mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Updates for September release
This commit is contained in:
Daniel H. Brown
parent
e05b0c8a57
commit
5ed8beb6cb
@ -7,7 +7,7 @@ localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 05/23/2023
|
||||
ms.date: 09/26/2023
|
||||
ms.topic: reference
|
||||
---
|
||||
|
||||
@ -1749,6 +1749,30 @@ The following fields are available:
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PopCnt CPU requirement for newer versions of Windows, to help keep Windows up-to-date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
- **Blocking** Is the upgrade blocked due to the processor missing the PopCnt instruction?
|
||||
- **PopCntPassed** Whether the machine passes the latest OS hardware requirements or not for the PopCnt instruction.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntStartSync
|
||||
|
||||
The SystemProcessorPopCntStartSync event indicates that a new set of SystemProcessorPopCntAdd events will be sent. This event is used to understand if the system supports the PopCnt CPU requirement for newer versions of Windows.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
|
||||
@ -2148,7 +2172,7 @@ This event sends data about Azure presence, type, and cloud domain use in order
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AADDeviceId** Azure Active Directory device ID.
|
||||
- **AADDeviceId** Microsoft Entra ID device ID.
|
||||
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
|
||||
- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
|
||||
- **CDJType** Represents the type of cloud domain joined for the machine.
|
||||
@ -2156,7 +2180,7 @@ The following fields are available:
|
||||
- **ContainerType** The type of container, such as process or virtual machine hosted.
|
||||
- **EnrollmentType** Defines the type of MDM enrollment on the device.
|
||||
- **HashedDomain** The hashed representation of the user domain used for login.
|
||||
- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
|
||||
- **IsCloudDomainJoined** Is this device joined to a Microsoft Entra tenant? true/false
|
||||
- **IsDERequirementMet** Represents if the device can do device encryption.
|
||||
- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
|
||||
- **IsDomainJoined** Indicates whether a machine is joined to a domain.
|
||||
@ -2164,7 +2188,7 @@ The following fields are available:
|
||||
- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
|
||||
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
|
||||
|
||||
|
||||
@ -2586,6 +2610,17 @@ The following fields are available:
|
||||
|
||||
## Code Integrity events
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.AutoEnablementIsBlocked
|
||||
|
||||
Indicates if OEM attempted to block autoenablement via regkey.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BlockHvciAutoenablement** True if auto-enablement was successfully blocked, false otherwise.
|
||||
- **BlockRequested** Whether an autoenablement block was requested.
|
||||
- **Scenario** Used to differentiate VBS and HVCI paths.
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.Compatibility
|
||||
|
||||
Fires when the compatibility check completes. Gives the results from the check.
|
||||
@ -2596,6 +2631,18 @@ The following fields are available:
|
||||
- **Issues** If compatibility checks failed, provides bit indexed indicators of issues detected. Table located here: [Check results of HVCI default enablement](/windows-hardware/design/device-experiences/oem-hvci-enablement#check-results-of-hvci-default-enablement).
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.Enabled
|
||||
|
||||
Fires when auto-enablement is successful and HVCI is being enabled on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Error** Error code if there was an issue during enablement
|
||||
- **Scenario** Indicates whether enablement was for VBS vs HVCI
|
||||
- **SuccessfullyEnabled** Indicates whether enablement was successful
|
||||
- **Upgrade** Indicates whether the event was fired during upgrade (rather than clean install)
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.HVCIActivity
|
||||
|
||||
Fires at the beginning and end of the HVCI auto-enablement process in sysprep.
|
||||
@ -3368,7 +3415,7 @@ The following fields are available:
|
||||
- **ClientID** Client ID being run.
|
||||
- **CoordinatorVersion** Coordinator version of DTU.
|
||||
- **CV** Correlation vector.
|
||||
- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the AAD (Azure Active Directory) domain.
|
||||
- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the Microsoft Entra domain.
|
||||
- **IsDeviceADDomainJoined** Indicates whether the device is logged in to the AD (Active Directory) domain.
|
||||
- **IsDeviceCloverTrail** Indicates whether the device has a Clover Trail system installed.
|
||||
- **IsDeviceFeatureUpdatingPaused** Indicates whether Feature Update is paused on the device.
|
||||
@ -5756,6 +5803,44 @@ The following fields are available:
|
||||
- **totalRuns** Total number of running/evaluation from last time.
|
||||
|
||||
|
||||
## Other events
|
||||
|
||||
### Microsoft.Windows.Defender.Engine.Maps.Heartbeat
|
||||
|
||||
Heartbeat is sent once a day to indicate Defender is running and functional. Event includes necessary information to understand health of Defender on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppVersion** Version of the Defender platform
|
||||
- **CampRing** Camp ring used for monthly deployment
|
||||
- **CfaMode** State of Controlled Folder Access
|
||||
- **ConsumerAsrMode** State of Attack Surface Reduction
|
||||
- **CountAsrRules** Number of Attack Surface Reduction rules in place
|
||||
- **EngineRing** Engine ring used for monthly deployment
|
||||
- **EngineVersion** Version of the AntiMalware Engine
|
||||
- **HeartbeatType** Enum of the reason the heartbeat is collected
|
||||
- **IsAsrAnyAudit** Flag to indicate if any Attack Surface Reduction rules are running in Audit mode
|
||||
- **IsAsrAnyBlock** Flag to indicate if any Attack Surface Reduction rules are running in Block mode
|
||||
- **IsBeta** Flag to indicate if the user has opted in for Beta updates for Defender
|
||||
- **IsManaged** Flag to indicate if Defender is running in manage mode
|
||||
- **IsPassiveMode** Flag to indicate if Defender is in Passive mode for ATP
|
||||
- **IsSxsPassiveMode** Flag to indicate if Defender is in Passive mode for Limited periodic scanning
|
||||
- **ProductGuid** Defender Product Guid (static for Defender)
|
||||
- **PusMode** Mode for blocking potentially unwanted software
|
||||
- **ShouldHashIds** Do we have ISO Compliance requirement to hash IDs for e5
|
||||
- **SignatureRing** Signature ring used for deployments
|
||||
- **SigVersion** Version of signature VDMs
|
||||
|
||||
|
||||
### Microsoft.Windows.SecureBootTelemetry.SecureBootEncodeUEFI
|
||||
|
||||
Information about Secure Boot configuration including the PK, KEKs, DB and DBX files on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **SecureBootUEFIEncoding** Information about the PK, KEKs, DB and DBX files on the device.
|
||||
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -6633,7 +6718,7 @@ The following fields are available:
|
||||
- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
|
||||
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
|
||||
- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
|
||||
- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNCountryCode** Two letter country or region abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
|
||||
- **ClientVersion** The version number of the software distribution client.
|
||||
- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0.
|
||||
@ -6757,7 +6842,7 @@ The following fields are available:
|
||||
- **CallerApplicationName** The name provided by the application that initiated API calls into the software distribution client.
|
||||
- **CbsDownloadMethod** Indicates whether the download was a full- or a partial-file download.
|
||||
- **CbsMethod** The method used for downloading the update content related to the Component Based Servicing (CBS) technology.
|
||||
- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNCountryCode** Two letter country or region abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
|
||||
- **ClientVersion** The version number of the software distribution client.
|
||||
- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior.
|
||||
@ -9667,10 +9752,10 @@ The following fields are available:
|
||||
- **CV** The correlation vector.
|
||||
- **GlobalEventCounter** Counts the events at the global level for telemetry.
|
||||
- **PackageVersion** The package version for currency tools.
|
||||
- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined.
|
||||
- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is Microsoft Entra joined.
|
||||
- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy.
|
||||
- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy.
|
||||
- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ.
|
||||
- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is Microsoft Entra joined.
|
||||
- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined.
|
||||
- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined.
|
||||
- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU.
|
||||
@ -9752,7 +9837,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin
|
||||
|
||||
This event is sent when the device is not joined to AAD. The data collected with this event is used to help keep Windows up to date and secure.
|
||||
This event is sent when the device is not Microsoft Entra joined. The data collected with this event is used to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 05/23/2023
|
||||
ms.date: 09/26/2023
|
||||
ms.topic: reference
|
||||
---
|
||||
|
||||
@ -757,6 +757,30 @@ The following fields are available:
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PopCnt CPU requirement for newer versions of Windows, to help keep Windows up-to-date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
- **Blocking** Is the upgrade blocked due to the processor missing the PopCnt instruction?
|
||||
- **PopCntPassed** Whether the machine passes the latest OS hardware requirements or not for the PopCnt instruction.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntStartSync
|
||||
|
||||
The SystemProcessorPopCntStartSync event indicates that a new set of SystemProcessorPopCntAdd events will be sent. This event is used to understand if the system supports the PopCnt CPU requirement for newer versions of Windows.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
|
||||
@ -967,7 +991,7 @@ This event sends data about Azure presence, type, and cloud domain use in order
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AADDeviceId** Azure Active Directory device ID.
|
||||
- **AADDeviceId** Microsoft Entra ID device ID.
|
||||
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
|
||||
- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
|
||||
- **CDJType** Represents the type of cloud domain joined for the machine.
|
||||
@ -975,7 +999,7 @@ The following fields are available:
|
||||
- **ContainerType** The type of container, such as process or virtual machine hosted.
|
||||
- **EnrollmentType** Defines the type of MDM enrollment on the device.
|
||||
- **HashedDomain** The hashed representation of the user domain used for login.
|
||||
- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
|
||||
- **IsCloudDomainJoined** Is this device joined to a Microsoft Entra tenant? true/false
|
||||
- **IsDERequirementMet** Represents if the device can do device encryption.
|
||||
- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
|
||||
- **IsEDPEnabled** Represents if Enterprise data protected on the device.
|
||||
@ -2126,7 +2150,7 @@ The following fields are available:
|
||||
- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'.
|
||||
- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'.
|
||||
- **appPingEventDoneBeforeOOBEComplete** Indicates whether the install or update was completed before Windows Out of the Box Experience ends. 1 means event completed before OOBE finishes; 0 means event was not completed before OOBE finishes; -1 means the field does not apply.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country or region code that matches to the country or region updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2.
|
||||
- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
|
||||
- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
|
||||
@ -2253,6 +2277,31 @@ The following fields are available:
|
||||
- **windowInstanceId** Unique value for each window instance.
|
||||
|
||||
|
||||
### Microsoft.Windows.Defender.Engine.Maps.Heartbeat
|
||||
|
||||
Heartbeat is sent once a day to indicate Defender is running and functional. Event includes necessary information to understand health of Defender on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppVersion** Version of the Defender platform
|
||||
- **CampRing** Camp ring used for monthly deployment
|
||||
- **CfaMode** State of Controlled Folder Access
|
||||
- **ConsumerAsrMode** State of Attack Surface Reduction
|
||||
- **CountAsrRules** Number of Attack Surface Reduction rules in place
|
||||
- **EngineRing** Engine ring used for monthly deployment
|
||||
- **EngineVersion** Version of the AntiMalware Engine
|
||||
- **IsAsrAnyAudit** Flag to indicate if any Attack Surface Reduction rules are running in Audit mode
|
||||
- **IsAsrAnyBlock** Flag to indicate if any Attack Surface Reduction rules are running in Block mode
|
||||
- **IsBeta** Flag to indicate if the user has opted in for Beta updates for Defender.
|
||||
- **IsManaged** Flag to indicate if Defender is running in manage mode
|
||||
- **IsPassiveMode** Flag to indicate if Defender is in Passive mode for ATP
|
||||
- **IsSxsPassiveMode** Flag to indicate if Defender is in Passive mode for Limited periodic scanning
|
||||
- **ProductGuid** Defender Product Guid (static for Defender).
|
||||
- **PusMode** Mode for blocking potentially unwanted software
|
||||
- **ShouldHashIds** Do we have ISO Compliance requirement to hash IDs for e5
|
||||
- **SignatureRing** Signature ring used for deployments
|
||||
- **SigVersion** Version of signature VDMs
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -2281,6 +2330,29 @@ The following fields are available:
|
||||
- **TargetPath** (Optional) If the operation is a move, the target path to which the file or directory is being moved.
|
||||
|
||||
|
||||
### Microsoft.Windows.Setup.WinSetupMon.TraceError
|
||||
|
||||
Provides details about error in the functioning of upgrade data safety monitoring filter driver.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Message** Text string describing the error condition.
|
||||
- **SessionId** Identifier to correlate this component's telemetry with that of others.
|
||||
- **Status** NTSTATUS code related to the error.
|
||||
|
||||
|
||||
### Microsoft.Windows.Setup.WinSetupMon.TraceErrorVolume
|
||||
|
||||
Provides details about error in the functioning of upgrade data safety monitoring filter driver, related to a specific volume (drive).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Message** Text string describing the error condition.
|
||||
- **SessionId** Identifier to correlate this component's telemetry with that of others.
|
||||
- **Status** NTSTATUS code related to the error.
|
||||
- **Volume** Path of the volume on which the error occurs
|
||||
|
||||
|
||||
### SetupPlatformTel.SetupPlatformTelEvent
|
||||
|
||||
This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios, to help keep Windows up to date.
|
||||
@ -3374,6 +3446,26 @@ The following fields are available:
|
||||
- **updateId** Unique identifier for each update.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.ScheduledScanBeforeInitialLogon
|
||||
|
||||
Indicates that a scan before an initial logon is being scheduled
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **deferDurationInMinutes** The delay in minutes until the scan for updates is performed.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
|
||||
|
||||
This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **configuredPoliciescount** Number of policies on the device.
|
||||
- **policiesNamevaluesource** Policy name and source of policy (group policy, MDM or flight).
|
||||
- **updateInstalluxsetting** Indicates whether a user has set policies via a user experience option.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.SIHClient.TaskRunCompleted
|
||||
|
||||
This event is a launch event for Server Initiated Healing client.
|
||||
@ -3430,6 +3522,23 @@ The following fields are available:
|
||||
- **UusVersion** The version of the Update Undocked Stack.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.WUClientExt.UpdateMetadataIntegrityGeneral
|
||||
|
||||
Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CallerName** Name of the application making the Windows Update Request. Used to identify context of the request.
|
||||
- **EndpointUrl** Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack.
|
||||
- **ExtendedStatusCode** Secondary status code for certain scenarios where StatusCode was not specific enough.
|
||||
- **MetadataIntegrityMode** Mode of update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
|
||||
- **RawMode** Raw unparsed mode string from the SLS response. May be null if not applicable.
|
||||
- **ServiceGuid** Identifier for the service to which the software distribution client is connecting (Windows Update, Windows Store, etc)
|
||||
- **SLSPrograms** A test program a machine may be opted in. Examples include "Canary" and "Insider Fast".
|
||||
- **StatusCode** Result code of the event (success, cancellation, failure code HResult)
|
||||
- **UusVersion** The version of the Update Undocked Stack
|
||||
|
||||
|
||||
### Microsoft.Windows.WindowsUpdate.RUXIM.ICSExit
|
||||
|
||||
This event is generated when the RUXIM Interaction Campaign Scheduler (RUXIMICS) exits. The data collected with this event is used to help keep Windows up to date and performing properly.
|
||||
@ -3482,7 +3591,4 @@ The following fields are available:
|
||||
- **ScenarioSupported** Whether the updated scenario that was passed in was supported.
|
||||
- **SessionId** The UpdateAgent “SessionId” value.
|
||||
- **UpdateId** Unique identifier for the Update.
|
||||
- **WuId** Unique identifier for the Windows Update client.
|
||||
|
||||
|
||||
|
||||
- **WuId** Unique identifier for the Windows Update client.
|
||||
@ -7,7 +7,7 @@ localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 05/23/2023
|
||||
ms.date: 09/26/2023
|
||||
ms.collection: highpri
|
||||
ms.topic: reference
|
||||
---
|
||||
@ -37,7 +37,6 @@ You can learn more about Windows functional and diagnostic data through these ar
|
||||
- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
|
||||
- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
|
||||
|
||||
|
||||
## AppPlatform events
|
||||
|
||||
### AppPlatform.InstallActivity
|
||||
@ -157,7 +156,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** The version of the appraiser binary generating the events.
|
||||
- **AppraiserVersion** The version of the appraiser binary generating the events.
|
||||
- **SdbEntries** Indicates if any matching compat Sdb entries are associated with this application
|
||||
|
||||
|
||||
@ -1182,6 +1181,19 @@ The following fields are available:
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PopCnt CPU requirement for newer versions of Windows, to help keep Windows up-to-date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
- **Blocking** Is the upgrade blocked due to the processor missing the PopCnt instruction?
|
||||
- **PopCntPassed** Whether the machine passes the latest OS hardware requirements or not for the PopCnt instruction.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
|
||||
@ -1462,7 +1474,7 @@ This event sends data about Azure presence, type, and cloud domain use in order
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AADDeviceId** Azure Active Directory device ID.
|
||||
- **AADDeviceId** Microsoft Entra ID device ID.
|
||||
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
|
||||
- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
|
||||
- **CDJType** Represents the type of cloud domain joined for the machine.
|
||||
@ -1470,7 +1482,7 @@ The following fields are available:
|
||||
- **ContainerType** The type of container, such as process or virtual machine hosted.
|
||||
- **EnrollmentType** Defines the type of MDM enrollment on the device.
|
||||
- **HashedDomain** The hashed representation of the user domain used for login.
|
||||
- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
|
||||
- **IsCloudDomainJoined** Is this device joined to a Microsoft Entra tenant? true/false
|
||||
- **IsDERequirementMet** Represents if the device can do device encryption.
|
||||
- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
|
||||
- **IsEDPEnabled** Represents if Enterprise data protected on the device.
|
||||
@ -1478,7 +1490,7 @@ The following fields are available:
|
||||
- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device.
|
||||
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
|
||||
|
||||
|
||||
@ -1941,6 +1953,7 @@ The following fields are available:
|
||||
|
||||
- **wilActivity** Contains the thread ID used to match the begin and end events, and for the end event also a HResult indicating sucess or failure.
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.HvciAlreadyEnabled
|
||||
|
||||
Fires when HVCI is already enabled so no need to continue auto-enablement.
|
||||
@ -2371,6 +2384,78 @@ The following fields are available:
|
||||
|
||||
## Diagnostic data events
|
||||
|
||||
### TelClientSynthetic.AbnormalShutdown_0
|
||||
|
||||
This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AbnormalShutdownBootId** BootId of the abnormal shutdown being reported by this event.
|
||||
- **AbsCausedbyAutoChk** This flag is set when AutoCheck forces a device restart to indicate that the shutdown was not an abnormal shutdown.
|
||||
- **AcDcStateAtLastShutdown** Identifies if the device was on battery or plugged in.
|
||||
- **BatteryLevelAtLastShutdown** The last recorded battery level.
|
||||
- **BatteryPercentageAtLastShutdown** The battery percentage at the last shutdown.
|
||||
- **CrashDumpEnabled** Are crash dumps enabled?
|
||||
- **CumulativeCrashCount** Cumulative count of operating system crashes since the BootId reset.
|
||||
- **CurrentBootId** BootId at the time the abnormal shutdown event was being reported.
|
||||
- **Firmwaredata->ResetReasonEmbeddedController** The reset reason that was supplied by the firmware.
|
||||
- **Firmwaredata->ResetReasonEmbeddedControllerAdditional** Additional data related to reset reason provided by the firmware.
|
||||
- **Firmwaredata->ResetReasonPch** The reset reason that was supplied by the hardware.
|
||||
- **Firmwaredata->ResetReasonPchAdditional** Additional data related to the reset reason supplied by the hardware.
|
||||
- **Firmwaredata->ResetReasonSupplied** Indicates whether the firmware supplied any reset reason or not.
|
||||
- **FirmwareType** ID of the FirmwareType as enumerated in DimFirmwareType.
|
||||
- **HardwareWatchdogTimerGeneratedLastReset** Indicates whether the hardware watchdog timer caused the last reset.
|
||||
- **HardwareWatchdogTimerPresent** Indicates whether hardware watchdog timer was present or not.
|
||||
- **InvalidBootStat** This is a sanity check flag that ensures the validity of the bootstat file.
|
||||
- **LastBugCheckBootId** bootId of the last captured crash.
|
||||
- **LastBugCheckCode** Code that indicates the type of error.
|
||||
- **LastBugCheckContextFlags** Additional crash dump settings.
|
||||
- **LastBugCheckOriginalDumpType** The type of crash dump the system intended to save.
|
||||
- **LastBugCheckOtherSettings** Other crash dump settings.
|
||||
- **LastBugCheckParameter1** The first parameter with additional info on the type of the error.
|
||||
- **LastBugCheckProgress** Progress towards writing out the last crash dump.
|
||||
- **LastBugCheckVersion** The version of the information struct written during the crash.
|
||||
- **LastSuccessfullyShutdownBootId** BootId of the last fully successful shutdown.
|
||||
- **LongPowerButtonPressDetected** Identifies if the user was pressing and holding power button.
|
||||
- **LongPowerButtonPressInstanceGuid** The Instance GUID for the user state of pressing and holding the power button.
|
||||
- **OOBEInProgress** Identifies if OOBE is running.
|
||||
- **OSSetupInProgress** Identifies if the operating system setup is running.
|
||||
- **PowerButtonCumulativePressCount** How many times has the power button been pressed?
|
||||
- **PowerButtonCumulativeReleaseCount** How many times has the power button been released?
|
||||
- **PowerButtonErrorCount** Indicates the number of times there was an error attempting to record power button metrics.
|
||||
- **PowerButtonLastPressBootId** BootId of the last time the power button was pressed.
|
||||
- **PowerButtonLastPressTime** Date and time of the last time the power button was pressed.
|
||||
- **PowerButtonLastReleaseBootId** BootId of the last time the power button was released.
|
||||
- **PowerButtonLastReleaseTime** Date and time of the last time the power button was released.
|
||||
- **PowerButtonPressCurrentCsPhase** Represents the phase of Connected Standby exit when the power button was pressed.
|
||||
- **PowerButtonPressIsShutdownInProgress** Indicates whether a system shutdown was in progress at the last time the power button was pressed.
|
||||
- **PowerButtonPressLastPowerWatchdogStage** Progress while the monitor is being turned on.
|
||||
- **PowerButtonPressPowerWatchdogArmed** Indicates whether or not the watchdog for the monitor was active at the time of the last power button press.
|
||||
- **ShutdownDeviceType** Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API.
|
||||
- **SleepCheckpoint** Provides the last checkpoint when there is a failure during a sleep transition.
|
||||
- **SleepCheckpointSource** Indicates whether the source is the EFI variable or bootstat file.
|
||||
- **SleepCheckpointStatus** Indicates whether the checkpoint information is valid.
|
||||
- **StaleBootStatData** Identifies if the data from bootstat is stale.
|
||||
- **TransitionInfoBootId** BootId of the captured transition info.
|
||||
- **TransitionInfoCSCount** l number of times the system transitioned from Connected Standby mode.
|
||||
- **TransitionInfoCSEntryReason** Indicates the reason the device last entered Connected Standby mode.
|
||||
- **TransitionInfoCSExitReason** Indicates the reason the device last exited Connected Standby mode.
|
||||
- **TransitionInfoCSInProgress** At the time the last marker was saved, the system was in or entering Connected Standby mode.
|
||||
- **TransitionInfoLastReferenceTimeChecksum** The checksum of TransitionInfoLastReferenceTimestamp,
|
||||
- **TransitionInfoLastReferenceTimestamp** The date and time that the marker was last saved.
|
||||
- **TransitionInfoLidState** Describes the state of the laptop lid.
|
||||
- **TransitionInfoPowerButtonTimestamp** The date and time of the last time the power button was pressed.
|
||||
- **TransitionInfoSleepInProgress** At the time the last marker was saved, the system was in or entering sleep mode.
|
||||
- **TransitionInfoSleepTranstionsToOn** Total number of times the device transitioned from sleep mode.
|
||||
- **TransitionInfoSystemRunning** At the time the last marker was saved, the device was running.
|
||||
- **TransitionInfoSystemShutdownInProgress** Indicates whether a device shutdown was in progress when the power button was pressed.
|
||||
- **TransitionInfoUserShutdownInProgress** Indicates whether a user shutdown was in progress when the power button was pressed.
|
||||
- **TransitionLatestCheckpointId** Represents a unique identifier for a checkpoint during the device state transition.
|
||||
- **TransitionLatestCheckpointSeqNumber** Represents the chronological sequence number of the checkpoint.
|
||||
- **TransitionLatestCheckpointType** Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational.
|
||||
- **VirtualMachineId** If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host.
|
||||
|
||||
|
||||
### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
|
||||
|
||||
This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly.
|
||||
@ -3375,7 +3460,7 @@ The following fields are available:
|
||||
- **DriverIsKernelMode** Is it a kernel mode driver?
|
||||
- **DriverName** The file name of the driver.
|
||||
- **DriverPackageStrongName** The strong name of the driver package
|
||||
- **DriverSigned** Is the driver signed?
|
||||
- **DriverSigned** Is the driver signed?
|
||||
- **DriverTimeStamp** The low 32 bits of the time stamp of the driver file.
|
||||
- **DriverType** A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
|
||||
- **DriverVersion** The version of the driver file.
|
||||
@ -3689,7 +3774,7 @@ The following fields are available:
|
||||
- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'.
|
||||
- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'.
|
||||
- **appPingEventDoneBeforeOOBEComplete** Indicates whether the install or update was completed before Windows Out of the Box Experience ends. 1 means event completed before OOBE finishes; 0 means event was not completed before OOBE finishes; -1 means the field does not apply.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country or region code that matches to the country or region updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2.
|
||||
- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
|
||||
- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
|
||||
@ -3876,6 +3961,33 @@ The following fields are available:
|
||||
- **resultCode** HR result of operation.
|
||||
|
||||
|
||||
## Other events
|
||||
|
||||
### Microsoft.Windows.Defender.Engine.Maps.Heartbeat
|
||||
|
||||
Heartbeat is sent once a day to indicate Defender is running and functional. Event includes necessary information to understand health of Defender on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppVersion** Version of the Defender platform
|
||||
- **CampRing** Camp ring used for monthly deployment
|
||||
- **CfaMode** State of Controlled Folder Access
|
||||
- **ConsumerAsrMode** State of Attack Surface Reduction
|
||||
- **CountAsrRules** Number of Attack Surface Reduction rules in place
|
||||
- **EngineRing** Engine ring used for monthly deployment
|
||||
- **EngineVersion** Version of the AntiMalware Engine
|
||||
- **IsAsrAnyAudit** Flag to indicate if any Attack Surface Reduction rules are running in Audit mode
|
||||
- **IsAsrAnyBlock** Flag to indicate if any Attack Surface Reduction rules are running in Block mode
|
||||
- **IsBeta** Flag to indicate if the user has opted in for Beta updates for Defender.
|
||||
- **IsManaged** Flag to indicate if Defender is running in manage mode
|
||||
- **IsPassiveMode** Flag to indicate if Defender is in Passive mode for ATP
|
||||
- **IsSxsPassiveMode** Flag to indicate if Defender is in Passive mode for Limited periodic scanning
|
||||
- **ProductGuid** Defender Product Guid (static for Defender).
|
||||
- **PusMode** Mode for blocking potentially unwanted software
|
||||
- **ShouldHashIds** Do we have ISO Compliance requirement to hash IDs for e5
|
||||
- **SignatureRing** Signature ring used for deployments
|
||||
- **SigVersion** Version of signature VDMs
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -3964,6 +4076,18 @@ The following fields are available:
|
||||
- **TargetPath** (Optional) If the operation is a move, the target path to which the file or directory is being moved.
|
||||
|
||||
|
||||
### Microsoft.Windows.Setup.WinSetupMon.TraceErrorVolume
|
||||
|
||||
Provides details about error in the functioning of upgrade data safety monitoring filter driver, related to a specific volume (drive).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Message** Text string describing the error condition.
|
||||
- **SessionId** Identifier to correlate this component's telemetry with that of others.
|
||||
- **Status** NTSTATUS code related to the error.
|
||||
- **Volume** Path of the volume on which the error occurs
|
||||
|
||||
|
||||
### SetupPlatformTel.SetupPlatformTelActivityEvent
|
||||
|
||||
This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up to date.
|
||||
@ -6225,6 +6349,17 @@ The following fields are available:
|
||||
- **WorkCompleted** A flag that indicates if work is completed.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
|
||||
|
||||
This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **configuredPoliciescount** Number of policies on the device.
|
||||
- **policiesNamevaluesource** Policy name and source of policy (group policy, MDM or flight).
|
||||
- **updateInstalluxsetting** Indicates whether a user has set policies via a user experience option.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.UX.InitiatingReboot
|
||||
|
||||
This event indicates that a restart was initiated in to enable the update process. The data collected with this event is used to help keep Windows up to date.
|
||||
@ -6618,4 +6753,4 @@ The following fields are available:
|
||||
- **Disposition** The parameter for the hard reserve adjustment function.
|
||||
- **Flags** The flags passed to the hard reserve adjustment function.
|
||||
- **PendingHardReserveAdjustment** The final change to the hard reserve size.
|
||||
- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve.
|
||||
- **UpdateType** Indicates whether the change is an increase or decrease in the size of the hard reserve.
|
||||
|
||||
@ -7,7 +7,7 @@ localizationpriority: high
|
||||
author: DHB-MSFT
|
||||
ms.author: danbrown
|
||||
manager: laurawi
|
||||
ms.date: 05/23/2023
|
||||
ms.date: 09/26/2023
|
||||
ms.collection: highpri
|
||||
ms.topic: reference
|
||||
---
|
||||
@ -1652,6 +1652,30 @@ The following fields are available:
|
||||
- **AppraiserVersion** The version of the Appraiser file that is generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PopCnt CPU requirement for newer versions of Windows, to help keep Windows up-to-date.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
- **Blocking** Is the upgrade blocked due to the processor missing the PopCnt instruction?
|
||||
- **PopCntPassed** Whether the machine passes the latest OS hardware requirements or not for the PopCnt instruction.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPopCntStartSync
|
||||
|
||||
The SystemProcessorPopCntStartSync event indicates that a new set of SystemProcessorPopCntAdd events will be sent. This event is used to understand if the system supports the PopCnt CPU requirement for newer versions of Windows.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppraiserVersion** Appraiser version
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
|
||||
|
||||
This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
|
||||
@ -1988,7 +2012,7 @@ This event sends data about Azure presence, type, and cloud domain use in order
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AADDeviceId** Azure Active Directory device ID.
|
||||
- **AADDeviceId** Microsoft Entra ID device ID.
|
||||
- **AzureOSIDPresent** Represents the field used to identify an Azure machine.
|
||||
- **AzureVMType** Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
|
||||
- **CDJType** Represents the type of cloud domain joined for the machine.
|
||||
@ -1996,7 +2020,7 @@ The following fields are available:
|
||||
- **ContainerType** The type of container, such as process or virtual machine hosted.
|
||||
- **EnrollmentType** Defines the type of MDM enrollment on the device.
|
||||
- **HashedDomain** The hashed representation of the user domain used for login.
|
||||
- **IsCloudDomainJoined** Is this device joined to an Azure Active Directory (AAD) tenant? true/false
|
||||
- **IsCloudDomainJoined** Is this device joined to a Microsoft Entra tenant? true/false
|
||||
- **IsDERequirementMet** Represents if the device can do device encryption.
|
||||
- **IsDeviceProtected** Represents if Device protected by BitLocker/Device Encryption
|
||||
- **IsDomainJoined** Indicates whether a machine is joined to a domain.
|
||||
@ -2005,7 +2029,7 @@ The following fields are available:
|
||||
- **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device.
|
||||
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
|
||||
|
||||
|
||||
@ -2474,6 +2498,7 @@ The following fields are available:
|
||||
|
||||
- **wilActivity** Contains the thread ID used to match the begin and end events, and for the end event also a HResult indicating sucess or failure.
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.CodeIntegrity.HVCISysprep.HvciScanGetResultFailed
|
||||
|
||||
Fires when driver scanning fails to get results.
|
||||
@ -3125,7 +3150,7 @@ The following fields are available:
|
||||
- **CoordinatorVersion** Coordinator version of DTU.
|
||||
- **CV** Correlation vector.
|
||||
- **IsCTA** If device has the CTA regkey set.
|
||||
- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the AAD (Azure Active Directory) domain.
|
||||
- **IsDeviceAADDomainJoined** Indicates whether the device is logged in to the Microsoft Entra domain.
|
||||
- **IsDeviceADDomainJoined** Indicates whether the device is logged in to the AD (Active Directory) domain.
|
||||
- **IsDeviceCloverTrail** Indicates whether the device has a Clover Trail system installed.
|
||||
- **IsDeviceDiskSpaceLow** If device disk space is low.
|
||||
@ -5150,7 +5175,7 @@ The following fields are available:
|
||||
- **appPingEventDoneBeforeOOBEComplete** Indicates whether the install or update was completed before Windows Out of the Box Experience ends. 1 means event completed before OOBE finishes; 0 means event was not completed before OOBE finishes; -1 means the field does not apply.
|
||||
- **appPingEventDownloadMetricsCdnAzureRefOriginShield** Provides a unique reference string that identifies a request served by Azure Front Door. It's used to search access logs and is critical for troubleshooting. For example, Ref A: E172B39D19774147B0EFCC8E3E823D9D Ref B: BL2EDGE0215 Ref C: 2021-05-11T22:25:48Z.
|
||||
- **appPingEventDownloadMetricsCdnCache** Corresponds to the result, whether the proxy has served the result from cache (HIT for yes, and MISS for no) For example, HIT from proxy.domain.tld, MISS from proxy.local.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country or region code that matches to the country or region updated binaries are delivered from. E.g.: US.
|
||||
- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2.
|
||||
- **appPingEventDownloadMetricsCdnMSEdgeRef** Used to help correlate client-to-AFD (Azure Front Door) conversations. For example, Ref A: E2476A9592DF426A934098C0C2EAD3AB Ref B: DM2EDGE0307 Ref C: 2022-01-13T22:08:31Z.
|
||||
- **appPingEventDownloadMetricsCdnP3P** Electronic privacy statement: CAO = collects contact-and-other, PSA = for pseudo-analysis, OUR = data received by us only. Helps identify the existence of transparent intermediaries (proxies) that can create noise in legitimate error detection. For example, CP=\"CAO PSA OUR\".
|
||||
@ -5591,6 +5616,33 @@ The following fields are available:
|
||||
|
||||
## Other events
|
||||
|
||||
### Microsoft.Windows.Defender.Engine.Maps.Heartbeat
|
||||
|
||||
Heartbeat is sent once a day to indicate Defender is running and functional. Event includes necessary information to understand health of Defender on the device.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AppVersion** Version of the Defender platform
|
||||
- **CampRing** Camp ring used for monthly deployment
|
||||
- **CfaMode** State of Controlled Folder Access
|
||||
- **ConsumerAsrMode** State of Attack Surface Reduction
|
||||
- **CountAsrRules** Number of Attack Surface Reduction rules in place
|
||||
- **EngineRing** Engine ring used for monthly deployment
|
||||
- **EngineVersion** Version of the AntiMalware Engine
|
||||
- **HeartbeatType** Enum of the reason the heartbeat is collected
|
||||
- **IsAsrAnyAudit** Flag to indicate if any Attack Surface Reduction rules are running in Audit mode
|
||||
- **IsAsrAnyBlock** Flag to indicate if any Attack Surface Reduction rules are running in Block mode
|
||||
- **IsBeta** Flag to indicate if the user has opted in for Beta updates for Defender.
|
||||
- **IsManaged** Flag to indicate if Defender is running in manage mode
|
||||
- **IsPassiveMode** Flag to indicate if Defender is in Passive mode for ATP
|
||||
- **IsSxsPassiveMode** Flag to indicate if Defender is in Passive mode for Limited periodic scanning
|
||||
- **ProductGuid** Defender Product Guid (static for Defender).
|
||||
- **PusMode** Mode for blocking potentially unwanted software
|
||||
- **ShouldHashIds** Do we have ISO Compliance requirement to hash IDs for e5
|
||||
- **SignatureRing** Signature ring used for deployments
|
||||
- