. - **IsActive** Is the device connected, or has it been seen in the last 14 days? - **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. @@ -3851,6 +3796,14 @@ The following fields are available: - **IndicatorValue** The indicator value. +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. @@ -4378,32 +4331,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Windows Admin Center events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID.. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5238,6 +5165,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved + +This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. @@ -5308,6 +5247,24 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. @@ -5319,6 +5276,17 @@ The following fields are available: - **PackageVersion** Current package version of UpdateHealthTools. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5955,6 +5923,32 @@ The following fields are available: - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +## Windows Admin Center events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed @@ -6929,29 +6923,6 @@ The following fields are available: - **updateId** ID of the update that is getting installed with this restart. - **wuDeviceid** Unique device ID used by Windows Update. -### wilActivity - -This event provides a Windows Internal Library context used for Product and Service diagnostics. - -The following fields are available: - -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. -- **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. -- **threadId** The ID of the thread on which the activity is executing. ### Microsoft.Windows.Update.Orchestrator.ActivityError @@ -7584,3 +7555,6 @@ The following fields are available: - **virtualMachineName** VM name. - **waitForClientConnection** True if we should wait for client connection. - **wp81NetworkStackDisabled** WP 8.1 networking stack disabled. + + + From d8cca8e954c934e46ccdc2b1cb201e8ba3e71b9e Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Sep 2020 16:31:18 +0100 Subject: [PATCH 03/82] update to versions --- .../basic-level-windows-diagnostic-events-and-fields-1703.md | 1 + .../basic-level-windows-diagnostic-events-and-fields-1709.md | 1 + .../basic-level-windows-diagnostic-events-and-fields-1803.md | 1 + .../basic-level-windows-diagnostic-events-and-fields-1809.md | 2 +- .../basic-level-windows-diagnostic-events-and-fields-1903.md | 2 +- ...equired-windows-diagnostic-data-events-and-fields-2004.md | 5 +++-- 6 files changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index fa4db33c8a..0c83fa4192 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 959e63868e..8211ff28f1 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 546e1a123f..d124eff53d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 74ff710523..e77fcf07a9 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 3769fda3cd..433e1dc88c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 6dba7d4e7e..e471f677ba 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,6 +1,6 @@ --- description: Use this article to learn more about what required Windows diagnostic data is gathered. -title: Windows 10, version 2004 required diagnostic events and fields (Windows 10) +title: Windows 10, version 2010 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -17,7 +17,7 @@ ms.date: 09/29/2020 --- -# Windows 10, version 2004 required Windows diagnostic events and fields +# Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields > [!IMPORTANT] @@ -26,6 +26,7 @@ ms.date: 09/29/2020 **Applies to** +- Windows 10, version 2010 - Windows 10, version 2004 From 737c15d139de99b0bd6b009ed67777e427d7fe72 Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Sep 2020 16:39:47 +0100 Subject: [PATCH 04/82] Update toc.yml --- windows/privacy/toc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 6d801ea292..df43ead56e 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -15,7 +15,7 @@ href: Microsoft-DiagnosticDataViewer.md - name: Required Windows diagnostic data events and fields items: - - name: Windows 10, version 2004 required Windows diagnostic data events and fields + - name: Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic data events and fields href: required-windows-diagnostic-data-events-and-fields-2004.md - name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1903.md From 2fec2bca86e0305e14d2d8d98deee7e0d747691e Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Wed, 30 Sep 2020 19:53:30 +0100 Subject: [PATCH 05/82] version and brian updates --- ...ndows-diagnostic-events-and-fields-1703.md | 12 +- ...ndows-diagnostic-events-and-fields-1709.md | 22 +-- ...ndows-diagnostic-events-and-fields-1803.md | 22 +-- ...ndows-diagnostic-events-and-fields-1809.md | 154 +++++++++--------- ...ndows-diagnostic-events-and-fields-1903.md | 8 +- ...-diagnostic-data-events-and-fields-2004.md | 51 +++++- 6 files changed, 138 insertions(+), 131 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 0c83fa4192..80e304507e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -3072,14 +3072,6 @@ The following fields are available: - **winInetError** The HResult of the operation. -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - - - ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 8211ff28f1..2ff7a59444 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -3226,24 +3226,6 @@ The following fields are available: - **winInetError** The HResult of the operation. -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Privacy logging notification events ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index d124eff53d..dea5ad5838 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -4574,24 +4574,6 @@ The following fields are available: - **winInetError** The HResult of the operation. -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index e77fcf07a9..50de9f211f 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -3568,6 +3568,80 @@ The following fields are available: ## DISM events +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. @@ -5447,7 +5521,7 @@ The following fields are available: - **winInetError** The HResult of the operation. -## Other events +## ONNX runtime events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5474,80 +5548,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -### Microsoft.Windows.StartRep.DISMLatesInstalledLCU - -This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM. - - -### Microsoft.Windows.StartRep.DISMPendingInstall - -This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **DISMPendingInstallPackageName** The name of the pending package. - - -### Microsoft.Windows.StartRep.DISMRevertPendingActions - -This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The result from the operation to revert pending packages. - - -### Microsoft.Windows.StartRep.DISMUninstallLCU - -This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The error code that is being reported by DISM. - - -### Microsoft.Windows.StartRep.SRTRepairActionEnd - -This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The error code that is reported. -- **SRTRepairAction** The action that was taken by SRT. - - -### Microsoft.Windows.StartRep.SRTRepairActionStart - -This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **SRTRepairAction** The action that is being taken by SRT. - - -### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd - -This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **ErrorCode** The final result code for the root cause operation. -- **SRTRootCauseDiag** The name of the root cause operation that ran. - - -### Microsoft.Windows.StartRep.SRTRootCauseDiagStart - -This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. - -The following fields are available: - -- **SRTRootCauseDiag** The name of a specific diagnostic. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 433e1dc88c..96c8128e1d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 --- @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: -- [Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -5065,7 +5065,7 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. -## Other events +## ONNX runtime events ### Microsoft.ML.ONNXRuntime.ProcessInfo @@ -5092,6 +5092,8 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +## Other events + ### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index e471f677ba..76596829af 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 09/29/2020 +ms.date: 09/30/2020 --- @@ -4332,6 +4332,31 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. +## Other events + +### GameCoreController.LaunchLifetimeSummary + +No content is currently available. + +The following fields are available: + +- **gameos** The OS version of the game. +- **isSuspended** A flag that indicates if account is suspended. +- **launchInstanceId** A launch identification. +- **msaAppId** The MSA app identification. +- **pfn** Stands for Package Full Name and includes the package name, version, and publisher identifier. +- **prevLaunchesOnVm** The previous launch count on a virtual machine. +- **suspendCount** The total launch suspend count. +- **systemType** A type of console. +- **terminateReason** An error code indicating the reasons for launch termination. + + +### SFR.XvdStreamingStart + +No content is currently available. + + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -7506,6 +7531,30 @@ This event signals the completion of the setup process. It happens only once dur +## XBOX events + +### Microsoft.Xbox.EraControl.EraVmTerminationReason + +No content is currently available. + +The following fields are available: + +- **pfn** A package full name. +- **reasonNumber** A number associated with reason. + + +### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.1.SFR.XvdStreamingStart + +No content is currently available. + + + +### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.2.SFR.XvdStreamingStart + +No content is currently available. + + + ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady From 73ad06915df005b6d43817884a79cd5facdcbdbd Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:12:58 -0700 Subject: [PATCH 06/82] Update required-windows-diagnostic-data-events-and-fields-2004.md --- ...-diagnostic-data-events-and-fields-2004.md | 25 ------------------- 1 file changed, 25 deletions(-) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 76596829af..d6e66d19eb 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -4332,31 +4332,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Other events - -### GameCoreController.LaunchLifetimeSummary - -No content is currently available. - -The following fields are available: - -- **gameos** The OS version of the game. -- **isSuspended** A flag that indicates if account is suspended. -- **launchInstanceId** A launch identification. -- **msaAppId** The MSA app identification. -- **pfn** Stands for Package Full Name and includes the package name, version, and publisher identifier. -- **prevLaunchesOnVm** The previous launch count on a virtual machine. -- **suspendCount** The total launch suspend count. -- **systemType** A type of console. -- **terminateReason** An error code indicating the reasons for launch termination. - - -### SFR.XvdStreamingStart - -No content is currently available. - - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted From 2d2f2053d883b7cc82253407c6b1ac38610c4785 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:14:12 -0700 Subject: [PATCH 07/82] Update required-windows-diagnostic-data-events-and-fields-2004.md --- ...-diagnostic-data-events-and-fields-2004.md | 26 ------------------- 1 file changed, 26 deletions(-) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index d6e66d19eb..ad5d9e3798 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -7504,32 +7504,6 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. - - -## XBOX events - -### Microsoft.Xbox.EraControl.EraVmTerminationReason - -No content is currently available. - -The following fields are available: - -- **pfn** A package full name. -- **reasonNumber** A number associated with reason. - - -### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.1.SFR.XvdStreamingStart - -No content is currently available. - - - -### Microsoft.Xbox.XceBridge.CS.1.0.0.9.0.2.SFR.XvdStreamingStart - -No content is currently available. - - - ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady From e046ff68789298dc4d2695d2729992f06336aa5d Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:19:00 -0700 Subject: [PATCH 08/82] Update basic-level-windows-diagnostic-events-and-fields-1903.md --- ...ndows-diagnostic-events-and-fields-1903.md | 23 ++----------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 96c8128e1d..03c0807c38 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -5092,27 +5092,7 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Other events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - +## Surface events ### Microsoft.Surface.Health.Binary.Prod.McuHealthLog @@ -5125,6 +5105,7 @@ The following fields are available: - **healthLogSize** 4KB. - **productId** Identifier for product model. +## Update health events ### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked From 8c957f9ccf12d68b01be40195cc6fb464b0c509c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:22:26 -0700 Subject: [PATCH 09/82] Update basic-level-windows-diagnostic-events-and-fields-1809.md --- ...basic-level-windows-diagnostic-events-and-fields-1809.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 50de9f211f..cd6e3b7b59 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -7979,7 +7979,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7994,7 +7994,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -8010,7 +8010,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. +This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: From 461ce1be60ef385f4afe69dfc74d1ffa4ac9fd84 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:27:50 -0700 Subject: [PATCH 10/82] Update basic-level-windows-diagnostic-events-and-fields-1903.md --- ...basic-level-windows-diagnostic-events-and-fields-1903.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 03c0807c38..9ee1b41afa 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -3655,7 +3655,7 @@ The following fields are available: This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. -This event includes fields from [Ms.Device.DeviceInven|oryChange](#msdevicedeviceinven|orychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -3758,7 +3758,7 @@ The following fields are available: This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DmviceInventoryChange](#msdevicedmviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -3929,7 +3929,7 @@ The following fields are available: - **HWID** The version of the driver loaded for the device. - **Inf** The bus that enumerated the device. - **InstallDate** The date of the most recent installation of the device on the machine. -- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** List of hardware ids for the device. - **LowerClassFilters** Lower filter class drivers IDs installed for the device - **LowerFilters** Lower filter drivers IDs installed for the device From 3cfc61fb602f7dec1f61b9927de1c495a2c532c9 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:30:48 -0700 Subject: [PATCH 11/82] Update basic-level-windows-diagnostic-events-and-fields-1809.md --- ...vel-windows-diagnostic-events-and-fields-1809.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index cd6e3b7b59..6cb675ffc6 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -2551,6 +2551,19 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. +## Common Data Fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events From b8d2d03e08e1dd4ebc03f31711c2fa5276bb0034 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:52:22 -0700 Subject: [PATCH 12/82] Update required-windows-diagnostic-data-events-and-fields-2004.md --- ...-diagnostic-data-events-and-fields-2004.md | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index ad5d9e3798..f5e56db553 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1393,6 +1393,23 @@ The following fields are available: ## Audio endpoint events +### MicArrayGeometry + +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **MicCoords** The location and orientation of the microphone element. +- **usFrequencyBandHi** The high end of the frequency range for the microphone. +- **usFrequencyBandLo** The low end of the frequency range for the microphone. +- **usMicArrayType** The type of the microphone array. +- **usNumberOfMicrophones** The number of microphones in the array. +- **usVersion** The version of the microphone array specification. +- **wHorizontalAngleBegin** The horizontal angle of the start of the working volume (reported as radians times 10,000). +- **wHorizontalAngleEnd** The horizontal angle of the end of the working volume (reported as radians times 10,000). +- **wVerticalAngleBegin** The vertical angle of the start of the working volume (reported as radians times 10,000). +- **wVerticalAngleEnd** The vertical angle of the end of the working volume (reported as radians times 10,000). + ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. @@ -2081,6 +2098,18 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. +## Common data fields + +### Ms.Device.DeviceInventoryChange + +Describes the installation state for all hardware and software components available on a particular device. + +The following fields are available: + +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. ## Component-based servicing events @@ -7330,6 +7359,29 @@ The following fields are available: - **UpdateId** Unique ID for each Update. - **WuId** Unique ID for the Windows Update client. +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. ## Windows Update Reserve Manager events From 85931a4dfe7c160112ad2e5068430438d40f6968 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 12:58:36 -0700 Subject: [PATCH 13/82] Update basic-level-windows-diagnostic-events-and-fields-1809.md --- ...ndows-diagnostic-events-and-fields-1809.md | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 6cb675ffc6..d15f59c958 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -4332,7 +4332,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.De~iceInventoryChange](#msdevicede~iceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4423,7 +4423,7 @@ The following fields are available: This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.De~ice.DeviceInventoryChange](#msde~icedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4929,7 +4929,7 @@ The following fields are available: This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChangd](#msdevicedeviceinventorychangd). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). The following fields are available: @@ -4955,6 +4955,15 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ## Kernel events +### IO + +This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup. + +The following fields are available: + +- **BytesRead** The total number of bytes read from or read by the OS upon system startup. +- **BytesWritten** The total number of bytes written to or written by the OS upon system startup. + ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. @@ -7592,6 +7601,18 @@ The following fields are available: - **IsValidDumpFile** True if the dump file is valid for the debugger, false otherwise - **ReportId** WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson). +### Value + +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. + +The following fields are available: + +- **Algorithm** The algorithm used to preserve privacy. +- **DPRange** The upper bound of the range being measured. +- **DPValue** The randomized response returned by the client. +- **Epsilon** The level of privacy to be applied. +- **HistType** The histogram type if the algorithm is a histogram algorithm. +- **PertProb** The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”. ## Windows Error Reporting MTT events From d55d3228b78791c4b032f21138c1956f86ae379a Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 13:02:12 -0700 Subject: [PATCH 14/82] Update basic-level-windows-diagnostic-events-and-fields-1903.md --- .../basic-level-windows-diagnostic-events-and-fields-1903.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 9ee1b41afa..629309f9a2 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -3769,7 +3769,7 @@ The following fields are available: This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device,DeviceInventoryChange](#msdevice,deviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) The following fields are available: From d54f542768d86631aa909ff67972c1b22c0cd171 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 13:03:01 -0700 Subject: [PATCH 15/82] Update basic-level-windows-diagnostic-events-and-fields-1803.md --- .../basic-level-windows-diagnostic-events-and-fields-1803.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index dea5ad5838..d8b6f689ba 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -3470,7 +3470,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. From a6c0d066f93639413923d52601c01ac60b1fada5 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 13:03:31 -0700 Subject: [PATCH 17/82] Update basic-level-windows-diagnostic-events-and-fields-1709.md --- .../basic-level-windows-diagnostic-events-and-fields-1709.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 2ff7a59444..ea0817c0af 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -2512,7 +2512,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. From eaba346fac5f82f7a58e97477dbc62df0449776f Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 30 Sep 2020 13:03:56 -0700 Subject: [PATCH 18/82] Update basic-level-windows-diagnostic-events-and-fields-1703.md --- .../basic-level-windows-diagnostic-events-and-fields-1703.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 80e304507e..a241aced69 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -2490,7 +2490,7 @@ The following fields are available: - **Enumerator** Identifies the bus that enumerated the device. - **HWID** A list of hardware IDs for the device. See [HWID](#hwid). - **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). -- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx - **InventoryVersion** The version number of the inventory process generating the events. - **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. - **LowerFilters** The identifiers of the Lower filters installed for the device. From c4d7250a8612b6a58aeb522fa46c432edd8b90f9 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Wed, 30 Sep 2020 13:54:56 -0700 Subject: [PATCH 19/82] Update windows-diagnostic-data.md --- windows/privacy/windows-diagnostic-data.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 153c7ca114..3546128bc3 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -12,20 +12,21 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/04/2019 ms.reviewer: --- # Windows 10, version 1709 and newer optional diagnostic data Applies to: +- Windows 10, version 2010 +- Windows 10, version 2004 - Windows 10, version 1909 - Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2004 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2010 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard. From d5870efa6a4dfe008ab3c7562683bfe26e2be93a Mon Sep 17 00:00:00 2001 From: Sinead O'Sullivan Date: Thu, 1 Oct 2020 10:49:36 +0100 Subject: [PATCH 20/82] Update toc.yml --- windows/privacy/toc.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index df43ead56e..321a57eb41 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -15,9 +15,9 @@ href: Microsoft-DiagnosticDataViewer.md - name: Required Windows diagnostic data events and fields items: - - name: Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic data events and fields + - name: Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic data events and fields href: required-windows-diagnostic-data-events-and-fields-2004.md - - name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields + - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1903.md - name: Windows 10, version 1809 required Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1809.md From 893db2910c80f7fb96dfd3aa1212a92b590002db Mon Sep 17 00:00:00 2001 From: skycommand Date: Sun, 4 Oct 2020 09:33:10 +0330 Subject: [PATCH 21/82] Update windows/deployment/update/media-dynamic-update.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/media-dynamic-update.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 2c0a78e280..ea81420b8b 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -93,7 +93,7 @@ Optional Components, along with the .NET feature, can be installed offline, howe ## Windows PowerShell scripts to apply Dynamic Updates to an existing image -These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages is stored locally in this folder structure: +These examples are for illustration only, and therefore lack error handling. The script assumes that the following packages are stored locally in this folder structure: |Folder |Description | |---------|---------| From 4b0252c5c632ec54848d0ae6e4f87c0331ef9f12 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 9 Oct 2020 10:44:05 -0700 Subject: [PATCH 22/82] whats new --- windows/whats-new/TOC.md | 1 + .../whats-new-windows-10-version-20H2.md | 255 ++++++++++++++++++ 2 files changed, 256 insertions(+) create mode 100644 windows/whats-new/whats-new-windows-10-version-20H2.md diff --git a/windows/whats-new/TOC.md b/windows/whats-new/TOC.md index edb6146667..28e444d3c9 100644 --- a/windows/whats-new/TOC.md +++ b/windows/whats-new/TOC.md @@ -1,4 +1,5 @@ # [What's new in Windows 10](index.md) +## [What's new in Windows 10, version 20H2](whats-new-windows-10-version-20H2.md) ## [What's new in Windows 10, version 2004](whats-new-windows-10-version-2004.md) ## [What's new in Windows 10, version 1909](whats-new-windows-10-version-1909.md) ## [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md new file mode 100644 index 0000000000..d41fb782a1 --- /dev/null +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -0,0 +1,255 @@ +--- +title: What's new in Windows 10, version 20H2 +description: New and updated features in Windows 10, version 20H2 (also known as the Windows 10 May 2020 Update). +keywords: ["What's new in Windows 10", "Windows 10", "October 2020 Update"] +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# What's new in Windows 10, version 20H2 for IT Pros + +**Applies to** +- Windows 10, version 20H2 + +This article lists new and updated features and content that are of interest to IT Pros for Windows 10, version 20H2, also known as the Windows 10 October 2020 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 2004. + +To download and install Windows 10, version 2004, use Windows Update (**Settings > Update & Security > Windows Update**). + +## Security + +### Windows Hello + +- Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox. +- You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to **Settings > Accounts > Sign-in options**, and selecting **On** under **Make your device passwordless**. Enabling passwordless sign in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN. +- Windows Hello PIN sign-in support is [added to Safe mode](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#windows-hello-pin-in-safe-mode-build-18995). +- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894). + +### Windows Defender System Guard + +In this release, [Windows Defender System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) enables an even *higher* level of [System Management Mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows#system-management-mode-smm-protection) (SMM) Firmware Protection that goes beyond checking the OS memory and secrets to additional resources like registers and IO. + +With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. This feature is forward-looking and currently requires new hardware available soon. + + ![System Guard](images/system-guard2.png) + +### Windows Defender Application Guard + +[Windows Defender Application Guard](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) has been available for Chromium-based Edge since early 2020. + +Note: [Application Guard for Office](https://support.office.com/article/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46) is coming soon. + +## Deployment + +### Windows Setup + +Windows Setup [answer files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs) (unattend.xml) have [improved language ](https://oofhours.com/2020/06/01/new-in-windows-10-2004-better-language-handling/). + +Improvements in Windows Setup with this release also include: +- Reduced offline time during feature updates +- Improved controls for reserved storage +- Improved controls and diagnostics +- New recovery options + +For more information, see Windows Setup enhancements in the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/pilot-new-features-with-the-windows-insider-program-for-business/ba-p/1220464). + +### SetupDiag + +In Windows 10, version 2004, SetupDiag is now automatically installed. + +[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. + +During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup. + +### Windows Autopilot + +With this release, you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903. + +If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles. + +### Microsoft Endpoint Manager + +An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364). + +Also see [What's new in Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/whats-new). + +### Windows Assessment and Deployment Toolkit (ADK) + +Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). + +For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). + +### Microsoft Deployment Toolkit (MDT) + +MDT version 8456 supports Windows 10, version 2004, but there is currently an issue that causes MDT to incorrectly detect that UEFI is present. There is an [update available](https://support.microsoft.com/help/4564442/windows-10-deployments-fail-with-microsoft-deployment-toolkit) for MDT to address this issue. + +For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). + +## Servicing + +### Delivery Optimization + +Windows PowerShell cmdlets have been improved: + +- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). +- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. +- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting. + +Additional improvements: +- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. +- Automatic cloud-based congestion detection is available for PCs with cloud service support. + +The following [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) policies are removed in this release: + +- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) + - Reason: Replaced with separate policies for foreground and background +- Max Upload Bandwidth (DOMaxUploadBandwidth) + - Reason: impacts uploads to internet peers only, which isn't used in Enterprises. +- Absolute max throttle (DOMaxDownloadBandwidth) + - Reason: separated to foreground and background + +### Windows Update for Business + +[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include: +- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. +- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. +- Update less: Last year, we [changed update installation policies](https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency/#l2jH7KMkOkfcWdBs.97) for Windows 10 to only target devices running a feature update version that is nearing end of service. As a result, many devices are only updating once a year. To enable all devices to make the most of this policy change, and to prevent confusion, we have removed deferrals from the Windows Update settings **Advanced Options** page starting on Windows 10, version 2004. If you wish to continue leveraging deferrals, you can use local Group Policy (**Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview builds and Feature Updates are received** or **Select when Quality Updates are received**). For more information about this change, see [Simplified Windows Update settings for end users](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplified-windows-update-settings-for-end-users/ba-p/1497215). + +## Networking + +### Wi-Fi 6 and WPA3 + +Windows now supports the latest Wi-Fi standards with [Wi-Fi 6 and WPA3](https://support.microsoft.com/help/4562575/windows-10-faster-more-secure-wifi). Wi-Fi 6 gives you better wireless coverage and performance with added security. WPA3 provides improved Wi-Fi security and secures open networks. + +### TEAP + +In this release, Tunnel Extensible Authentication Protocol (TEAP) has been added as an authentication method to allow chaining together multiple credentials into a single EAP transaction. TEAP networks can be configured by [enterprise policy](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpwl/94cf6896-c28e-4865-b12a-d83ee38cd3ea). + +## Virtualization + +### Windows Sandbox + +[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bug fixes and enables even more control over configuration. + +[Windows Sandbox configuration](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file) includes: +- MappedFolders now supports a destination folder. Previously no destination could be specified, it was always mapped to the Sandbox desktop. +- AudioInput/VideoInput settings now enable you to share their host microphone or webcam with the Sandbox. +- ProtectedClient is a new security setting that runs the connection to the Sandbox with extra security settings enabled. This is disabled by default due to issues with copy & paste. +- PrinterRedirection: You can now enable and disable host printer sharing with the Sandbox. +- ClipboardRedirection: You can now enable and disable host clipboard sharing with the Sandbox. +- MemoryInMB adds the ability to specify the maximum memory usage of the Sandbox. + +Windows Media Player is also added back to the Sandbox image in this release. + +Windows Sandbox also has improved accessibility in this release, including: +- Microphone support is available. +- Added functionality to configure the audio input device via the Windows Sandbox config file. +- A Shift + Alt + PrintScreen key sequence that activates the ease of access dialog for enabling high contrast mode. +- A ctrl + alt + break key sequence that allows entering/exiting fullscreen mode. + +### Windows Subsystem for Linux (WSL) + +With this release, memory that is no longer in use in a Linux VM will be freed back to Windows. Previously, a WSL VM's memory could grow, but would not shrink when no longer needed. + +[WSL2](https://docs.microsoft.com/windows/wsl/wsl2-index) support has been added for ARM64 devices if your device supports virtualization. + +For a full list of updates to WSL, see the [WSL release notes](https://docs.microsoft.com/windows/wsl/release-notes). + +### Windows Virtual Desktop (WVD) + +Windows 10 is an integral part of WVD, and several enhancements are available in the Spring 2020 update. Check out [Windows Virtual Desktop documentation](https://aka.ms/wvdgetstarted) for the latest and greatest information, as well as the [WVD Virtual Event from March](https://aka.ms/wvdvirtualevent). + +## Microsoft Edge + +Read about plans for the new Microsoft Edge and other innovations announced at [Build 2020](https://blogs.windows.com/msedgedev/2020/05/19/microsoft-edge-news-developers-build-2020/) and [What's new at Microsoft Edge Insider](https://www.microsoftedgeinsider.com/whats-new). + +Also see information about the exciting new Edge browser [here](https://blogs.windows.com/windowsexperience/2020/01/15/new-year-new-browser-the-new-microsoft-edge-is-out-of-preview-and-now-available-for-download/). + +## Application settings + +This release enables explicit [control over when Windows automatically restarts apps](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#control-over-restarting-apps-at-sign-in-build-18965) that were open when you restart your PC. + +## Windows Shell + +Several enhancements to the Windows 10 user interface are implemented in this release: + +### Cortana + +[Cortana](https://www.microsoft.com/cortana) has been updated and enhanced in Windows 10, version 2004: +- Productivity: chat-based UI gives you the ability to [interact with Cortana using typed or spoken natural language queries](https://support.microsoft.com/help/4557165) to easily get information across Microsoft 365 and stay on track. Productivity focused capabilities such as finding people profiles, checking schedules, joining meetings, and adding to lists in Microsoft To Do are currently available to English speakers in the US. + - In the coming months, with regular app updates through the Microsoft Store, we’ll enhance this experience to support wake word invocation and enable listening when you say “Cortana,” offer more productivity capabilities such as surfacing relevant emails and documents to help you prepare for meetings, and expand supported capabilities for international users. +- Security: tightened access to Cortana so that you must be securely logged in with your work or school account or your Microsoft account before using Cortana. Because of this tightened access, some consumer skills including music, connected home, and third-party skills will no longer be available. Additionally, users [get cloud-based assistance services that meet Office 365’s enterprise-level privacy, security, and compliance promises](https://docs.microsoft.com/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide) as set out in the Online Services Terms. +- Move the Cortana window: drag the Cortana window to a more convenient location on your desktop. + +For updated information, see the [Microsoft 365 blog](https://aka.ms/CortanaUpdatesMay2020). + +### Windows Search + +Windows Search is improved in several ways. For more information, see [Supercharging Windows Search](https://aka.ms/AA8kllm). + +### Virtual Desktops + +You can now [rename your virtual desktops](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#renaming-your-virtual-desktops-build-18975), instead of getting stuck with the system-issued names like Desktop 1. + +### Bluetooth pairing + +Pairing Bluetooth devices with your computer will occur through notifications, so you won't need to go to the Settings app to finish pairing. Other improvements include faster pairing and device name display. For more information, see [Improving your Bluetooth pairing experience](https://docs.microsoft.com/windows-insider/at-home/Whats-new-wip-at-home-20h1#improving-your-bluetooth-pairing-experience-build-18985). + +### Reset this PC + +The 'reset this PC' recovery function now includes a [cloud download](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-reset-this-pc-option-cloud-download-build-18970) option. + +### Task Manager + +The following items are added to Task Manager in this release: +- GPU Temperature is available on the Performance tab for devices with a dedicated GPU card. +- Disk type is now [listed for each disk on the Performance tab](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#disk-type-visible-in-task-manager-performance-tab-build-18898). + +## Graphics & display + +### DirectX + +[New DirectX 12 features](https://devblogs.microsoft.com/directx/dev-preview-of-new-directx-12-features/) are available in this release. + +### 2-in-1 PCs + +A [new tablet experience](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-tablet-experience-for-2-in-1-convertible-pcs-build-18970) for two-in-one convertible PCs is available. The screen will be optimized for touch when you detach your two-in-one's keyboard, but you'll still keep the familiar look of your desktop without interruption. + +### Specialized displays + +With this update, devices running Windows 10 Enterprise or Windows 10 Pro for Workstations with multiple displays can be configured to prevent Windows from using a display, making it available for a specialized purpose. + +Examples include: +- Fixed-function arcade & gaming such as cockpit, driving, flight, and military simulators +- Medical imaging devices with custom panels, such as grayscale X-ray displays +- Video walls like those displayed in Microsoft Store +- Dedicated video monitoring +- Monitor panel testing and validation +- Independent Hardware Vendor (IHV) driver testing and validation + +To prevent Windows from using a display, choose Settings > Display and click Advanced display settings. Select a display to view or change, and then set the Remove display from desktop setting to On. The display will now be available for a specialized use. + +## Desktop Analytics + +[Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/overview) is a cloud-connected service, integrated with Configuration Manager that provides data-driven insights to the management of Windows endpoints in your organization. Desktop Analytics requires a Windows E3 or E5 license, or a Microsoft 365 E3 or E5 license. + +For information about Desktop Analytics and this release of Windows 10, see [What's new in Desktop Analytics](https://docs.microsoft.com/mem/configmgr/desktop-analytics/whats-new). + +## See Also + +[What’s new for IT pros in Windows 10, version 2004](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/what-s-new-for-it-pros-in-windows-10-version-2004/ba-p/1419764): Windows IT Pro blog.
+[What’s new in the Windows 10 May 2020 Update](https://blogs.windows.com/windowsexperience/2020/05/27/whats-new-in-the-windows-10-may-2020-update/): Windows Insider blog.
+[What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
+[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
+[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
+[Start developing on Windows 10, version 2004 today](https://blogs.windows.com/windowsdeveloper/2020/05/12/start-developing-on-windows-10-version-2004-today/): New and updated features in Windows 10 that are of interest to developers.
+[What's new for business in Windows 10 Insider Preview Builds](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new): A preview of new features for businesses.
+[What's new in Windows 10, version 2004 - Windows Insiders](https://docs.microsoft.com/windows-insider/at-home/whats-new-wip-at-home-20h1): This list also includes consumer focused new features.
+[Features and functionality removed in Windows 10](https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features): Removed features.
+[Windows 10 features we’re no longer developing](https://docs.microsoft.com/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
From 48940c9c13a95ae1b3124a340a486c918cfa59b2 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 9 Oct 2020 10:51:51 -0700 Subject: [PATCH 23/82] fix link --- windows/whats-new/TOC.md | 2 +- windows/whats-new/index.md | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/whats-new/TOC.md b/windows/whats-new/TOC.md index 28e444d3c9..9be4f860e1 100644 --- a/windows/whats-new/TOC.md +++ b/windows/whats-new/TOC.md @@ -5,8 +5,8 @@ ## [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) ## [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) ## [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -## [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) ## Previous versions +### [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) ### [What's new in Windows 10, version 1703](whats-new-windows-10-version-1703.md) ### [What's new in Windows 10, version 1607](whats-new-windows-10-version-1607.md) ### [What's new in Windows 10, versions 1507 and 1511](whats-new-windows-10-version-1507-and-1511.md) diff --git a/windows/whats-new/index.md b/windows/whats-new/index.md index 6f809cdf89..559ab66233 100644 --- a/windows/whats-new/index.md +++ b/windows/whats-new/index.md @@ -18,16 +18,17 @@ Windows 10 provides IT professionals with advanced protection against modern sec ## In this section +- [What's new in Windows 10, version 20H2](whats-new-windows-10-version-20H2.md) - [What's new in Windows 10, version 2004](whats-new-windows-10-version-2004.md) - [What's new in Windows 10, version 1909](whats-new-windows-10-version-1909.md) - [What's new in Windows 10, version 1903](whats-new-windows-10-version-1903.md) - [What's new in Windows 10, version 1809](whats-new-windows-10-version-1809.md) - [What's new in Windows 10, version 1803](whats-new-windows-10-version-1803.md) -- [What's new in Windows 10, version 1709](whats-new-windows-10-version-1709.md) + ## Learn more -- [Windows 10 release information](https://technet.microsoft.com/windows/release-info) +- [Windows 10 release information](https://docs.microsoft.com/windows/release-information/) - [Windows 10 release health dashboard](https://docs.microsoft.com/windows/release-information/status-windows-10-2004) - [Windows 10 update history](https://support.microsoft.com/help/4555932/windows-10-update-history) - [What’s new for business in Windows 10 Insider Preview Builds](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new) From 1f9d8ff4cd960ec1bdacf69de9b603600e11af5f Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 15 Oct 2020 12:46:51 -0700 Subject: [PATCH 24/82] 2 --- .../whats-new-windows-10-version-20H2.md | 127 ++++-------------- 1 file changed, 24 insertions(+), 103 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md index d41fb782a1..51aabd41fb 100644 --- a/windows/whats-new/whats-new-windows-10-version-20H2.md +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -1,6 +1,6 @@ --- title: What's new in Windows 10, version 20H2 -description: New and updated features in Windows 10, version 20H2 (also known as the Windows 10 May 2020 Update). +description: New and updated features in Windows 10, version 20H2 (also known as the Windows 10 October 2020 Update). keywords: ["What's new in Windows 10", "Windows 10", "October 2020 Update"] ms.prod: w10 ms.mktglfcycl: deploy @@ -18,7 +18,12 @@ ms.topic: article **Applies to** - Windows 10, version 20H2 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10, version 20H2, also known as the Windows 10 October 2020 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 2004. +This article lists new and updated features and content that are of interest to IT Pros for Windows 10, version 20H2, also known as the Windows 10 October 2020 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 2004. + +> [!NOTE] +> With this release and future releases, the Windows 10 release nomenclature is changing from a year and month pattern (YYMM) to a year and half-year pattern (YYH1, YYH2). + +As with previous fall releases, Windows 10, version 20H2 is a scoped set of features for select performance improvements, enterprise features, and quality enhancements. As a [September-targeted release](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet), 20H2 is serviced for 30 months from the release date for devices running Windows 10 Enterprise or Windows 10 Education editions. To download and install Windows 10, version 2004, use Windows Update (**Settings > Update & Security > Windows Update**). @@ -26,214 +31,130 @@ To download and install Windows 10, version 2004, use Windows Update (**Settings ### Windows Hello -- Windows Hello is now supported as Fast Identity Online 2 (FIDO2) authenticator across all major browsers including Chrome and Firefox. -- You can now enable passwordless sign-in for Microsoft accounts on your Windows 10 device by going to **Settings > Accounts > Sign-in options**, and selecting **On** under **Make your device passwordless**. Enabling passwordless sign in will switch all Microsoft accounts on your Windows 10 device to modern authentication with Windows Hello Face, Fingerprint, or PIN. -- Windows Hello PIN sign-in support is [added to Safe mode](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#windows-hello-pin-in-safe-mode-build-18995). -- Windows Hello for Business now has Hybrid Azure Active Directory support and phone number sign-in (MSA). FIDO2 security key support is expanded to Azure Active Directory hybrid environments, enabling enterprises with hybrid environments to take advantage of [passwordless authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises). For more information, see [Expanding Azure Active Directory support for FIDO2 preview to hybrid environments](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/expanding-azure-active-directory-support-for-fido2-preview-to/ba-p/981894). + ### Windows Defender System Guard -In this release, [Windows Defender System Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) enables an even *higher* level of [System Management Mode](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows#system-management-mode-smm-protection) (SMM) Firmware Protection that goes beyond checking the OS memory and secrets to additional resources like registers and IO. -With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. This feature is forward-looking and currently requires new hardware available soon. - - ![System Guard](images/system-guard2.png) ### Windows Defender Application Guard -[Windows Defender Application Guard](https://docs.microsoft.com/deployedge/microsoft-edge-security-windows-defender-application-guard) has been available for Chromium-based Edge since early 2020. -Note: [Application Guard for Office](https://support.office.com/article/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46) is coming soon. ## Deployment +### Windows Update + +For more information, see [What's next for Windows 10 updates](https://blogs.windows.com/windowsexperience/2020/06/16/whats-next-for-windows-10-updates/). + ### Windows Setup -Windows Setup [answer files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/update-windows-settings-and-scripts-create-your-own-answer-file-sxs) (unattend.xml) have [improved language ](https://oofhours.com/2020/06/01/new-in-windows-10-2004-better-language-handling/). -Improvements in Windows Setup with this release also include: -- Reduced offline time during feature updates -- Improved controls for reserved storage -- Improved controls and diagnostics -- New recovery options For more information, see Windows Setup enhancements in the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/pilot-new-features-with-the-windows-insider-program-for-business/ba-p/1220464). ### SetupDiag -In Windows 10, version 2004, SetupDiag is now automatically installed. -[SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues. - -During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup. ### Windows Autopilot -With this release, you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903. -If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles. ### Microsoft Endpoint Manager -An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364). -Also see [What's new in Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/whats-new). ### Windows Assessment and Deployment Toolkit (ADK) -Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install). -For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004). ### Microsoft Deployment Toolkit (MDT) -MDT version 8456 supports Windows 10, version 2004, but there is currently an issue that causes MDT to incorrectly detect that UEFI is present. There is an [update available](https://support.microsoft.com/help/4564442/windows-10-deployments-fail-with-microsoft-deployment-toolkit) for MDT to address this issue. -For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes). ## Servicing ### Delivery Optimization -Windows PowerShell cmdlets have been improved: -- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). -- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. -- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting. - -Additional improvements: -- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. -- Automatic cloud-based congestion detection is available for PCs with cloud service support. - -The following [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) policies are removed in this release: - -- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) - - Reason: Replaced with separate policies for foreground and background -- Max Upload Bandwidth (DOMaxUploadBandwidth) - - Reason: impacts uploads to internet peers only, which isn't used in Enterprises. -- Absolute max throttle (DOMaxDownloadBandwidth) - - Reason: separated to foreground and background ### Windows Update for Business -[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include: -- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. -- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds. -- Update less: Last year, we [changed update installation policies](https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency/#l2jH7KMkOkfcWdBs.97) for Windows 10 to only target devices running a feature update version that is nearing end of service. As a result, many devices are only updating once a year. To enable all devices to make the most of this policy change, and to prevent confusion, we have removed deferrals from the Windows Update settings **Advanced Options** page starting on Windows 10, version 2004. If you wish to continue leveraging deferrals, you can use local Group Policy (**Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview builds and Feature Updates are received** or **Select when Quality Updates are received**). For more information about this change, see [Simplified Windows Update settings for end users](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplified-windows-update-settings-for-end-users/ba-p/1497215). + ## Networking ### Wi-Fi 6 and WPA3 -Windows now supports the latest Wi-Fi standards with [Wi-Fi 6 and WPA3](https://support.microsoft.com/help/4562575/windows-10-faster-more-secure-wifi). Wi-Fi 6 gives you better wireless coverage and performance with added security. WPA3 provides improved Wi-Fi security and secures open networks. + ### TEAP -In this release, Tunnel Extensible Authentication Protocol (TEAP) has been added as an authentication method to allow chaining together multiple credentials into a single EAP transaction. TEAP networks can be configured by [enterprise policy](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpwl/94cf6896-c28e-4865-b12a-d83ee38cd3ea). + ## Virtualization ### Windows Sandbox -[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bug fixes and enables even more control over configuration. -[Windows Sandbox configuration](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file) includes: -- MappedFolders now supports a destination folder. Previously no destination could be specified, it was always mapped to the Sandbox desktop. -- AudioInput/VideoInput settings now enable you to share their host microphone or webcam with the Sandbox. -- ProtectedClient is a new security setting that runs the connection to the Sandbox with extra security settings enabled. This is disabled by default due to issues with copy & paste. -- PrinterRedirection: You can now enable and disable host printer sharing with the Sandbox. -- ClipboardRedirection: You can now enable and disable host clipboard sharing with the Sandbox. -- MemoryInMB adds the ability to specify the maximum memory usage of the Sandbox. - -Windows Media Player is also added back to the Sandbox image in this release. - -Windows Sandbox also has improved accessibility in this release, including: -- Microphone support is available. -- Added functionality to configure the audio input device via the Windows Sandbox config file. -- A Shift + Alt + PrintScreen key sequence that activates the ease of access dialog for enabling high contrast mode. -- A ctrl + alt + break key sequence that allows entering/exiting fullscreen mode. ### Windows Subsystem for Linux (WSL) -With this release, memory that is no longer in use in a Linux VM will be freed back to Windows. Previously, a WSL VM's memory could grow, but would not shrink when no longer needed. -[WSL2](https://docs.microsoft.com/windows/wsl/wsl2-index) support has been added for ARM64 devices if your device supports virtualization. - -For a full list of updates to WSL, see the [WSL release notes](https://docs.microsoft.com/windows/wsl/release-notes). ### Windows Virtual Desktop (WVD) -Windows 10 is an integral part of WVD, and several enhancements are available in the Spring 2020 update. Check out [Windows Virtual Desktop documentation](https://aka.ms/wvdgetstarted) for the latest and greatest information, as well as the [WVD Virtual Event from March](https://aka.ms/wvdvirtualevent). ## Microsoft Edge -Read about plans for the new Microsoft Edge and other innovations announced at [Build 2020](https://blogs.windows.com/msedgedev/2020/05/19/microsoft-edge-news-developers-build-2020/) and [What's new at Microsoft Edge Insider](https://www.microsoftedgeinsider.com/whats-new). -Also see information about the exciting new Edge browser [here](https://blogs.windows.com/windowsexperience/2020/01/15/new-year-new-browser-the-new-microsoft-edge-is-out-of-preview-and-now-available-for-download/). ## Application settings -This release enables explicit [control over when Windows automatically restarts apps](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#control-over-restarting-apps-at-sign-in-build-18965) that were open when you restart your PC. - ## Windows Shell Several enhancements to the Windows 10 user interface are implemented in this release: ### Cortana -[Cortana](https://www.microsoft.com/cortana) has been updated and enhanced in Windows 10, version 2004: -- Productivity: chat-based UI gives you the ability to [interact with Cortana using typed or spoken natural language queries](https://support.microsoft.com/help/4557165) to easily get information across Microsoft 365 and stay on track. Productivity focused capabilities such as finding people profiles, checking schedules, joining meetings, and adding to lists in Microsoft To Do are currently available to English speakers in the US. - - In the coming months, with regular app updates through the Microsoft Store, we’ll enhance this experience to support wake word invocation and enable listening when you say “Cortana,” offer more productivity capabilities such as surfacing relevant emails and documents to help you prepare for meetings, and expand supported capabilities for international users. -- Security: tightened access to Cortana so that you must be securely logged in with your work or school account or your Microsoft account before using Cortana. Because of this tightened access, some consumer skills including music, connected home, and third-party skills will no longer be available. Additionally, users [get cloud-based assistance services that meet Office 365’s enterprise-level privacy, security, and compliance promises](https://docs.microsoft.com/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide) as set out in the Online Services Terms. -- Move the Cortana window: drag the Cortana window to a more convenient location on your desktop. -For updated information, see the [Microsoft 365 blog](https://aka.ms/CortanaUpdatesMay2020). + + ### Windows Search -Windows Search is improved in several ways. For more information, see [Supercharging Windows Search](https://aka.ms/AA8kllm). + ### Virtual Desktops -You can now [rename your virtual desktops](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#renaming-your-virtual-desktops-build-18975), instead of getting stuck with the system-issued names like Desktop 1. + ### Bluetooth pairing -Pairing Bluetooth devices with your computer will occur through notifications, so you won't need to go to the Settings app to finish pairing. Other improvements include faster pairing and device name display. For more information, see [Improving your Bluetooth pairing experience](https://docs.microsoft.com/windows-insider/at-home/Whats-new-wip-at-home-20h1#improving-your-bluetooth-pairing-experience-build-18985). + ### Reset this PC -The 'reset this PC' recovery function now includes a [cloud download](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-reset-this-pc-option-cloud-download-build-18970) option. + ### Task Manager -The following items are added to Task Manager in this release: -- GPU Temperature is available on the Performance tab for devices with a dedicated GPU card. -- Disk type is now [listed for each disk on the Performance tab](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#disk-type-visible-in-task-manager-performance-tab-build-18898). + ## Graphics & display ### DirectX -[New DirectX 12 features](https://devblogs.microsoft.com/directx/dev-preview-of-new-directx-12-features/) are available in this release. + ### 2-in-1 PCs -A [new tablet experience](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-tablet-experience-for-2-in-1-convertible-pcs-build-18970) for two-in-one convertible PCs is available. The screen will be optimized for touch when you detach your two-in-one's keyboard, but you'll still keep the familiar look of your desktop without interruption. + ### Specialized displays -With this update, devices running Windows 10 Enterprise or Windows 10 Pro for Workstations with multiple displays can be configured to prevent Windows from using a display, making it available for a specialized purpose. -Examples include: -- Fixed-function arcade & gaming such as cockpit, driving, flight, and military simulators -- Medical imaging devices with custom panels, such as grayscale X-ray displays -- Video walls like those displayed in Microsoft Store -- Dedicated video monitoring -- Monitor panel testing and validation -- Independent Hardware Vendor (IHV) driver testing and validation - -To prevent Windows from using a display, choose Settings > Display and click Advanced display settings. Select a display to view or change, and then set the Remove display from desktop setting to On. The display will now be available for a specialized use. ## Desktop Analytics From f238d78628a1041ff5819a7dc38fd7ec7acdc4d3 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 15 Oct 2020 13:23:26 -0700 Subject: [PATCH 25/82] updates --- ...ew-in-windows-mdm-enrollment-management.md | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ba8dc31c1f..a1e771af09 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -24,6 +24,7 @@ This topic provides information about what's new and breaking changes in Windows For details about Microsoft mobile device management protocols for Windows 10 see [\[MS-MDM\]: Mobile Device Management Protocol](https://go.microsoft.com/fwlink/p/?LinkId=619346) and [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). - **What’s new in MDM for Windows 10 versions** + - [What’s new in MDM for Windows 10, version 2010](#whats-new-in-mdm-for-windows-10-version-2010) - [What’s new in MDM for Windows 10, version 2004](#whats-new-in-mdm-for-windows-10-version-2004) - [What’s new in MDM for Windows 10, version 1909](#whats-new-in-mdm-for-windows-10-version-1909) - [What’s new in MDM for Windows 10, version 1903](#whats-new-in-mdm-for-windows-10-version-1903) @@ -92,6 +93,58 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [September 2017](#september-2017) - [August 2017](#august-2017) +## What’s new in MDM for Windows 10, version 2010 + ++++ + + + + + + + + + + + + + + + + + + + + +
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 2010:

+ + +

Updated the following policy in Windows 10, version 2004:

+ + +

Deprecated the following policies in Windows 10, version 2004:

+ +
DevDetail CSP

Added the following new node:
Ext/Microsoft/DNSComputerName

+
EnterpriseModernAppManagement CSP

Added the following new node:
IsStub

+
SUPL CSP

Added the following new node:
FullVersion

+
+ ## What’s new in MDM for Windows 10, version 2004 From 19fe418cbb0427db7819ab1d98b91b65516e5add Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 16 Oct 2020 08:58:02 +0530 Subject: [PATCH 26/82] removed broken link added new correct link as per the user report #8473 , so i replaced the broken link to correct link. --- windows/security/threat-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index b4f683756c..3763417926 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -17,7 +17,7 @@ ms.topic: conceptual --- # Threat Protection -[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture. +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture. >[!TIP] > Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/). From 5bd71e4a71d3a64f6e34485f6c7c69e659d5cb27 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 16 Oct 2020 13:13:53 -0700 Subject: [PATCH 27/82] Add note on panics on Big Sur --- .../threat-protection/microsoft-defender-atp/mac-whatsnew.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index ca4617cc28..98c20cb71d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -46,6 +46,10 @@ ms.topic: conceptual ## 101.09.50 - This product version has been validated on macOS Big Sur 11 beta 9 + + > [!IMPORTANT] + > Extensive testing of MDE (Microsoft Defender for Endpoint) with new macOS system extensions revealed an intermittent issue that impacts macOS devices with specific graphic cards models. In rare cases on impacted macOS devices calls into macOS system extensions were seen resulting in kernel panic. Microsoft is actively working with Apple engineering to clarify profile of impacted devices and to address this macOS issue. + - The new syntax for the `mdatp` command-line tool is now the default one. For more information on the new syntax, see [Resources for Microsoft Defender ATP for Mac](mac-resources.md#configuring-from-the-command-line) > [!NOTE] From af6a53971c885b247d51d319cd7c6e34a9638e78 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 16 Oct 2020 13:56:21 -0700 Subject: [PATCH 28/82] HTML to MD conversion --- ...ew-in-windows-mdm-enrollment-management.md | 1314 ++--------------- 1 file changed, 124 insertions(+), 1190 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index a1e771af09..50aa1ad7e8 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -94,1215 +94,149 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [August 2017](#august-2017) ## What’s new in MDM for Windows 10, version 2010 -
---- - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 2010:

- - -

Updated the following policy in Windows 10, version 2004:

- - -

Deprecated the following policies in Windows 10, version 2004:

- -
DevDetail CSP

Added the following new node:
Ext/Microsoft/DNSComputerName

-
EnterpriseModernAppManagement CSP

Added the following new node:
IsStub

-
SUPL CSP

Added the following new node:
FullVersion

-
+|New or updated topic|Description| +|-----|-----| +|[Policy CSP - MixedReality](policy-csp-mixedreality.md)|Added the new MixedReality policy CSP.| +|[Policy CSP - LocalUsersandGroups](policy-csp-localusersandgroups.md)|Added the new LocalUsersandGroups policy CSP.| ## What’s new in MDM for Windows 10, version 2004 - ---- - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 2004:

- +| New or updated topic | Description | +|-----|-----| +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 2004:
- [ApplicationManagement/BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall)
- [Bluetooth/SetMinimumEncryptionKeySize](policy-csp-bluetooth.md#bluetooth-setminimumencryptionkeysize)
- [DeliveryOptimization/DOCacheHostSource]("policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource)
- [DeliveryOptimization/DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth)
- [DeliveryOptimization/DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth)
- [Education/AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator)
- [TextInput/ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion)
- [TextInput/ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion)
- [TextInput/ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion)

Updated the following policy in Windows 10, version 2004:
- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost)

Deprecated the following policies in Windows 10, version 2004:
- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth)
- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth)
- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) | +| [DevDetail CSP](devdetail-csp.md) | Added the following new node:
- Ext/Microsoft/DNSComputerName | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following new node:
- IsStub | +| [SUPL CSP](supl-csp.md) | Added the following new node:
- FullVersion | -

Updated the following policy in Windows 10, version 2004:

- - -

Deprecated the following policies in Windows 10, version 2004:

- -
DevDetail CSP

Added the following new node:
Ext/Microsoft/DNSComputerName

-
EnterpriseModernAppManagement CSP

Added the following new node:
IsStub

-
SUPL CSP

Added the following new node:
FullVersion

-
## What’s new in MDM for Windows 10, version 1909 - ---- - - - - - - - - - - - -
New or updated topicDescription
BitLocker CSP
Added the following new nodes in Windows 10, version 1909:

-ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID. -
+| New or updated topic | Description | +|-----|-----| +| [BitLocker CSP](bitlocker-csp.md) | Added the following new nodes in Windows 10, version 1909:
- ConfigureRecoveryPasswordRotation
- RotateRecoveryPasswords
- RotateRecoveryPasswordsStatus
- RotateRecoveryPasswordsRequestID| ## What’s new in MDM for Windows 10, version 1903 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 1903:

-
Policy CSP - Audit

Added new Audit policies in Windows 10, version 1903.

-
ApplicationControl CSP

Added new CSP in Windows 10, version 1903.

-
Defender CSP

Added the following new nodes:
Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.

-
DiagnosticLog CSP
-DiagnosticLog DDF

Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
-Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. -

-
EnrollmentStatusTracking CSP

Added new CSP in Windows 10, version 1903.

-
PassportForWork CSP

Added the following new nodes in Windows 10, version 1903:
SecurityKey, SecurityKey/UseSecurityKeyForSignin

-
+| New or updated topic | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 1903:
- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground)
- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground)
- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring)
- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope)
- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination)
- [DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids)
- [DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids)
- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload)
- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview)
- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync)
- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation)
- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete)
- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage)
- [Power/EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery)
- [Power/EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin)
- [Power/SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery)
- [Power/SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin)
- [Power/SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery)
- [Power/SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin)
- [Power/SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery)
- [Power/SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin)
- [Power/TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery)
- [Power/TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin)
- [Power/UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery)
- [Power/UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin)
- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice)
- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock)
- [Search/AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles)
- [ServiceControlManager/SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation)
- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline)
- [System/TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory)
- [TimeLanguageSettings/ConfigureTimeZone](policy-csp-timelanguagesettings.md#timelanguagesettings-configuretimezone)
- [Troubleshooting/AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations)
- [Update/AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup)
- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates)
- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates)
- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod)
- [WindowsLogon/AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon)
- [WindowsLogon/ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon)
- [WindowsLogon/EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation)| +| [Policy CSP - Audit](policy-csp-audit.md) | Added the new Audit policy CSP. | +| [ApplicationControl CSP](applicationcontrol-csp.md) | Added the new CSP. | +| [Defender CSP](defender-csp.md) | Added the following new nodes:
- Health/TamperProtectionEnabled
- Health/IsVirtualMachine
- Configuration
- Configuration/TamperProtection
- Configuration/EnableFileHashComputation | +| [DiagnosticLog CSP](diagnosticlog-csp.md)
[DiagnosticLog DDF](diagnosticlog-ddf.md) | Added version 1.4 of the CSP in Windows 10, version 1903.
Added the new 1.4 version of the DDF.
Added the following new nodes:
- Policy
- Policy/Channels
- Policy/Channels/ChannelName
- Policy/Channels/ChannelName/MaximumFileSize
- Policy/Channels/ChannelName/SDDL
- Policy/Channels/ChannelName/ActionWhenFull
- Policy/Channels/ChannelName/Enabled
- DiagnosticArchive
- DiagnosticArchive/ArchiveDefinition
- DiagnosticArchive/ArchiveResults | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | Added the new CSP. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new nodes:
- SecurityKey
- SecurityKey/UseSecurityKeyForSignin | + ## What’s new in MDM for Windows 10, version 1809 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies in Windows 10, version 1809:

-
    -
  • ApplicationManagement/LaunchAppAfterLogOn
    • -
  • ApplicationManagement/ScheduleForceRestartForUpdateFailures
    • -
  • Authentication/EnableFastFirstSignIn (Preview mode only)
    • -
  • Authentication/EnableWebSignIn (Preview mode only)
    • -
  • Authentication/PreferredAadTenantDomainName
    • -
  • Browser/AllowFullScreenMode
    • -
  • Browser/AllowPrelaunch
    • -
  • Browser/AllowPrinting
    • -
  • Browser/AllowSavingHistory
    • -
  • Browser/AllowSideloadingOfExtensions
    • -
  • Browser/AllowTabPreloading
    • -
  • Browser/AllowWebContentOnNewTabPage
    • -
  • Browser/ConfigureFavoritesBar
    • -
  • Browser/ConfigureHomeButton
    • -
  • Browser/ConfigureKioskMode
    • -
  • Browser/ConfigureKioskResetAfterIdleTimeout
    • -
  • Browser/ConfigureOpenMicrosoftEdgeWith
    • -
  • Browser/ConfigureTelemetryForMicrosoft365Analytics
    • -
  • Browser/PreventCertErrorOverrides
    • -
  • Browser/SetHomeButtonURL
    • -
  • Browser/SetNewTabPageURL
    • -
  • Browser/UnlockHomeButton
    • -
  • Defender/CheckForSignaturesBeforeRunningScan
    • -
  • Defender/DisableCatchupFullScan
    • -
  • Defender/DisableCatchupQuickScan
    • -
  • Defender/EnableLowCPUPriority
    • -
  • Defender/SignatureUpdateFallbackOrder
    • -
  • Defender/SignatureUpdateFileSharesSources
    • -
  • DeviceGuard/ConfigureSystemGuardLaunch
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • -
  • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • -
  • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • -
  • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • -
  • DmaGuard/DeviceEnumerationPolicy
    • -
  • Experience/AllowClipboardHistory
    • -
  • Experience/DoNotSyncBrowserSettings
    • -
  • Experience/PreventUsersFromTurningOnBrowserSyncing
    • -
  • Kerberos/UPNNameHints
    • -
  • Privacy/AllowCrossDeviceClipboard
    • -
  • Privacy/DisablePrivacyExperience
    • -
  • Privacy/UploadUserActivities
    • -
  • Security/RecoveryEnvironmentAuthentication
    • -
  • System/AllowDeviceNameInDiagnosticData
    • -
  • System/ConfigureMicrosoft365UploadEndpoint
    • -
  • System/DisableDeviceDelete
    • -
  • System/DisableDiagnosticDataViewer
    • -
  • Storage/RemovableDiskDenyWriteAccess
    • -
  • TaskManager/AllowEndTask
    • -
  • Update/EngagedRestartDeadlineForFeatureUpdates
    • -
  • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
    • -
  • Update/EngagedRestartTransitionScheduleForFeatureUpdates
    • -
  • Update/SetDisablePauseUXAccess
    • -
  • Update/SetDisableUXWUAccess
    • -
  • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • -
  • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
    • -
  • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
    • -
  • WindowsLogon/DontDisplayNetworkSelectionUI
    • -
-
PassportForWork CSP

Added new settings in Windows 10, version 1809.

-
EnterpriseModernAppManagement CSP

Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

-
Win32CompatibilityAppraiser CSP

Added new configuration service provider in Windows 10, version 1809.

-
WindowsLicensing CSP

Added S mode settings and SyncML examples in Windows 10, version 1809.

-
SUPL CSP

Added 3 new certificate nodes in Windows 10, version 1809.

-
Defender CSP

Added a new node Health/ProductStatus in Windows 10, version 1809.

-
BitLocker CSP

Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

-
DevDetail CSP

Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

-
Wifi CSP

Added a new node WifiCost in Windows 10, version 1809.

-
WindowsDefenderApplicationGuard CSP

Added new settings in Windows 10, version 1809.

-
RemoteWipe CSP

Added new settings in Windows 10, version 1809.

-
TenantLockdown CSP

Added new CSP in Windows 10, version 1809.

-
Office CSP

Added FinalStatus setting in Windows 10, version 1809.

-
+| New or updated topic | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policy settings in Windows 10, version 1809:
- ApplicationManagement/LaunchAppAfterLogOn
- ApplicationManagement/ScheduleForceRestartForUpdateFailures
- Authentication/EnableFastFirstSignIn (Preview mode only)
- Authentication/EnableWebSignIn (Preview mode only)
- Authentication/PreferredAadTenantDomainName
- Browser/AllowFullScreenMode
- Browser/AllowPrelaunch
- Browser/AllowPrinting
- Browser/AllowSavingHistory
- Browser/AllowSideloadingOfExtensions
- Browser/AllowTabPreloading
- Browser/AllowWebContentOnNewTabPage
- Browser/ConfigureFavoritesBar
- Browser/ConfigureHomeButton
- Browser/ConfigureKioskMode
- Browser/ConfigureKioskResetAfterIdleTimeout
- Browser/ConfigureOpenMicrosoftEdgeWith
- Browser/ConfigureTelemetryForMicrosoft365Analytics
- Browser/PreventCertErrorOverrides
- Browser/SetHomeButtonURL
- Browser/SetNewTabPageURL
- Browser/UnlockHomeButton
- Defender/CheckForSignaturesBeforeRunningScan
- Defender/DisableCatchupFullScan
- Defender/DisableCatchupQuickScan
- Defender/EnableLowCPUPriority
- Defender/SignatureUpdateFallbackOrder
- Defender/SignatureUpdateFileSharesSources
- DeviceGuard/ConfigureSystemGuardLaunch
- DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
- DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
- DeviceInstallation/PreventDeviceMetadataFromNetwork
- DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
- DmaGuard/DeviceEnumerationPolicy
- Experience/AllowClipboardHistory
- Experience/DoNotSyncBrowserSettings
- Experience/PreventUsersFromTurningOnBrowserSyncing
- Kerberos/UPNNameHints
- Privacy/AllowCrossDeviceClipboard
- Privacy/DisablePrivacyExperience
- Privacy/UploadUserActivities
- Security/RecoveryEnvironmentAuthentication
- System/AllowDeviceNameInDiagnosticData
- System/ConfigureMicrosoft365UploadEndpoint
- System/DisableDeviceDelete
- System/DisableDiagnosticDataViewer
- Storage/RemovableDiskDenyWriteAccess
- TaskManager/AllowEndTask
- Update/EngagedRestartDeadlineForFeatureUpdates
- Update/EngagedRestartSnoozeScheduleForFeatureUpdates
- Update/EngagedRestartTransitionScheduleForFeatureUpdates
- Update/SetDisablePauseUXAccess
- Update/SetDisableUXWUAccess
- WindowsDefenderSecurityCenter/DisableClearTpmButton
- WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
- WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
- WindowsLogon/DontDisplayNetworkSelectionUI | +| [BitLocker CSP](bitlocker-csp.md) | Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro. | +| [Defender CSP](defender-csp.md) | Added a new node Health/ProductStatus in Windows 10, version 1809. | +| [DevDetail CSP](devdetail-csp.md) | Added a new node SMBIOSSerialNumber in Windows 10, version 1809. | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added NonRemovable setting under AppManagement node in Windows 10, version 1809. | +| [Office CSP](office-csp.md) | Added FinalStatus setting in Windows 10, version 1809. | +| [PassportForWork CSP](passportforwork-csp.md) | Added new settings in Windows 10, version 1809. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new settings in Windows 10, version 1809. | +| [SUPL CSP](supl-csp.md) | Added 3 new certificate nodes in Windows 10, version 1809. | +| [TenantLockdown CSP](tenantlockdown-csp.md) | Added new CSP in Windows 10, version 1809. | +| [Wifi CSP](wifi-csp.md) | Added a new node WifiCost in Windows 10, version 1809. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Added new settings in Windows 10, version 1809. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added S mode settings and SyncML examples in Windows 10, version 1809. | +| [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md) | Added new configuration service provider in Windows 10, version 1809. | + ## What’s new in MDM for Windows 10, version 1803 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
New or updated topicDescription
Policy CSP

Added the following new policies for Windows 10, version 1803:

-
    -
  • ApplicationDefaults/EnableAppUriHandlers
    • -
  • ApplicationManagement/MSIAllowUserControlOverInstall
    • -
  • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
    • -
  • Bluetooth/AllowPromptedProximalConnections
    • -
  • Browser/AllowConfigurationUpdateForBooksLibrary
    • -
  • Browser/AlwaysEnableBooksLibrary
    • -
  • Browser/EnableExtendedBooksTelemetry
    • -
  • Browser/UseSharedFolderForBooks
    • -
  • Connectivity/AllowPhonePCLinking
    • -
  • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    • -
  • DeliveryOptimization/DODelayForegroundDownloadFromHttp
    • -
  • DeliveryOptimization/DOGroupIdSource
    • -
  • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
    • -
  • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
    • -
  • DeliveryOptimization/DORestrictPeerSelectionBy
    • -
  • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
    • -
  • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
    • -
  • Display/DisablePerProcessDpiForApps
    • -
  • Display/EnablePerProcessDpi
    • -
  • Display/EnablePerProcessDpiForApps
    • -
  • Experience/AllowWindowsSpotlightOnSettings
    • -
  • KioskBrowser/BlockedUrlExceptions
    • -
  • KioskBrowser/BlockedUrls
    • -
  • KioskBrowser/DefaultURL
    • -
  • KioskBrowser/EnableEndSessionButton
    • -
  • KioskBrowser/EnableHomeButton
    • -
  • KioskBrowser/EnableNavigationButtons
    • -
  • KioskBrowser/RestartOnIdleTime
    • -
  • LanmanWorkstation/EnableInsecureGuestLogons
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
    • -
  • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • -
  • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • -
  • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
    • -
  • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • -
  • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
    • -
  • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
    • -
  • Notifications/DisallowCloudNotification
    • -
  • RestrictedGroups/ConfigureGroupMembership
    • -
  • Search/AllowCortanaInAAD
    • -
  • Search/DoNotUseWebResults
    • -
  • Security/ConfigureWindowsPasswords
    • -
  • Start/DisableContextMenus
    • -
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
    • -
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
    • -
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • -
  • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
    • -
  • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
    • -
  • TaskScheduler/EnableXboxGameSaveTask
    • -
  • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
    • -
  • TextInput/ForceTouchKeyboardDockedState
    • -
  • TextInput/TouchKeyboardDictationButtonAvailability
    • -
  • TextInput/TouchKeyboardEmojiButtonAvailability
    • -
  • TextInput/TouchKeyboardFullModeAvailability
    • -
  • TextInput/TouchKeyboardHandwritingModeAvailability
    • -
  • TextInput/TouchKeyboardNarrowModeAvailability
    • -
  • TextInput/TouchKeyboardSplitModeAvailability
    • -
  • TextInput/TouchKeyboardWideModeAvailability
    • -
  • Update/ConfigureFeatureUpdateUninstallPeriod
    • -
  • Update/TargetReleaseVersion
    • -
  • UserRights/AccessCredentialManagerAsTrustedCaller
    • -
  • UserRights/AccessFromNetwork
    • -
  • UserRights/ActAsPartOfTheOperatingSystem
    • -
  • UserRights/AllowLocalLogOn
    • -
  • UserRights/BackupFilesAndDirectories
    • -
  • UserRights/ChangeSystemTime
    • -
  • UserRights/CreateGlobalObjects
    • -
  • UserRights/CreatePageFile
    • -
  • UserRights/CreatePermanentSharedObjects
    • -
  • UserRights/CreateSymbolicLinks
    • -
  • UserRights/CreateToken
    • -
  • UserRights/DebugPrograms
    • -
  • UserRights/DenyAccessFromNetwork
    • -
  • UserRights/DenyLocalLogOn
    • -
  • UserRights/DenyRemoteDesktopServicesLogOn
    • -
  • UserRights/EnableDelegation
    • -
  • UserRights/GenerateSecurityAudits
    • -
  • UserRights/ImpersonateClient
    • -
  • UserRights/IncreaseSchedulingPriority
    • -
  • UserRights/LoadUnloadDeviceDrivers
    • -
  • UserRights/LockMemory
    • -
  • UserRights/ManageAuditingAndSecurityLog
    • -
  • UserRights/ManageVolume
    • -
  • UserRights/ModifyFirmwareEnvironment
    • -
  • UserRights/ModifyObjectLabel
    • -
  • UserRights/ProfileSingleProcess
    • -
  • UserRights/RemoteShutdown
    • -
  • UserRights/RestoreFilesAndDirectories
    • -
  • UserRights/TakeOwnership
    • -
  • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
    • -
  • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
    • -
  • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
    • -
  • WindowsDefenderSecurityCenter/HideSecureBoot
    • -
  • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
    • -
-

Security/RequireDeviceEncryption - updated to show it is supported in desktop.

-
BitLocker CSP

Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

-
DMClient CSP

Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

-
    -
  • AADSendDeviceToken
    • -
  • BlockInStatusPage
    • -
  • AllowCollectLogsButton
    • -
  • CustomErrorText
    • -
  • SkipDeviceStatusPage
    • -
  • SkipUserStatusPage
    • -
-
Defender CSP

Added new node (OfflineScan) in Windows 10, version 1803.

-
UEFI CSP

Added a new CSP in Windows 10, version 1803.

-
Update CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Rollback
    • -
  • Rollback/FeatureUpdate
    • -
  • Rollback/QualityUpdateStatus
    • -
  • Rollback/FeatureUpdateStatus
    • -
-
AssignedAccess CSP

Added the following nodes in Windows 10, version 1803:

-
    -
  • Status
    • -
  • ShellLauncher
    • -
  • StatusConfiguration
    • -
-

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

-
MultiSIM CSP

Added a new CSP in Windows 10, version 1803.

-
EnterpriseModernAppManagement CSP

Added the following node in Windows 10, version 1803:

-
    -
  • MaintainProcessorArchitectureOnUpdate
    • -
-
eUICCs CSP

Added the following node in Windows 10, version 1803:

-
    -
  • IsEnabled
    • -
-
DeviceStatus CSP

Added the following node in Windows 10, version 1803:

-
    -
  • OS/Mode
    • -
-
AccountManagement CSP

Added a new CSP in Windows 10, version 1803.

-
RootCATrustedCertificates CSP

Added the following node in Windows 10, version 1803:

-
    -
  • UntrustedCertificates
    • -
-
NetworkProxy CSP

Added the following node in Windows 10, version 1803:

-
    -
  • ProxySettingsPerUser
    • -
-
Accounts CSP

Added a new CSP in Windows 10, version 1803.

-
MDM Migration Analysis Too (MMAT)

Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

-
CSP DDF files download

Added the DDF download of Windows 10, version 1803 configuration service providers.

-
+| New or updated topic | Description | +|-----|-----| +|[Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1803:
- ApplicationDefaults/EnableAppUriHandlers
- ApplicationManagement/MSIAllowUserControlOverInstall
- ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
- Bluetooth/AllowPromptedProximalConnections
- Browser/AllowConfigurationUpdateForBooksLibrary
- Browser/AlwaysEnableBooksLibrary
- Browser/EnableExtendedBooksTelemetry
- Browser/UseSharedFolderForBooks
- Connectivity/AllowPhonePCLinking
- DeliveryOptimization/DODelayBackgroundDownloadFromHttp
- DeliveryOptimization/DODelayForegroundDownloadFromHttp
- DeliveryOptimization/DOGroupIdSource
- DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
- DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
- DeliveryOptimization/DORestrictPeerSelectionBy
- DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
- DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
- Display/DisablePerProcessDpiForApps
- Display/EnablePerProcessDpi
- Display/EnablePerProcessDpiForApps
- Experience/AllowWindowsSpotlightOnSettings
- KioskBrowser/BlockedUrlExceptions
- KioskBrowser/BlockedUrls
- KioskBrowser/DefaultURL
- KioskBrowser/EnableEndSessionButton
- KioskBrowser/EnableHomeButton
- KioskBrowser/EnableNavigationButtons
- KioskBrowser/RestartOnIdleTime
- LanmanWorkstation/EnableInsecureGuestLogons
- LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
- LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
- LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
- LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
- LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
- LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
- LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
- LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
- LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
- LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
- Notifications/DisallowCloudNotification
- RestrictedGroups/ConfigureGroupMembership
- Search/AllowCortanaInAAD
- Search/DoNotUseWebResults
- Security/ConfigureWindowsPasswords
- Start/DisableContextMenus
- System/FeedbackHubAlwaysSaveDiagnosticsLocally
- SystemServices/ConfigureHomeGroupListenerServiceStartupMode
- SystemServices/ConfigureHomeGroupProviderServiceStartupMode
- SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
- SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
- SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
- SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
- TaskScheduler/EnableXboxGameSaveTask
- TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
- TextInput/ForceTouchKeyboardDockedState
- TextInput/TouchKeyboardDictationButtonAvailability
- TextInput/TouchKeyboardEmojiButtonAvailability
- TextInput/TouchKeyboardFullModeAvailability
- TextInput/TouchKeyboardHandwritingModeAvailability
- TextInput/TouchKeyboardNarrowModeAvailability
- TextInput/TouchKeyboardSplitModeAvailability
- TextInput/TouchKeyboardWideModeAvailability
- Update/ConfigureFeatureUpdateUninstallPeriod
- Update/TargetReleaseVersion
- UserRights/AccessCredentialManagerAsTrustedCaller
- UserRights/AccessFromNetwork
- UserRights/ActAsPartOfTheOperatingSystem
- UserRights/AllowLocalLogOn
- UserRights/BackupFilesAndDirectories
- UserRights/ChangeSystemTime
- UserRights/CreateGlobalObjects
- UserRights/CreatePageFile
- UserRights/CreatePermanentSharedObjects
- UserRights/CreateSymbolicLinks
- UserRights/CreateToken
- UserRights/DebugPrograms
- UserRights/DenyAccessFromNetwork
- UserRights/DenyLocalLogOn
- UserRights/DenyRemoteDesktopServicesLogOn
- UserRights/EnableDelegation
- UserRights/GenerateSecurityAudits
- UserRights/ImpersonateClient
- UserRights/IncreaseSchedulingPriority
- UserRights/LoadUnloadDeviceDrivers
- UserRights/LockMemory
- UserRights/ManageAuditingAndSecurityLog
- UserRights/ManageVolume
- UserRights/ModifyFirmwareEnvironment
- UserRights/ModifyObjectLabel
- UserRights/ProfileSingleProcess
- UserRights/RemoteShutdown
- UserRights/RestoreFilesAndDirectories
- UserRights/TakeOwnership
- WindowsDefenderSecurityCenter/DisableAccountProtectionUI
- WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
- WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
- WindowsDefenderSecurityCenter/HideSecureBoot
- WindowsDefenderSecurityCenter/HideTPMTroubleshooting
- Security/RequireDeviceEncryption - updated to show it is supported in desktop. | +| [Accounts CSP](accounts-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AccountManagement CSP](accountmanagement-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following nodes in Windows 10, version 1803:
- Status
- ShellLauncher
- StatusConfiguration

Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite. | +| [BitLocker CSP](bitlocker-csp.md) | Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803. | +| [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) | Added the DDF download of Windows 10, version 1803 configuration service providers. | +| [Defender CSP](defender-csp.md) | Added new node (OfflineScan) in Windows 10, version 1803. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following node in Windows 10, version 1803:
- OS/Mode | +| [DMClient CSP](dmclient-csp.md) | Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:
- AADSendDeviceToken
- BlockInStatusPage
- AllowCollectLogsButton
- CustomErrorText
- SkipDeviceStatusPage
- SkipUserStatusPage | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | Added the following node in Windows 10, version 1803:
- MaintainProcessorArchitectureOnUpdate | +| [eUICCs CSP](euiccs-csp.md) | Added the following node in Windows 10, version 1803:
- IsEnabled | +| [MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat) | MDM Migration Analysis Too (MMAT)
Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies. | +| [MultiSIM CSP](multisim-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the following node in Windows 10, version 1803:
- ProxySettingsPerUser | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | Added the following node in Windows 10, version 1803:
- UntrustedCertificates | +| [UEFI CSP](uefi-csp.md) | Added a new CSP in Windows 10, version 1803. | +| [Update CSP](update-csp.md) | Added the following nodes in Windows 10, version 1803:
- Rollback
- Rollback/FeatureUpdate
- Rollback/QualityUpdateStatus
- Rollback/FeatureUpdateStatus | ## What’s new in MDM for Windows 10, version 1709 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription
The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

-
    -
  • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
    • -
  • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
    • -
  • DomainName - fully qualified domain name if the device is domain-joined.
    • -
-

For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

-
Firewall CSP

Added new CSP in Windows 10, version 1709.

-
eUICCs CSP

Added new CSP in Windows 10, version 1709.

-
WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
CM_ProxyEntries CSP and CMPolicy CSPIn Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
VPNv2 CSP

Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

-
DeviceStatus CSP

Added the following settings in Windows 10, version 1709:

-
    -
  • DeviceStatus/DomainName
    • -
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
    • -
  • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
    • -
  • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
    • -
-
AssignedAccess CSP

Added the following setting in Windows 10, version 1709.

-
    -
  • Configuration
    • -
-

Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

-
DeviceManageability CSP

Added the following settings in Windows 10, version 1709:

-
    -
  • Provider/ProviderID/ConfigInfo
    • -
  • Provider/ProviderID/EnrollmentInfo
    • -
-
Office CSP

Added the following setting in Windows 10, version 1709:

-
    -
  • Installation/CurrentStatus
    • -
-
DMClient CSP

Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

-
Bitlocker CSP

Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

-
ADMX-backed policies in Policy CSP

Added new policies.

-
Microsoft Store for Business and Microsoft Store

Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

-
MDM enrollment of Windows-based devices

New features in the Settings app:

-
    -
  • User sees installation progress of critical policies during MDM enrollment.
    • -
  • User knows what policies, profiles, apps MDM has configured
    • -
  • IT helpdesk can get detailed MDM diagnostic information using client tools
    • -
-

For details, see Managing connection and Collecting diagnostic logs

-
Enroll a Windows 10 device automatically using Group Policy

Added new topic to introduce a new Group Policy for automatic MDM enrollment.

-
Policy CSP

Added the following new policies for Windows 10, version 1709:

-
    -
  • Authentication/AllowAadPasswordReset
    • -
  • Authentication/AllowFidoDeviceSignon
    • -
  • Browser/LockdownFavorites
    • -
  • Browser/ProvisionFavorites
    • -
  • Cellular/LetAppsAccessCellularData
    • -
  • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
    • -
  • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
    • -
  • CredentialProviders/DisableAutomaticReDeploymentCredentials
    • -
  • DeviceGuard/EnableVirtualizationBasedSecurity
    • -
  • DeviceGuard/RequirePlatformSecurityFeatures
    • -
  • DeviceGuard/LsaCfgFlags
    • -
  • DeviceLock/MinimumPasswordAge
    • -
  • ExploitGuard/ExploitProtectionSettings
    • -
  • Games/AllowAdvancedGamingServices
    • -
  • Handwriting/PanelDefaultModeDocked
    • -
  • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
    • -
  • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
    • -
  • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
    • -
  • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
    • -
  • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
    • -
  • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
    • -
  • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
    • -
  • Power/DisplayOffTimeoutOnBattery
    • -
  • Power/DisplayOffTimeoutPluggedIn
    • -
  • Power/HibernateTimeoutOnBattery
    • -
  • Power/HibernateTimeoutPluggedIn
    • -
  • Power/StandbyTimeoutOnBattery
    • -
  • Power/StandbyTimeoutPluggedIn
    • -
  • Privacy/EnableActivityFeed
    • -
  • Privacy/PublishUserActivities
    • -
  • Defender/AttackSurfaceReductionOnlyExclusions
    • -
  • Defender/AttackSurfaceReductionRules
    • -
  • Defender/CloudBlockLevel
    • -
  • Defender/CloudExtendedTimeout
    • -
  • Defender/ControlledFolderAccessAllowedApplications
    • -
  • Defender/ControlledFolderAccessProtectedFolders
    • -
  • Defender/EnableControlledFolderAccess
    • -
  • Defender/EnableNetworkProtection
    • -
  • Education/DefaultPrinterName
    • -
  • Education/PreventAddingNewPrinters
    • -
  • Education/PrinterNames
    • -
  • Search/AllowCloudSearch
    • -
  • Security/ClearTPMIfNotReady
    • -
  • Settings/AllowOnlineTips
    • -
  • Start/HidePeopleBar
    • -
  • Storage/AllowDiskHealthModelUpdates
    • -
  • System/DisableEnterpriseAuthProxy
    • -
  • System/LimitEnhancedDiagnosticDataWindowsAnalytics
    • -
  • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
    • -
  • Update/DisableDualScan
    • -
  • Update/ManagePreviewBuilds
    • -
  • Update/ScheduledInstallEveryWeek
    • -
  • Update/ScheduledInstallFirstWeek
    • -
  • Update/ScheduledInstallFourthWeek
    • -
  • Update/ScheduledInstallSecondWeek
    • -
  • Update/ScheduledInstallThirdWeek
    • -
  • WindowsDefenderSecurityCenter/CompanyName
    • -
  • WindowsDefenderSecurityCenter/DisableAppBrowserUI
    • -
  • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
    • -
  • WindowsDefenderSecurityCenter/DisableFamilyUI
    • -
  • WindowsDefenderSecurityCenter/DisableHealthUI
    • -
  • WindowsDefenderSecurityCenter/DisableNetworkUI
    • -
  • WindowsDefenderSecurityCenter/DisableNotifications
    • -
  • WindowsDefenderSecurityCenter/DisableVirusUI
    • -
  • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
    • -
  • WindowsDefenderSecurityCenter/Email
    • -
  • WindowsDefenderSecurityCenter/EnableCustomizedToasts
    • -
  • WindowsDefenderSecurityCenter/EnableInAppCustomization
    • -
  • WindowsDefenderSecurityCenter/Phone
    • -
  • WindowsDefenderSecurityCenter/URL
    • -
  • WirelessDisplay/AllowMdnsAdvertisement
    • -
  • WirelessDisplay/AllowMdnsDiscovery
    • -
-
+| New or updated topic | Description | +|-----|-----| +| The [The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-mde2/4d7eadd5-3951-4f1c-8159-c39e07cbe692?redirectedfrom=MSDN) | The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:
- UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
-ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
- DomainName - fully qualified domain name if the device is domain-joined. | +| [Firewall CSP](firewall-csp.md) | Added new CSP in Windows 10, version 1709. | +| [eUICCs CSP](euiccs-csp.md) | Added new CSP in Windows 10, version 1709. | +| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)
[WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md) | New CSP added in Windows 10, version 1709. Also added the DDF topic. | +| [CM_ProxyEntries CSP](cm-proxyentries-csp.md) and [CMPolicy CSP](cmpolicy-csp.md) | In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. | +| [VPNv2 CSP](vpnv2-csp.md) | Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709. | +| [DeviceStatus CSP](devicestatus-csp.md) | Added the following settings in Windows 10, version 1709:
- DeviceStatus/DomainName
- DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
- DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
- DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus | +| [AssignedAccess CSP](assignedaccess-csp.md) | Added the following setting in Windows 10, version 1709:
- Configuration
Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro. | +| [DeviceManageability CSP](devicemanageability-csp.md) | Added the following settings in Windows 10, version 1709:
- Provider/_ProviderID_/ConfigInfo
- Provider/_ProviderID_/EnrollmentInfo | +| [Office CSP](office-csp.md) | Added the following setting in Windows 10, version 1709:
- Installation/CurrentStatus | +| [DMClient CSP](dmclient-csp.md) | Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics. | +| [Bitlocker CSP](bitlocker-csp.md) | Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. | +| [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md) | Added new policies. | +| Microsoft Store for Business and Microsoft Store | Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store. | +| [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) | New features in the Settings app:
- User sees installation progress of critical policies during MDM enrollment.
- User knows what policies, profiles, apps MDM has configured
- IT helpdesk can get detailed MDM diagnostic information using client tools
For details, see [Managing connection](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#manage-connections) and [Collecting diagnostic logs](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#collecting-diagnostic-logs).| +| [Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md) | Added new topic to introduce a new Group Policy for automatic MDM enrollment. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies for Windows 10, version 1709:
- Authentication/AllowAadPasswordReset
- Authentication/AllowFidoDeviceSignon
- Browser/LockdownFavorites
- Browser/ProvisionFavorites
- Cellular/LetAppsAccessCellularData
- Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
- Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
- Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
- CredentialProviders/DisableAutomaticReDeploymentCredentials
- DeviceGuard/EnableVirtualizationBasedSecurity
- DeviceGuard/RequirePlatformSecurityFeatures
- DeviceGuard/LsaCfgFlags
- DeviceLock/MinimumPasswordAge
- ExploitGuard/ExploitProtectionSettings
- Games/AllowAdvancedGamingServices
- Handwriting/PanelDefaultModeDocked
- LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
- LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
- LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
- LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
- LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
- LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
- LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
- LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
- LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
- LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
- LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
- LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
- Power/DisplayOffTimeoutOnBattery
- Power/DisplayOffTimeoutPluggedIn
- Power/HibernateTimeoutOnBattery
- Power/HibernateTimeoutPluggedIn
- Power/StandbyTimeoutOnBattery
- Power/StandbyTimeoutPluggedIn
- Privacy/EnableActivityFeed
- Privacy/PublishUserActivities
- Defender/AttackSurfaceReductionOnlyExclusions
- Defender/AttackSurfaceReductionRules
- Defender/CloudBlockLevel
- Defender/CloudExtendedTimeout
- Defender/ControlledFolderAccessAllowedApplications
- Defender/ControlledFolderAccessProtectedFolders
- Defender/EnableControlledFolderAccess
- Defender/EnableNetworkProtection
- Education/DefaultPrinterName
- Education/PreventAddingNewPrinters
- Education/PrinterNames
- Search/AllowCloudSearch
- Security/ClearTPMIfNotReady
- Settings/AllowOnlineTips
- Start/HidePeopleBar
- Storage/AllowDiskHealthModelUpdates
- System/DisableEnterpriseAuthProxy
- System/LimitEnhancedDiagnosticDataWindowsAnalytics
- Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
- Update/DisableDualScan
- Update/ManagePreviewBuilds
- Update/ScheduledInstallEveryWeek
- Update/ScheduledInstallFirstWeek
- Update/ScheduledInstallFourthWeek
- Update/ScheduledInstallSecondWeek
- Update/ScheduledInstallThirdWeek
- WindowsDefenderSecurityCenter/CompanyName
- WindowsDefenderSecurityCenter/DisableAppBrowserUI
- WindowsDefenderSecurityCenter/DisableEnhancedNotifications
- WindowsDefenderSecurityCenter/DisableFamilyUI
- WindowsDefenderSecurityCenter/DisableHealthUI
- WindowsDefenderSecurityCenter/DisableNetworkUI
- WindowsDefenderSecurityCenter/DisableNotifications
- WindowsDefenderSecurityCenter/DisableVirusUI
- WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
- WindowsDefenderSecurityCenter/Email
- WindowsDefenderSecurityCenter/EnableCustomizedToasts
- WindowsDefenderSecurityCenter/EnableInAppCustomization
- WindowsDefenderSecurityCenter/Phone
- WindowsDefenderSecurityCenter/URL
- WirelessDisplay/AllowMdnsAdvertisement
- WirelessDisplay/AllowMdnsDiscovery | + ## What’s new in MDM for Windows 10, version 1703 - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ItemDescription

Update CSP

Added the following nodes:

-
    -
  • FailedUpdates/Failed Update Guid/RevisionNumber
    • -
  • InstalledUpdates/Installed Update Guid/RevisionNumber
    • -
  • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
    • -
-
CM_CellularEntries CSP

To PurposeGroups setting, added the following values:

-
    -
  • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
    • -
  • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
    • -
-

CertificateStore CSP

Added the following setting:

-
    -
  • My/WSTEP/Renew/RetryAfterExpiryInterval
    • -
-

ClientCertificateInstall CSP

Added the following setting:

-
    -
  • SCEP/UniqueID/Install/AADKeyIdentifierList
    • -
-

DMAcc CSP

Added the following setting:

-
    -
  • AccountUID/EXT/Microsoft/InitiateSession
    • -
-

DMClient CSP

Added the following nodes and settings:

-
    -
  • HWDevID
    • -
  • Provider/ProviderID/ManagementServerToUpgradeTo
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/Title
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
    • -
  • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
    • -
-

CellularSettings CSP

CM_CellularEntries CSP

EnterpriseAPN CSP

For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

-
SecureAssessment CSP

Added the following settings:

-
    -
  • AllowTextSuggestions
    • -
  • RequirePrinting
    • -
-
EnterpriseAPN CSP

Added the following setting:

-
    -
  • Roaming
    • -
-
Messaging CSP

Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

-
Policy CSP

Added the following new policies:

-
    -
  • Accounts/AllowMicrosoftAccountSignInAssistant
    • -
  • ApplicationDefaults/DefaultAssociationsConfiguration
    • -
  • Browser/AllowAddressBarDropdown
    • -
  • Browser/AllowFlashClickToRun
    • -
  • Browser/AllowMicrosoftCompatibilityList
    • -
  • Browser/AllowSearchEngineCustomization
    • -
  • Browser/ClearBrowsingDataOnExit
    • -
  • Browser/ConfigureAdditionalSearchEngines
    • -
  • Browser/DisableLockdownOfStartPages
    • -
  • Browser/PreventFirstRunPage
    • -
  • Browser/PreventLiveTileDataCollection
    • -
  • Browser/SetDefaultSearchEngine
    • -
  • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
    • -
  • Connectivity/AllowConnectedDevices
    • -
  • DeliveryOptimization/DOAllowVPNPeerCaching
    • -
  • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
    • -
  • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
    • -
  • DeliveryOptimization/DOMinFileSizeToCache
    • -
  • DeliveryOptimization/DOMinRAMAllowedToPeer
    • -
  • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
    • -
  • Display/TurnOffGdiDPIScalingForApps
    • -
  • Display/TurnOnGdiDPIScalingForApps
    • -
  • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
    • -
  • EnterpriseCloudPrint/CloudPrintOAuthAuthority
    • -
  • EnterpriseCloudPrint/CloudPrintOAuthClientId
    • -
  • EnterpriseCloudPrint/CloudPrintResourceId
    • -
  • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
    • -
  • EnterpriseCloudPrint/MopriaDiscoveryResourceId
    • -
  • Experience/AllowFindMyDevice
    • -
  • Experience/AllowTailoredExperiencesWithDiagnosticData
    • -
  • Experience/AllowWindowsSpotlightOnActionCenter
    • -
  • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
    • -
  • Location/EnableLocation
    • -
  • Messaging/AllowMMS
    • -
  • Messaging/AllowRCS
    • -
  • Privacy/LetAppsAccessTasks
    • -
  • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
    • -
  • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
    • -
  • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo
    • -
  • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
    • -
  • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
    • -
  • Privacy/LetAppsRunInBackground
    • -
  • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
    • -
  • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
    • -
  • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
    • -
  • Settings/ConfigureTaskbarCalendar
    • -
  • Settings/PageVisibilityList
    • -
  • SmartScreen/EnableAppInstallControl
    • -
  • SmartScreen/EnableSmartScreenInShell
    • -
  • SmartScreen/PreventOverrideForFilesInShell
    • -
  • Start/AllowPinnedFolderDocuments
    • -
  • Start/AllowPinnedFolderDownloads
    • -
  • Start/AllowPinnedFolderFileExplorer
    • -
  • Start/AllowPinnedFolderHomeGroup
    • -
  • Start/AllowPinnedFolderMusic
    • -
  • Start/AllowPinnedFolderNetwork
    • -
  • Start/AllowPinnedFolderPersonalFolder
    • -
  • Start/AllowPinnedFolderPictures
    • -
  • Start/AllowPinnedFolderSettings
    • -
  • Start/AllowPinnedFolderVideos
    • -
  • Start/HideAppList
    • -
  • Start/HideChangeAccountSettings
    • -
  • Start/HideFrequentlyUsedApps
    • -
  • Start/HideHibernate
    • -
  • Start/HideLock
    • -
  • Start/HidePowerButton
    • -
  • Start/HideRecentJumplists
    • -
  • Start/HideRecentlyAddedApps
    • -
  • Start/HideRestart
    • -
  • Start/HideShutDown
    • -
  • Start/HideSignOut
    • -
  • Start/HideSleep
    • -
  • Start/HideSwitchAccount
    • -
  • Start/HideUserTile
    • -
  • Start/ImportEdgeAssets
    • -
  • Start/NoPinningToTaskbar
    • -
  • System/AllowFontProviders
    • -
  • System/DisableOneDriveFileSync
    • -
  • TextInput/AllowKeyboardTextSuggestions
    • -
  • TimeLanguageSettings/AllowSet24HourClock
    • -
  • Update/ActiveHoursMaxRange
    • -
  • Update/AutoRestartDeadlinePeriodInDays
    • -
  • Update/AutoRestartNotificationSchedule
    • -
  • Update/AutoRestartRequiredNotificationDismissal
    • -
  • Update/DetectionFrequency
    • -
  • Update/EngagedRestartDeadline
    • -
  • Update/EngagedRestartSnoozeSchedule
    • -
  • Update/EngagedRestartTransitionSchedule
    • -
  • Update/IgnoreMOAppDownloadLimit
    • -
  • Update/IgnoreMOUpdateDownloadLimit
    • -
  • Update/PauseFeatureUpdatesStartTime
    • -
  • Update/PauseQualityUpdatesStartTime
    • -
  • Update/SetAutoRestartNotificationDisable
    • -
  • Update/SetEDURestart
    • -
  • WiFi/AllowWiFiDirect
    • -
  • WindowsLogon/HideFastUserSwitching
    • -
  • WirelessDisplay/AllowProjectionFromPC
    • -
  • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
    • -
  • WirelessDisplay/AllowProjectionToPCOverInfrastructure
    • -
  • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
    • -

Removed TextInput/AllowLinguisticDataCollection

-

Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

-

Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

-

Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

-

Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

-

Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

-
DevDetail CSP

Added the following setting:

-
    -
  • DeviceHardwareData
    • -
-
CleanPC CSP

Added new CSP.

DeveloperSetup CSP

Added new CSP.

NetworkProxy CSP

Added new CSP.

BitLocker CSP

Added new CSP.

-

Added the following setting:

-
    -
  • AllowWarningForOtherDiskEncryption
    • -
-
EnterpriseDataProtection CSP

Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

Added the following settings:

-
    -
  • RevokeOnMDMHandoff
    • -
  • SMBAutoEncryptedFileExtensions
    • -
DynamicManagement CSP

Added new CSP.

Implement server-side support for mobile application management on Windows

New mobile application management (MAM) support added in Windows 10, version 1703.

PassportForWork CSP

Added the following new node and settings:

-
    -
  • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
    • -
  • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
    • -
  • TenantId/Policies/EnablePinRecovery
    • -
Office CSP

Added new CSP.

Personalization CSP

Added new CSP.

EnterpriseAppVManagement CSP

Added new CSP.

HealthAttestation CSP

Added the following settings:

-
    -
  • HASEndpoint - added in Windows 10, version 1607, but not documented
    • -
  • TpmReadyStatus - added in the March service release of Windows 10, version 1607
    • -

SurfaceHub CSP

Added the following nodes and settings:

-
    -
  • InBoxApps/SkypeForBusiness
    • -
  • InBoxApps/SkypeForBusiness/DomainName
    • -
  • InBoxApps/Connect
    • -
  • InBoxApps/Connect/AutoLaunch
    • -
  • Properties/DefaultVolume
    • -
  • Properties/ScreenTimeout
    • -
  • Properties/SessionTimeout
    • -
  • Properties/SleepTimeout
    • -
  • Properties/AllowSessionResume
    • -
  • Properties/AllowAutoProxyAuth
    • -
  • Properties/DisableSigninSuggestions
    • -
  • Properties/DoNotShowMyMeetingsAndFiles
    • -
-
NetworkQoSPolicy CSP

Added new CSP.

WindowsLicensing CSP

Added the following setting:

-
    -
  • ChangeProductKey
    • -
-
WindowsAdvancedThreatProtection CSP

Added the following setting:

-
    -
  • Configuration/TelemetryReportingFrequency
    • -
-
DMSessionActions CSP

Added new CSP.

-
SharedPC CSP

Added new settings in Windows 10, version 1703.

-
    -
  • RestrictLocalStorage
    • -
  • KioskModeAUMID
    • -
  • KioskModeUserTileDisplayText
    • -
  • InactiveThreshold
    • -
  • MaxPageFileSizeMB
    • -
-

The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

-
RemoteLock CSP

Added following setting:

-
    -
  • LockAndRecoverPIN
    • -
-
NodeCache CSP

Added following settings:

-
    -
  • ChangedNodesData
    • -
  • AutoSetExpectedValue
    • -
-
Download all the DDF files for Windows 10, version 1703

Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

-
RemoteWipe CSP

Added new setting in Windows 10, version 1703.

-
    -
  • doWipeProtected
    • -
-
MDM Bridge WMI Provider

Added new classes and properties.

-
Understanding ADMX-backed policies

Added a section describing SyncML examples of various ADMX elements.

-
Win32 and Desktop Bridge app policy configurationNew topic.
Deploy and configure App-V apps using MDM

Added a new topic describing how to deploy and configure App-V apps using MDM.

-
EnterpriseDesktopAppManagement CSP

Added new setting in the March service release of Windows 10, version 1607.

-
    -
  • MSI/UpgradeCode/[Guid]
    • -
-
Reporting CSP

Added new settings in Windows 10, version 1703.

-
    -
  • EnterpriseDataProtection/RetrieveByTimeRange/Type
    • -
  • EnterpriseDataProtection/RetrieveByCount/Type
    • -
-
Connect your Windows 10-based device to work using a deep link

Added following deep link parameters to the table:

-
    -
  • Username
    • -
  • Servername
    • -
  • Accesstoken
    • -
  • Deviceidentifier
    • -
  • Tenantidentifier
    • -
  • Ownership
    • -
-
MDM support for Windows 10 S

Updated the following topics to indicate MDM support in Windows 10 S.

- -
TPMPolicy CSPNew CSP added in Windows 10, version 1703.
  - +| New or updated topic | Description | +|-----|-----| +| [Update CSP](update-csp.md) | Added the following nodes:
- FailedUpdates/_Failed Update Guid_/RevisionNumber
- InstalledUpdates/_Installed Update Guid_/RevisionNumber
- PendingRebootUpdates/_Pending Reboot Update Guid_/RevisionNumber | +| [CM_CellularEntries CSP](cm-cellularentries-csp.md) | To PurposeGroups setting, added the following values:
- Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
- Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364 | +| [CertificateStore CSP](certificatestore-csp.md) | Added the following setting:
- My/WSTEP/Renew/RetryAfterExpiryInterval | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | Added the following setting:
- SCEP/UniqueID/Install/AADKeyIdentifierList | +| [DMAcc CSP](dmacc-csp.md) | Added the following setting:
- AccountUID/EXT/Microsoft/InitiateSession | +| [DMClient CSP](dmclient-csp.md) | Added the following nodes and settings:
- HWDevID
- Provider/ProviderID/ManagementServerToUpgradeTo
- Provider/ProviderID/CustomEnrollmentCompletePage
- Provider/ProviderID/CustomEnrollmentCompletePage/Title
- Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
- Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
- Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText | +| [CellularSettings CSP](cellularsettings-csp.md)
[CM_CellularEntries CSP](cm-cellularentries-csp.md)
[EnterpriseAPN CSP](enterpriseapn-csp.md) | For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions. | +| [SecureAssessment CSP](secureassessment-csp.md) | Added the following settings:
- AllowTextSuggestions
- RequirePrinting | +| [EnterpriseAPN CSP](enterpriseapn-csp.md) | Added the following setting:
- Roaming | +| [Messaging CSP](messaging-csp.md) | Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions. | +| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies:
- Accounts/AllowMicrosoftAccountSignInAssistant
- ApplicationDefaults/DefaultAssociationsConfiguration
- Browser/AllowAddressBarDropdown
- Browser/AllowFlashClickToRun
- Browser/AllowMicrosoftCompatibilityList
- Browser/AllowSearchEngineCustomization
- Browser/ClearBrowsingDataOnExit
- Browser/ConfigureAdditionalSearchEngines
- Browser/DisableLockdownOfStartPages
- Browser/PreventFirstRunPage
- Browser/PreventLiveTileDataCollection
- Browser/SetDefaultSearchEngine
- Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
- Connectivity/AllowConnectedDevices
- DeliveryOptimization/DOAllowVPNPeerCaching
- DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
- DeliveryOptimization/DOMinDiskSizeAllowedToPeer
- DeliveryOptimization/DOMinFileSizeToCache
- DeliveryOptimization/DOMinRAMAllowedToPeer
- DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
- Display/TurnOffGdiDPIScalingForApps
- Display/TurnOnGdiDPIScalingForApps
- EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
- EnterpriseCloudPrint/CloudPrintOAuthAuthority
- EnterpriseCloudPrint/CloudPrintOAuthClientId
- EnterpriseCloudPrint/CloudPrintResourceId
- EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
- EnterpriseCloudPrint/MopriaDiscoveryResourceId
- Experience/AllowFindMyDevice
- Experience/AllowTailoredExperiencesWithDiagnosticData
- Experience/AllowWindowsSpotlightOnActionCenter
- Experience/AllowWindowsSpotlightWindowsWelcomeExperience
- Location/EnableLocation
- Messaging/AllowMMS
- Messaging/AllowRCS
- Privacy/LetAppsAccessTasks
- Privacy/LetAppsAccessTasks_ForceAllowTheseApps
- Privacy/LetAppsAccessTasks_ForceDenyTheseApps
- Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
- Privacy/LetAppsGetDiagnosticInfo
- Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
- Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
- Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
- Privacy/LetAppsRunInBackground
- Privacy/LetAppsRunInBackground_ForceAllowTheseApps
- Privacy/LetAppsRunInBackground_ForceDenyTheseApps
- Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
- Settings/ConfigureTaskbarCalendar
- Settings/PageVisibilityList
- SmartScreen/EnableAppInstallControl
- SmartScreen/EnableSmartScreenInShell
- SmartScreen/PreventOverrideForFilesInShell
- Start/AllowPinnedFolderDocuments
- Start/AllowPinnedFolderDownloads
- Start/AllowPinnedFolderFileExplorer
- Start/AllowPinnedFolderHomeGroup
- Start/AllowPinnedFolderMusic
- Start/AllowPinnedFolderNetwork
- Start/AllowPinnedFolderPersonalFolder
- Start/AllowPinnedFolderPictures
- Start/AllowPinnedFolderSettings
- Start/AllowPinnedFolderVideos
- Start/HideAppList
- Start/HideChangeAccountSettings
- Start/HideFrequentlyUsedApps
- Start/HideHibernate
- Start/HideLock
- Start/HidePowerButton
- Start/HideRecentJumplists
- Start/HideRecentlyAddedApps
- Start/HideRestart
- Start/HideShutDown
- Start/HideSignOut
- Start/HideSleep
- Start/HideSwitchAccount
- Start/HideUserTile
- Start/ImportEdgeAssets
- Start/NoPinningToTaskbar
- System/AllowFontProviders
- System/DisableOneDriveFileSync
- TextInput/AllowKeyboardTextSuggestions
- TimeLanguageSettings/AllowSet24HourClock
- Update/ActiveHoursMaxRange
- Update/AutoRestartDeadlinePeriodInDays
- Update/AutoRestartNotificationSchedule
- Update/AutoRestartRequiredNotificationDismissal
- Update/DetectionFrequency
- Update/EngagedRestartDeadline
- Update/EngagedRestartSnoozeSchedule
- Update/EngagedRestartTransitionSchedule
- Update/IgnoreMOAppDownloadLimit
- Update/IgnoreMOUpdateDownloadLimit
- Update/PauseFeatureUpdatesStartTime
- Update/PauseQualityUpdatesStartTime
- Update/SetAutoRestartNotificationDisable
- Update/SetEDURestart
- WiFi/AllowWiFiDirect
- WindowsLogon/HideFastUserSwitching
- WirelessDisplay/AllowProjectionFromPC
- WirelessDisplay/AllowProjectionFromPCOverInfrastructure
- WirelessDisplay/AllowProjectionToPCOverInfrastructure
- WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
Removed TextInput/AllowLinguisticDataCollection
Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise
Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.
Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.
Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.
Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files. | +| [DevDetail CSP](devdetail-csp.md) | Added the following setting:
- DeviceHardwareData | +| [CleanPC CSP](cleanpc-csp.md) | Added the new CSP. | +| [DeveloperSetup CSP](developersetup-csp.md) | Added the new CSP. | +| [NetworkProxy CSP](networkproxy-csp.md) | Added the new CSP. | +| [BitLocker CSP](bitlocker-csp.md) | Added the new CSP.

Added the following setting:
- AllowWarningForOtherDiskEncryption | +| [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.
Added the following settings:
- RevokeOnMDMHandoff
- SMBAutoEncryptedFileExtensions | +| [DynamicManagement CSP](dynamicmanagement-csp.md) | Added the new CSP. | +| [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/windows/client-management/mdm/implement-server-side-mobile-application-management) | New mobile application management (MAM) support added in Windows 10, version 1703. | +| [PassportForWork CSP](passportforwork-csp.md) | Added the following new node and settings:
- _TenantId_/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
- _TenantId_/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
- _TenantId_/Policies/EnablePinRecovery | +| [Office CSP](office-csp.md) | Added the new CSP. | +| [Personalization CSP](personalization-csp.md) | Added the new CSP. | +| [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md) | Added the new CSP. | +| [HealthAttestation CSP](healthattestation-csp.md) | Added the following settings:
- HASEndpoint - added in Windows 10, version 1607, but not documented
- TpmReadyStatus - added in the March service release of Windows 10, version 1607 | +| [SurfaceHub CSP](surfacehub-csp.md) | Added the following nodes and settings:
- InBoxApps/SkypeForBusiness
- InBoxApps/SkypeForBusiness/DomainName
- InBoxApps/Connect
- InBoxApps/Connect/AutoLaunch
- Properties/DefaultVolume
- Properties/ScreenTimeout
- Properties/SessionTimeout
- Properties/SleepTimeout
- Properties/AllowSessionResume
- Properties/AllowAutoProxyAuth
- Properties/DisableSigninSuggestions
- Properties/DoNotShowMyMeetingsAndFiles | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | Added the new CSP. | +| [WindowsLicensing CSP](windowslicensing-csp.md) | Added the following setting:
- ChangeProductKey | +| [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) | Added the following setting:
- Configuration/TelemetryReportingFrequency | +| [DMSessionActions CSP](dmsessionactions-csp.md) | Added the new CSP. | +| [SharedPC CSP](dmsessionactions-csp.md) | Added new settings in Windows 10, version 1703:
- RestrictLocalStorage
- KioskModeAUMID
- KioskModeUserTileDisplayText
- InactiveThreshold
- MaxPageFileSizeMB
The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300. | +| [RemoteLock CSP](remotelock-csp.md) | Added following setting:
- LockAndRecoverPIN | +| [NodeCache CSP](nodecache-csp.md) | Added following settings:
- ChangedNodesData
- AutoSetExpectedValue | +| [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) | Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs. | +| [RemoteWipe CSP](remotewipe-csp.md) | Added new setting in Windows 10, version 1703:
- doWipeProtected | +| [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) | Added new classes and properties. | +| [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies) | Added a section describing SyncML examples of various ADMX elements. | +| [Win32 and Desktop Bridge app policy configuration](https://docs.microsoft.com/windows/client-management/mdm/win32-and-centennial-app-policy-configuration) | New topic. | +| [Deploy and configure App-V apps using MDM](https://docs.microsoft.com/windows/client-management/mdm/appv-deploy-and-config) | Added a new topic describing how to deploy and configure App-V apps using MDM. | +| [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md) | Added new setting in the March service release of Windows 10, version 1607.
- MSI/UpgradeCode/[Guid] | +| [Reporting CSP](reporting-csp.md) | Added new settings in Windows 10, version 1703.
- EnterpriseDataProtection/RetrieveByTimeRange/Type
- EnterpriseDataProtection/RetrieveByCount/Type | +| [Connect your Windows 10-based device to work using a deep link](https://docs.microsoft.com/windows/client-management/mdm/mdm-enrollment-of-windows-devices#connect-your-windows-10-based-device-to-work-using-a-deep-link) | Added following deep link parameters to the table:
- Username
- Servername
- Accesstoken
- Deviceidentifier
- Tenantidentifier
- Ownership | +| MDM support for Windows 10 S | Updated the following topics to indicate MDM support in Windows 10 S.
- [Configuration service provider reference](onfiguration-service-provider-reference.md)
- [Policy CSP](policy-configuration-service-provider.md) | +| [TPMPolicy CSP](tpmpolicy-csp.md) | Added the new CSP. | ## What’s new in MDM for Windows 10, version 1607 From 28095ad20f41c4cfc2dc299f76b29523f9a5d7a9 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Fri, 16 Oct 2020 15:04:41 -0700 Subject: [PATCH 29/82] article reorganization --- windows/security/threat-protection/TOC.md | 33 ++++-- .../next-gen-threat-and-vuln-mgt.md | 20 ---- .../tvm-assign-device-value.md | 67 +++++++++++ .../tvm-end-of-support-software.md | 70 ++++++++++++ .../microsoft-defender-atp/tvm-exception.md | 105 ++++++++++++++++++ ...enarios.md => tvm-hunt-exposed-devices.md} | 0 .../tvm-prerequisites.md | 71 ++++++++++++ .../microsoft-defender-atp/tvm-remediation.md | 67 +++++------ .../tvm-security-recommendation.md | 88 +-------------- .../tvm-software-inventory.md | 11 +- .../tvm-supported-os.md | 15 +-- .../microsoft-defender-atp/tvm-weaknesses.md | 18 +-- 12 files changed, 372 insertions(+), 193 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/tvm-assign-device-value.md create mode 100644 windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md create mode 100644 windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md rename windows/security/threat-protection/microsoft-defender-atp/{threat-and-vuln-mgt-scenarios.md => tvm-hunt-exposed-devices.md} (100%) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c7f7335c43..ef6ee02b8e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -49,18 +49,27 @@ #### [PowerShell, WMI, and MPCmdRun.exe](microsoft-defender-atp/manage-atp-post-migration-other-tools.md) ## [Security administration]() -### [Threat & Vulnerability Management]() -#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) -#### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md) -#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) -#### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md) -#### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) -#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) -#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) -#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) -#### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md) -#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +### [Threat & vulnerability management]() +#### [Overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +#### [Get started]() +##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md) +##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) +##### [Assign device values](microsoft-defender-atp/tvm-assign-device-value.md) +#### [Assess your security posture]() +##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md) +##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) +##### [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md) +#### [Improve your security posture & reduce risk]() +##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) +##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md) +##### [File an exception](microsoft-defender-atp/tvm-exception.md) +##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md) +#### [Understand vulnerabilities on your devices]() +##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) +##### [List of vulnerabilities](microsoft-defender-atp/tvm-weaknesses.md) +##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md) +##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md) + ### [Attack surface reduction]() #### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index a0f4515971..7499f4de13 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -81,25 +81,6 @@ Watch this video for a comprehensive walk-through of threat and vulnerability ma >[!VIDEO https://aka.ms/MDATP-TVM-Interactive-Guide] -## Before you begin - -Ensure that your devices: - -- Are onboarded to Microsoft Defender Advanced Threat Protection -- Run [supported operating systems and platforms](tvm-supported-os.md) -- Have the following mandatory updates installed and deployed in your network to boost your vulnerability assessment detection rates: - -> Release | Security update KB number and link -> :---|:--- -> Windows 10 Version 1709 | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) and [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) -> Windows 10 Version 1803 | [KB4493464](https://support.microsoft.com/help/4493464) and [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) -> Windows 10 Version 1809 | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) -> Windows 10 Version 1903 | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) - -- Are onboarded to [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure). If you're using Configuration Manager, update your console to the latest version. -- Have at least one security recommendation that can be viewed in the device page -- Are tagged or marked as co-managed - ## APIs Run threat and vulnerability management-related API calls to automate vulnerability management workflows. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615). @@ -126,6 +107,5 @@ See the following articles for related APIs: - [Weaknesses](tvm-weaknesses.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) - [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) - [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) - [BLOG: Microsoft's Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time](https://www.microsoft.com/security/blog/2019/07/02/microsofts-threat-vulnerability-management-now-helps-thousands-of-customers-to-discover-prioritize-and-remediate-vulnerabilities-in-real-time/) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-assign-device-value.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-assign-device-value.md new file mode 100644 index 0000000000..3206f14e30 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-assign-device-value.md @@ -0,0 +1,67 @@ +--- +title: Scenarios - threat and vulnerability management +description: Learn how threat and vulnerability management can be used to help security admins, IT admins, and SecOps collaborate. +keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: ellevin +author: levinec +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: article +--- + +# Define a device's value to the organization + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) + +[!include[Prerelease information](../../includes/prerelease.md)] + +Defining a device’s value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the threat and vulnerability management exposure score calculation. Devices marked as “high value” will receive more weight. + +You can also use the [set device value API](set-device-value.md). + +Device value options: + +- Low +- Normal (Default) +- High + +Examples of devices that should be marked as high value: + +- Domain controllers, Active Directory +- Internet facing devices +- VIP devices +- Devices hosting internal/external production services + +## Set device value + +1. Navigate to any device page, the easiest place is from the device inventory. + +2. Select **Device Value** from three dots next to the actions bar at the top of the page. + ![Example of the device value dropdown.](images/tvm-device-value-dropdown.png) + +

+ +3. A flyout will appear with the current device value and what it means. Review the value of the device and choose the one that best fits your device. +![Example of the device value flyout.](images/tvm-device-value-flyout.png) + +## Related topics + +- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) +- [APIs](next-gen-threat-and-vuln-mgt.md#apis) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md new file mode 100644 index 0000000000..714e8a1e93 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md @@ -0,0 +1,70 @@ +--- +title: Plan for end-of-support software and software versions +description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value, in threat and vulnerability management. +keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: ellevin +author: levinec +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: conceptual +--- +# Plan for end-of-support software and software versions with threat and vulnerability management + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) + +End-of-support (EOS), otherwise known as end-of-life (EOL), for software or software versions means that they will no longer be supported or serviced, and will not receive security updates. When you use software or software versions with ended support, you're exposing your organization to security vulnerabilities, legal, and financial risks. + +It's crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem. They should examine the options to remove or replace apps that have reached end-of-support and update versions that are no longer supported. It's best to create and implement a plan **before** the end of support dates. + +## Find software or software versions that are no longer supported + +1. From the threat and vulnerability management menu, navigate to [**Security recommendations**](tvm-security-recommendation.md). +2. Go to the **Filters** panel and look for the tags section. Select one or more of the EOS tag options. Then **Apply**. + + ![Screenshot tags that say EOS software, EOS versions, and Upcoming EOS versions](images/tvm-eos-tag.png) + +3. You'll see a list of recommendations related to software with ended support, software versions that are end of support, or versions with upcoming end of support. These tags are also visible in the [software inventory](tvm-software-inventory.md) page. + + ![Screenshot tags that say EOS software, EOS versions, and Upcoming EOS versions](images/tvm-eos-tags-column.png) + +## List of versions and dates + +To view a list of versions that have reached end of support, or end or support soon, and those dates, follow the below steps: + +1. A message will appear in the security recommendation flyout for software with versions that have reached end of support, or will reach end of support soon. + + ![Screenshot of version distribution link](images/eos-upcoming-eos.png) + +2. Select the **version distribution** link to go to the software drill-down page. There, you can see a filtered list of versions with tags identifying them as end of support, or upcoming end of support. + + ![Screenshot of version distribution link](images/software-drilldown-eos.png) + +3. Select one of the versions in the table to open. For example, version 10.0.18362.1. A flyout will appear with the end of support date. + + ![Screenshot of version distribution link](images/version-eos-date.png) + +Once you identify which software and software versions are vulnerable due to their end-of-support status, you must decide whether to update or remove them from your organization. Doing so will lower your organizations exposure to vulnerabilities and advanced persistent threats. + +## Related topics + +- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) +- [Security recommendations](tvm-security-recommendation.md) +- [Software inventory](tvm-software-inventory.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md new file mode 100644 index 0000000000..ec2d78b08b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md @@ -0,0 +1,105 @@ +--- +title: File an exception for a security recommendation - threat and vulnerability management +description: Create and monitor exceptions for security recommendations in threat and vulnerability management. +keywords: microsoft defender atp tvm remediation, mdatp tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: ellevin +author: levinec +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: conceptual +--- +# File an exception for a security recommendation - threat and vulnerability management + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) + +As an alternative to a remediation request, you can create exceptions for recommendations. + +There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons. + +When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. + +1. Select a security recommendation you would like to create an exception for, and then **Exception options**. +![Showing where the button for "exception options" is location in a security recommendation flyout.](images/tvm-exception-option.png) + +2. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. + + The following list details the justifications behind the exception options: + + - **Third party control** - A third party product or software already addresses this recommendation + - Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced + - **Alternate mitigation** - An internal tool already addresses this recommendation + - Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced + - **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive + - **Planned remediation (grace)** - Already planned but is awaiting execution or authorization + +3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created. + +## View your exceptions + +When you file for an exception from the [Security recommendations page](tvm-security-recommendation.md), you create an exception for that security recommendation. You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). + +The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. You can filter your view based on exception justification, type, and status. + +![Example of the exception page and filter options.](images/tvm-exception-filters.png) + +### Exception actions and statuses + +You can take the following actions on an exception: + +- Cancel - You can cancel the exceptions you've filed anytime +- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change. It adversely affects the exposure impact associated with a recommendation that had previously been excluded. + +The following statuses will be a part of an exception: + +- **Canceled** - The exception has been canceled and is no longer in effect +- **Expired** - The exception that you've filed is no longer in effect +- **In effect** - The exception that you've filed is in progress + +### Exception impact on scores + +Creating an exception can potentially affect the Exposure Score (for both types of weaknesses) and Microsoft Secure Score for Devices of your organization in the following manner: + +- **No impact** - Removes the recommendation from the lists (which can be reverse through filters), but will not affect the scores. +- **Mitigation-like impact** - As if the recommendation was mitigated (and scores will be adjusted accordingly) when you select it as a compensating control. +- **Hybrid** - Provides visibility on both No impact and Mitigation-like impact. It shows both the Exposure Score and Microsoft Secure Score for Devices results out of the exception option that you made. + +The exception impact shows on both the Security recommendations page column and in the flyout pane. + +![Screenshot identifying the impact sections which list score impacts in the full page security recommendations table, and the flyout.](images/tvm-exception-impact.png) + +### View exceptions in other places + +Select **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard. It will open a filtered view in the **Security recommendations** page of recommendations with an "Exception" status. + +![Screenshot of Show exceptions link in the Top security recommendations card in the dashboard.](images/tvm-exception-dashboard.png) + +## Related topics + +- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) +- [Supported operating systems and platforms](tvm-supported-os.md) +- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) +- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) +- [Security recommendations](tvm-security-recommendation.md) +- [Software inventory](tvm-software-inventory.md) +- [Weaknesses](tvm-weaknesses.md) +- [Event timeline](threat-and-vuln-mgt-event-timeline.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) +- [APIs](next-gen-threat-and-vuln-mgt.md#apis) +- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md similarity index 100% rename from windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md rename to windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md new file mode 100644 index 0000000000..04ab0e13f8 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md @@ -0,0 +1,71 @@ +--- +title: Threat and vulnerability management +description: This new capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. +keywords: threat & vulnerability management, threat and vulnerability management, MDATP TVM, MDATP-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, microsoft defender atp, microsoft defender atp, endpoint vulnerabilities, next generation +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: ellevin +author: levinec +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Prerequisites & permissions - threat and vulnerability management + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) + +Ensure that your devices: + +- Are onboarded to Microsoft Defender Advanced Threat Protection +- Run [supported operating systems and platforms](tvm-supported-os.md) +- Have the following mandatory updates installed and deployed in your network to boost your vulnerability assessment detection rates: + +> Release | Security update KB number and link +> :---|:--- +> Windows 10 Version 1709 | [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441) and [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071) +> Windows 10 Version 1803 | [KB4493464](https://support.microsoft.com/help/4493464) and [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045) +> Windows 10 Version 1809 | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077) +> Windows 10 Version 1903 | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941) + +- Are onboarded to [Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/what-is-intune) and [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure). If you're using Configuration Manager, update your console to the latest version. +- Have at least one security recommendation that can be viewed in the device page +- Are tagged or marked as co-managed + +## Relevant permission options + +1. Log in to Microsoft Defender Security Center using account with a Security administrator or Global administrator role assigned. +2. In the navigation pane, select **Settings > Roles**. + +For more information, see [Create and manage roles for role-based access control](user-roles.md) + +### View data + +- **Security operations** - View all security operations data in the portal +- **Threat and vulnerability management** - View threat and vulnerability management data in the portal + +### Active remediation actions + +- **Security operations** - Take response actions, approve or dismiss pending remediation actions, manage allowed/blocked lists for automation and indicators +- **Threat and vulnerability management - Exception handling** - Create new exceptions and manage active exceptions +- **Threat and vulnerability management - Remediation handling** - Submit new remediation requests, create tickets, and manage existing remediation activities + +For more information, see [RBAC permission options](user-roles.md##permission-options) + +## See also + +- [Supported operating systems and platforms](tvm-supported-os.md) +- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) +- [Exposure score](tvm-exposure-score.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 96e22571c0..784f4d7a44 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -1,5 +1,5 @@ --- -title: Remediation activities and exceptions - threat and vulnerability management +title: Remediate vulnerabilities with threat and vulnerability management description: Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in threat and vulnerability management. keywords: microsoft defender atp tvm remediation, mdatp tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm search.product: eADQiWindows 10XVcnh @@ -18,7 +18,7 @@ ms.collection: - m365initiative-defender-endpoint ms.topic: conceptual --- -# Remediation activities and exceptions - threat and vulnerability management +# Remediate vulnerabilities with threat and vulnerability management [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] @@ -31,6 +31,31 @@ ms.topic: conceptual >[!NOTE] >To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. +## Request remediation + +The threat and vulnerability management capability in Microsoft Defender ATP bridges the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune. + +### Enable Microsoft Intune connection + +To use this capability, enable your Microsoft Intune connections. In the Microsoft Defender Security Center, navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle **On**. + +See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. + +### Remediation request steps + +1. Select a security recommendation you would like to request remediation for, and then select **Remediation options**. + +2. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices. + +3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. + +4. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request. + +If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. + +>[!NOTE] +>If your request involves remediating more than 10,000 devices, we can only send 10,000 devices for remediation to Intune. + After your organization's cybersecurity weaknesses are identified and mapped to actionable [security recommendations](tvm-security-recommendation.md), start creating security tasks. You can create tasks through the integration with Microsoft Intune where remediation tickets are created. Lower your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. @@ -59,44 +84,6 @@ When you [submit a remediation request](tvm-security-recommendation.md#request-r Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete. ![Example of the Remediation page, with a selected remediation activity, and that activity's flyout listing the description, IT service and device management tools, and device remediation progress.](images/remediation_flyouteolsw.png) -## Exceptions - -When you [file for an exception](tvm-security-recommendation.md#file-for-exception) from the [Security recommendations page](tvm-security-recommendation.md), you create an exception for that security recommendation. You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). - -The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. You can filter your view based on exception justification, type, and status. - -![Example of the exception page and filter options.](images/tvm-exception-filters.png) - -### Exception actions and statuses - -You can take the following actions on an exception: - -- Cancel - You can cancel the exceptions you've filed anytime -- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change. It adversely affects the exposure impact associated with a recommendation that had previously been excluded. - -The following statuses will be a part of an exception: - -- **Canceled** - The exception has been canceled and is no longer in effect -- **Expired** - The exception that you've filed is no longer in effect -- **In effect** - The exception that you've filed is in progress - -### Exception impact on scores - -Creating an exception can potentially affect the Exposure Score (for both types of weaknesses) and Microsoft Secure Score for Devices of your organization in the following manner: - -- **No impact** - Removes the recommendation from the lists (which can be reverse through filters), but will not affect the scores. -- **Mitigation-like impact** - As if the recommendation was mitigated (and scores will be adjusted accordingly) when you select it as a compensating control. -- **Hybrid** - Provides visibility on both No impact and Mitigation-like impact. It shows both the Exposure Score and Microsoft Secure Score for Devices results out of the exception option that you made. - -The exception impact shows on both the Security recommendations page column and in the flyout pane. - -![Screenshot identifying the impact sections which list score impacts in the full page security recommendations table, and the flyout.](images/tvm-exception-impact.png) - -### View exceptions in other places - -Select **Show exceptions** at the bottom of the **Top security recommendations** card in the dashboard. It will open a filtered view in the **Security recommendations** page of recommendations with an "Exception" status. - -![Screenshot of Show exceptions link in the Top security recommendations card in the dashboard.](images/tvm-exception-dashboard.png) ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 723a90bded..4fa0f5695a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -107,58 +107,7 @@ If there is a large jump in the number of exposed machines, or a sharp increase 1. Select the recommendation and **Open software page** 2. Select the **Event timeline** tab to view all the impactful events related to that software, such as new vulnerabilities or new public exploits. [Learn more about event timeline](threat-and-vuln-mgt-event-timeline.md) -3. Decide how to address the increase or your organization's exposure, such as submitting a remediation request - -## Request remediation - -The threat and vulnerability management capability in Microsoft Defender ATP bridges the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune. - -### Enable Microsoft Intune connection - -To use this capability, enable your Microsoft Intune connections. In the Microsoft Defender Security Center, navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle **On**. - -See [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. - -### Remediation request steps - -1. Select a security recommendation you would like to request remediation for, and then select **Remediation options**. - -2. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices. - -3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. - -4. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request. - -If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. - ->[!NOTE] ->If your request involves remediating more than 10,000 devices, we can only send 10,000 devices for remediation to Intune. - -## File for exception - -As an alternative to a remediation request, you can create exceptions for recommendations. - -There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons. - -When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. - -1. Select a security recommendation you would like to create an exception for, and then **Exception options**. -![Showing where the button for "exception options" is location in a security recommendation flyout.](images/tvm-exception-option.png) - -2. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. - - The following list details the justifications behind the exception options: - - - **Third party control** - A third party product or software already addresses this recommendation - - Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced - - **Alternate mitigation** - An internal tool already addresses this recommendation - - Choosing this justification type will lower your exposure score and increase you secure score because your risk is reduced - - **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive - - **Planned remediation (grace)** - Already planned but is awaiting execution or authorization - -3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created. - -4. Navigate to the [**Remediation**](tvm-remediation.md) page under the **Threat and vulnerability management** menu and select the **Exceptions** tab to view all your exceptions (current and past). +3. Decide how to address the increase or your organization's exposure, such as submitting a remediation request. ## Report inaccuracy @@ -174,41 +123,6 @@ You can report a false positive when you see any vague, inaccurate, incomplete, 4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts. -## Find and remediate software or software versions which have reached end-of-support (EOS) - -End-of-support (otherwise known as end-of-life) for software or software versions means that they will no longer be supported or serviced, and will not receive security updates. When you use software or software versions with ended support, you're exposing your organization to security vulnerabilities, legal, and financial risks. - -It's crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem. They should examine the options to remove or replace apps that have reached end-of-support and update versions that are no longer supported. It's best to create and implement a plan **before** the end of support dates. - -To find software or software versions that are no longer supported: - -1. From the threat and vulnerability management menu, navigate to **Security recommendations**. -2. Go to the **Filters** panel and look for the tags section. Select one or more of the EOS tag options. Then **Apply**. - - ![Screenshot tags that say EOS software, EOS versions, and Upcoming EOS versions](images/tvm-eos-tag.png) - -3. You'll see a list of recommendations related to software with ended support, software versions that are end of support, or versions with upcoming end of support. These tags are also visible in the [software inventory](tvm-software-inventory.md) page. - - ![Screenshot tags that say EOS software, EOS versions, and Upcoming EOS versions](images/tvm-eos-tags-column.png) - -### List of versions and dates - -To view a list of versions that have reached end of support, or end or support soon, and those dates, follow the below steps: - -1. A message will appear in the security recommendation flyout for software with versions that have reached end of support, or will reach end of support soon. - - ![Screenshot of version distribution link](images/eos-upcoming-eos.png) - -2. Select the **version distribution** link to go to the software drill-down page. There, you can see a filtered list of versions with tags identifying them as end of support, or upcoming end of support. - - ![Screenshot of version distribution link](images/software-drilldown-eos.png) - -3. Select one of the versions in the table to open. For example, version 10.0.18362.1. A flyout will appear with the end of support date. - - ![Screenshot of version distribution link](images/version-eos-date.png) - -Once you identify which software and software versions are vulnerable due to their end-of-support status, you must decide whether to update or remove them from your organization. Doing so will lower your organizations exposure to vulnerabilities and advanced persistent threats. - ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index 13d0634456..03f4ad48e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -25,6 +25,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) @@ -88,14 +89,6 @@ Report a false positive when you see any vague, inaccurate, or incomplete inform ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Weaknesses](tvm-weaknesses.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) +- [View and organize the Microsoft Defender ATP Devices list](machines-view-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md index 4de1a79a1e..e533863d57 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md @@ -1,7 +1,7 @@ --- title: Supported operating systems and platforms for threat and vulnerability management description: Before you begin, ensure that you meet the operating system or platform requisites for threat and vulnerability management so the activities in your all devices are properly accounted for. -keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score +keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, search.appverid: met150 search.product: eADQiWindows 10XVcnh ms.prod: w10 @@ -26,6 +26,7 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) @@ -50,14 +51,4 @@ Linux | Not supported (planned) ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) +- [Prerequisites & permissions](tvm-prerequisites.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 523a9d850b..b2b0021f69 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -1,5 +1,5 @@ --- -title: Weaknesses found by threat and vulnerability management +title: Vulnerabilities in my organization - threat and vulnerability management description: Lists the common vulnerabilities and exposures (CVE) ID of weaknesses found in the software running in your organization. Discovered by the Microsoft Defender ATP threat and vulnerability management capability. keywords: mdatp threat & vulnerability management, threat and vulnerability management, mdatp tvm weaknesses page, finding weaknesses through tvm, tvm vulnerability list, vulnerability details in tvm search.product: eADQiWindows 10XVcnh @@ -18,19 +18,19 @@ ms.collection: - m365initiative-defender-endpoint ms.topic: conceptual --- -# Weaknesses found by threat and vulnerability management +# Vulnerabilities in my organization - threat and vulnerability management [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) Threat and vulnerability management uses the same signals in Microsoft Defender ATP's endpoint protection to scan and detect vulnerabilities. -The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization by listing the Common Vulnerabilities and Exposures (CVE) ID. You can also view the severity, Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization, corresponding breach, threat insights, and more. +The **Weaknesses** page lists the software vulnerabilities your devices are exposed to by listing the Common Vulnerabilities and Exposures (CVE) ID. You can also view the severity, Common Vulnerability Scoring System (CVSS) rating, prevalence in your organization, corresponding breach, threat insights, and more. >[!NOTE] >If there is no official CVE-ID assigned to a vulnerability, the vulnerability name is assigned by threat and vulnerability management. @@ -140,14 +140,6 @@ Report a false positive when you see any vague, inaccurate, or incomplete inform ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) +- [View and organize the Microsoft Defender ATP Devices list](machines-view-overview.md) From fbb41b10fc40b32454a6159cf83f1859dda5a19c Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Fri, 16 Oct 2020 17:34:41 -0700 Subject: [PATCH 30/82] updated topics --- .../next-gen-threat-and-vuln-mgt.md | 10 --- .../tvm-dashboard-insights.md | 7 +-- .../tvm-end-of-support-software.md | 2 +- .../microsoft-defender-atp/tvm-exception.md | 38 +++++------- .../tvm-exposure-score.md | 8 --- .../tvm-hunt-exposed-devices.md | 61 +++++-------------- .../tvm-microsoft-secure-score-devices.md | 11 +--- .../tvm-prerequisites.md | 14 +++-- .../microsoft-defender-atp/tvm-remediation.md | 49 ++++----------- .../tvm-security-recommendation.md | 25 +++----- .../tvm-software-inventory.md | 3 +- .../tvm-supported-os.md | 4 +- .../microsoft-defender-atp/tvm-weaknesses.md | 8 +-- 13 files changed, 73 insertions(+), 167 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index 7499f4de13..37b42afa50 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -21,7 +21,6 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -99,13 +98,4 @@ See the following articles for related APIs: - [Supported operating systems and platforms](tvm-supported-os.md) - [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) - [BLOG: Microsoft's Threat & Vulnerability Management now helps thousands of customers to discover, prioritize, and remediate vulnerabilities in real time](https://www.microsoft.com/security/blog/2019/07/02/microsofts-threat-vulnerability-management-now-helps-thousands-of-customers-to-discover-prioritize-and-remediate-vulnerabilities-in-real-time/) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index eca2eff41e..f5a4c36323 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -83,14 +83,9 @@ For more information on the icons used throughout the portal, see [Microsoft Def ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) - [Exposure score](tvm-exposure-score.md) - [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md index 714e8a1e93..133be4654e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-end-of-support-software.md @@ -1,6 +1,6 @@ --- title: Plan for end-of-support software and software versions -description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value, in threat and vulnerability management. +description: Discover and plan for software and software versions that are no longer supported and won't receive security updates. keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md index ec2d78b08b..8b0dad82a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md @@ -1,5 +1,5 @@ --- -title: File an exception for a security recommendation - threat and vulnerability management +title: Create and view exceptions for security recommendations - threat and vulnerability management description: Create and monitor exceptions for security recommendations in threat and vulnerability management. keywords: microsoft defender atp tvm remediation, mdatp tvm, threat and vulnerability management, threat & vulnerability management, threat & vulnerability management remediation, tvm remediation intune, tvm remediation sccm search.product: eADQiWindows 10XVcnh @@ -18,26 +18,28 @@ ms.collection: - m365initiative-defender-endpoint ms.topic: conceptual --- -# File an exception for a security recommendation - threat and vulnerability management +# Create and view exceptions for security recommendations - threat and vulnerability management [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) -As an alternative to a remediation request, you can create exceptions for recommendations. +Sometimes, you may not be able to take the remediation steps suggested by a security recommendation. If that is the case, threat and vulnerability management gives you an avenue to create an exception. -There are many reasons why organizations create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides as much protection than the recommendation would, a false positive, among other reasons. +When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and no longer shows up in the security recommendations list. -When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. +## Create an exception -1. Select a security recommendation you would like to create an exception for, and then **Exception options**. +1. Go to the threat and vulnerability management navigation menu in the Microsoft Defender Security Center, and select [**Security recommendations**](tvm-security-recommendation.md). + +2. Select a security recommendation you would like to create an exception for, and then **Exception options**. ![Showing where the button for "exception options" is location in a security recommendation flyout.](images/tvm-exception-option.png) -2. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. +3. Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. The following list details the justifications behind the exception options: @@ -48,11 +50,11 @@ When an exception is created for a recommendation, the recommendation is no long - **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive - **Planned remediation (grace)** - Already planned but is awaiting execution or authorization -3. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created. +4. Select **Submit**. A confirmation message at the top of the page indicates that the exception has been created. ## View your exceptions -When you file for an exception from the [Security recommendations page](tvm-security-recommendation.md), you create an exception for that security recommendation. You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). +When you file for an exception from the security recommendations page, you create an exception for that security recommendation. You can file exceptions to exclude certain recommendation from showing up in reports and affecting your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). The exceptions you've filed will show up in the **Remediation** page, in the **Exceptions** tab. You can filter your view based on exception justification, type, and status. @@ -60,10 +62,7 @@ The exceptions you've filed will show up in the **Remediation** page, in the **E ### Exception actions and statuses -You can take the following actions on an exception: - -- Cancel - You can cancel the exceptions you've filed anytime -- Resurface - Your exception automatically becomes void and resurfaces in the security recommendation list when dynamic environmental factors change. It adversely affects the exposure impact associated with a recommendation that had previously been excluded. +Once an exception exists, you can cancel it at any time by going to the exception in the **Remediation** page and selecting **Cancel exception**. The following statuses will be a part of an exception: @@ -92,14 +91,7 @@ Select **Show exceptions** at the bottom of the **Top security recommendations** ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) +- [Remediate vulnerabilities](tvm-remediation.md) +- [Security recommendations](tvm-security-recommendation.md) - [Exposure score](tvm-exposure-score.md) - [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md index 1773f17654..f4e3899906 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exposure-score.md @@ -65,14 +65,6 @@ Lower your threat and vulnerability exposure by remediating [security recommenda ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) - [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md index 77b4642f92..9ed8b6cbca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-hunt-exposed-devices.md @@ -1,5 +1,5 @@ --- -title: Scenarios - threat and vulnerability management +title: Hunt for exposed devices description: Learn how threat and vulnerability management can be used to help security admins, IT admins, and SecOps collaborate. keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls search.product: eADQiWindows 10XVcnh @@ -19,20 +19,31 @@ ms.collection: ms.topic: article --- -# Scenarios - threat and vulnerability management +# Hunt for exposed devices - threat and vulnerability management [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) -[!include[Prerelease information](../../includes/prerelease.md)] +## Use advanced hunting to find devices with vulnerabilities -## Use advanced hunting query to search for devices with High active alerts or critical CVE public exploit +Advanced hunting is a query-based threat-hunting tool that lets you explore up to 30 days of raw data. You can proactively inspect events in your network to locate threat indicators and entities. The flexible access to data enables unconstrained hunting for both known and potential threats. [Learn more about advanced hunting](advanced-hunting-overview.md) + +### Schema tables + +- [DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md) - Inventory of software on devices as well as any known vulnerabilities in these software products + +- [DeviceTvmSoftwareVulnerabilitiesKB](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) - Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available + +- [DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md) - Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices + +- [DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) - Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks + +## Check which devices are involved in high severity alerts 1. Go to **Advanced hunting** from the left-hand navigation pane of the Microsoft Defender Security Center. @@ -55,50 +66,10 @@ DeviceName=any(DeviceName) by DeviceId, AlertId ``` -## Define a device's value to the organization - -Defining a device’s value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the threat and vulnerability management exposure score calculation. Devices marked as “high value” will receive more weight. - -You can also use the [set device value API](set-device-value.md). - -Device value options: - -- Low -- Normal (Default) -- High - -Examples of devices that should be marked as high value: - -- Domain controllers, Active Directory -- Internet facing devices -- VIP devices -- Devices hosting internal/external production services - -### Set device value - -1. Navigate to any device page, the easiest place is from the device inventory. - -2. Select **Device Value** from three dots next to the actions bar at the top of the page. - ![Example of the device value dropdown.](images/tvm-device-value-dropdown.png) - -

- -3. A flyout will appear with the current device value and what it means. Review the value of the device and choose the one that best fits your device. -![Example of the device value flyout.](images/tvm-device-value-flyout.png) - - ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) - [APIs](next-gen-threat-and-vuln-mgt.md#apis) - [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) - [Advanced hunting overview](overview-hunting.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md index 59c5598a86..f388e2ec91 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-microsoft-secure-score-devices.md @@ -1,5 +1,5 @@ --- -title: Overview of Microsoft Secure Score for Devices in Microsoft Defender Security Center +title: Microsoft Secure Score for Devices description: Your score for devices shows the collective security configuration state of your devices across application, operating system, network, accounts, and security controls. keywords: Microsoft Secure Score for Devices, mdatp Microsoft Secure Score for Devices, secure score, configuration score, threat and vulnerability management, security controls, improvement opportunities, security configuration score over time, security posture, baseline search.product: eADQiWindows 10XVcnh @@ -100,13 +100,6 @@ Improve your security configuration by remediating issues from the security reco ## Related topics - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) +- [Dashboard](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Security recommendations](tvm-security-recommendation.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md index 04ab0e13f8..437ee5c49d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-prerequisites.md @@ -1,7 +1,7 @@ --- -title: Threat and vulnerability management -description: This new capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations. -keywords: threat & vulnerability management, threat and vulnerability management, MDATP TVM, MDATP-TVM, vulnerability management, vulnerability assessment, threat and vulnerability scanning, secure configuration assessment, microsoft defender atp, microsoft defender atp, endpoint vulnerabilities, next generation +title: Prerequisites & permissions - threat and vulnerability management +description: Before you begin using threat and vulnerability management, make sure you have the relevant configurations and permissions. +keywords: threat & vulnerability management permissions prerequisites, threat and vulnerability management permissions prerequisites, MDATP TVM permissions prerequisites, vulnerability management search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -62,10 +62,12 @@ For more information, see [Create and manage roles for role-based access control - **Threat and vulnerability management - Exception handling** - Create new exceptions and manage active exceptions - **Threat and vulnerability management - Remediation handling** - Submit new remediation requests, create tickets, and manage existing remediation activities -For more information, see [RBAC permission options](user-roles.md##permission-options) +For more information, see [RBAC permission options](user-roles.md#permission-options) -## See also +## Related articles +- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) - [Supported operating systems and platforms](tvm-supported-os.md) +- [Assign device value](tvm-assign-device-value.md) - [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 784f4d7a44..328a47fcfc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -22,15 +22,11 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) ->[!NOTE] ->To use this capability, enable your Microsoft Intune connections. Navigate to **Settings** > **General** > **Advanced features**. Scroll down and look for **Microsoft Intune connection**. By default, the toggle is turned off. Turn your **Microsoft Intune connection** toggle on. - ## Request remediation The threat and vulnerability management capability in Microsoft Defender ATP bridges the gap between Security and IT administrators through the remediation request workflow. Security admins like you can request for the IT Administrator to remediate a vulnerability from the **Security recommendation** pages to Intune. @@ -43,13 +39,15 @@ See [Use Intune to remediate vulnerabilities identified by Microsoft Defender AT ### Remediation request steps -1. Select a security recommendation you would like to request remediation for, and then select **Remediation options**. +1. Go to the threat and vulnerability management navigation menu in the Microsoft Defender Security Center, and select [**Security recommendations**](tvm-security-recommendation.md). -2. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices. +2. Select a security recommendation you would like to request remediation for, and then select **Remediation options**. -3. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. +3. Fill out the form, including what you are requesting remediation for, priority, due date, and optional notes. Select **Submit request**. Submitting a remediation request creates a remediation activity item within threat and vulnerability management, which can be used for monitoring the remediation progress for this recommendation. This will not trigger a remediation or apply any changes to devices. -4. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request. +4. Notify your IT Administrator about the new request and have them log into Intune to approve or reject the request and start a package deployment. + +5. Go to the [**Remediation**](tvm-remediation.md) page to view the status of your remediation request. If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. @@ -60,16 +58,12 @@ After your organization's cybersecurity weaknesses are identified and mapped to Lower your organization's exposure from vulnerabilities and increase your security configuration by remediating the security recommendations. -## Navigate to the Remediation page +## View your remediation activities -You can access the Remediation page a few different ways: +When you submit a remediation request from the Security recommendations page, it kicks-off a remediation activity. A security task is created that can be tracked in the threat and vulnerability management **Remediation** page, and a remediation ticket is created in Microsoft Intune. -- Threat and vulnerability management navigation menu in the [Microsoft Defender Security Center](portal-overview.md) -- Top remediation activities card in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md) - -### Navigation menu - -Go to the threat and vulnerability management navigation menu and select **Remediation**. It will open the list of remediation activities and exceptions found in your organization. +Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete. +![Example of the Remediation page, with a selected remediation activity, and that activity's flyout listing the description, IT service and device management tools, and device remediation progress.](images/remediation_flyouteolsw.png) ### Top remediation activities in the dashboard @@ -77,25 +71,8 @@ View **Top remediation activities** in the [threat and vulnerability management ![Example of Top remediation activities card with a table that lists top activities that were generated from security recommendations.](images/tvm-remediation-activities-card.png) -## Remediation activities - -When you [submit a remediation request](tvm-security-recommendation.md#request-remediation) from the [Security recommendations page](tvm-security-recommendation.md), it kicks-off a remediation activity. A security task is created that can be tracked in the threat and vulnerability management **Remediation** page, and a remediation ticket is created in Microsoft Intune. - -Once you are in the Remediation page, select the remediation activity that you want to view. You can follow the remediation steps, track progress, view the related recommendation, export to CSV, or mark as complete. -![Example of the Remediation page, with a selected remediation activity, and that activity's flyout listing the description, IT service and device management tools, and device remediation progress.](images/remediation_flyouteolsw.png) - - -## Related topics +## Related articles - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) -- [Exposure score](tvm-exposure-score.md) -- [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) -- [Security recommendations](tvm-security-recommendation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) -- [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) +- [Dashboard](tvm-dashboard-insights.md) +- [Security recommendations](tvm-security-recommendation.md) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 4fa0f5695a..a59b92154b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -22,10 +22,10 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) @@ -79,7 +79,7 @@ The color of the **Exposed devices** graph changes as the trend changes. If the ### Icons -Useful icons also quickly call your attention to: +Useful icons also quickly call your attention to: - ![arrow hitting a target](images/tvm_alert_icon.png) possible active alerts - ![red bug](images/tvm_bug_icon.png) associated public exploits - ![light bulb](images/tvm_insight_icon.png) recommendation insights @@ -94,16 +94,16 @@ From the flyout, you can choose any of the following options: - **Open software page** - Open the software page to get more context on the software and how it's distributed. The information can include threat context, associated recommendations, weaknesses discovered, number of exposed devices, discovered vulnerabilities, names and detailed of devices with the software installed, and version distribution. -- [**Remediation options**](tvm-security-recommendation.md#request-remediation) - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address. +- [**Remediation options**](tvm-remediation.md) - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address. -- [**Exception options**](tvm-security-recommendation.md#file-for-exception) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue yet. +- [**Exception options**](tvm-exception.md) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue yet. >[!NOTE] >When a change is made on a device, it typically takes two hours for the data to be reflected in the Microsoft Defender Security Center. However, it may sometimes take longer. -### Investigate changes in machine exposure or impact +### Investigate changes in device exposure or impact -If there is a large jump in the number of exposed machines, or a sharp increase in the impact on your organization exposure score and configuration score, then that security recommendation is worth investigating. +If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and configuration score, then that security recommendation is worth investigating. 1. Select the recommendation and **Open software page** 2. Select the **Event timeline** tab to view all the impactful events related to that software, such as new vulnerabilities or new public exploits. [Learn more about event timeline](threat-and-vuln-mgt-event-timeline.md) @@ -123,17 +123,12 @@ You can report a false positive when you see any vague, inaccurate, incomplete, 4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts. -## Related topics +## Related articles - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) -- [Supported operating systems and platforms](tvm-supported-os.md) -- [Threat and vulnerability management dashboard](tvm-dashboard-insights.md) +- [Dashboard](tvm-dashboard-insights.md) - [Exposure score](tvm-exposure-score.md) - [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) -- [Remediation and exception](tvm-remediation.md) -- [Software inventory](tvm-software-inventory.md) -- [Weaknesses](tvm-weaknesses.md) +- [Remediate vulnerabilities](tvm-remediation.md) +- [Create and view exceptions for security recommendations](tvm-exceptions.md) - [Event timeline](threat-and-vuln-mgt-event-timeline.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) -- [APIs](next-gen-threat-and-vuln-mgt.md#apis) -- [Configure data access for threat and vulnerability management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index 03f4ad48e6..d34335654a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -22,7 +22,6 @@ ms.topic: conceptual [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - [Threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) @@ -86,7 +85,7 @@ Report a false positive when you see any vague, inaccurate, or incomplete inform 3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details about the inaccuracy. 4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts. -## Related topics +## Related articles - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) - [Security recommendations](tvm-security-recommendation.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md index e533863d57..8802d9cf10 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-supported-os.md @@ -1,6 +1,6 @@ --- title: Supported operating systems and platforms for threat and vulnerability management -description: Before you begin, ensure that you meet the operating system or platform requisites for threat and vulnerability management so the activities in your all devices are properly accounted for. +description: Ensure that you meet the operating system or platform requisites for threat and vulnerability management, so the activities in your all devices are properly accounted for. keywords: threat & vulnerability management, threat and vulnerability management, operating system, platform requirements, prerequisites, mdatp-tvm supported os, mdatp-tvm, search.appverid: met150 search.product: eADQiWindows 10XVcnh @@ -48,7 +48,7 @@ Windows Server 2019 | Operating System (OS) vulnerabilities
Software product macOS 10.13 "High Sierra" and above | Operating System (OS) vulnerabilities
Software product vulnerabilities Linux | Not supported (planned) -## Related topics +## Related articles - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) - [Prerequisites & permissions](tvm-prerequisites.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index b2b0021f69..ae152f9f21 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -70,7 +70,7 @@ Remediate the vulnerabilities in exposed devices to reduce the risk to your asse ### Breach and threat insights -View related breach and threat insights in the **Threat** column when the icons are colored red. +View any related breach and threat insights in the **Threat** column when the icons are colored red. >[!NOTE] > Always prioritize recommendations that are associated with ongoing threats. These recommendations are marked with the threat insight icon ![Simple drawing of a red bug.](images/tvm_bug_icon.png) and breach insight icon ![Simple drawing of an arrow hitting a target.](images/tvm_alert_icon.png). @@ -78,13 +78,13 @@ View related breach and threat insights in the **Threat** column when the icons The breach insights icon is highlighted if there's a vulnerability found in your organization. ![Example of a breach insights text that could show up when hovering over icon. This one says "possible active alert is associated with this recommendation.](images/tvm-breach-insights.png) -The threat insights icon is highlighted if there are associated exploits in the vulnerability found in your organization. Hovering over the icon shows whether the threat is a part of an exploit kit, or connected to specific advanced persistent campaigns or activity groups. When available, there is a link to a Threat Analytics report with zero-day exploitation news, disclosures, or related security advisories. +The threat insights icon is highlighted if there are associated exploits in the vulnerability found in your organization. Hovering over the icon shows whether the threat is a part of an exploit kit, or connected to specific advanced persistent campaigns or activity groups. When available, there's a link to a Threat Analytics report with zero-day exploitation news, disclosures, or related security advisories. ![Threat insights text that that could show up when hovering over icon. This one has multiple bullet points and linked text.](images/tvm-threat-insights.png) ### Gain vulnerability insights -If you select a CVE, a flyout panel will open with more information, including the vulnerability description, details, threat insights, and exposed devices. +If you select a CVE, a flyout panel will open with more information such as the vulnerability description, details, threat insights, and exposed devices. The "OS Feature" category is shown in relevant scenarios. @@ -137,7 +137,7 @@ Report a false positive when you see any vague, inaccurate, or incomplete inform 3. Select the inaccuracy category from the drop-down menu and fill in your email address and inaccuracy details. 4. Select **Submit**. Your feedback is immediately sent to the threat and vulnerability management experts. -## Related topics +## Related articles - [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md) - [Security recommendations](tvm-security-recommendation.md) From 470c7b461c81f52a684493ae589c090f9a3193d9 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 17 Oct 2020 16:54:30 +0530 Subject: [PATCH 31/82] Update windows/security/threat-protection/index.md accepted Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/security/threat-protection/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 3763417926..5873b326d0 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -19,7 +19,7 @@ ms.topic: conceptual # Threat Protection [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Microsoft Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture. ->[!TIP] +> [!TIP] > Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/).

Microsoft Defender ATP

From d73e0a401052b2abd11f49532e9a37d76f33dbc5 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Sat, 17 Oct 2020 19:59:34 +0530 Subject: [PATCH 32/82] added simplifying deployment of SSU link as per the user feedback #8478, so i added a simplifying-on-premises-deployment-of-SSU link. --- windows/deployment/update/servicing-stack-updates.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 49d29f4d8a..3ad8432738 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -28,6 +28,8 @@ Servicing stack updates provide fixes to the servicing stack, the component that Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. +See this [Simplifing Deployment of Servicing Stack Updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-on-premises-deployment-of-servicing-stack-updates/ba-p/1646039) + ## When are they released? Servicing stack update are released depending on new issues or vulnerabilities. In rare occasions a servicing stack update may need to be released on demand to address an issue impacting systems installing the monthly security update. Starting in November 2018 new servicing stack updates will be classified as "Security" with a severity rating of "Critical." From 6c90d2ae9c752f696655ced332343b29b4f42b18 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 19 Oct 2020 17:18:02 +0500 Subject: [PATCH 33/82] Correction in Syntax As mentioned by the user, * was missing the statement. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8211 --- windows/client-management/mdm/firewall-csp.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index 1fae08c646..64c5a2f5d7 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -248,9 +248,9 @@ Sample syncxml to provision the firewall settings to evaluate

Value type is string. Supported operations are Add, Get, Replace, and Delete.

**FirewallRules/*FirewallRuleName*/LocalAddressRanges** -

Comma separated list of local addresses covered by the rule. The default value is "". Valid tokens include:

+

Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include: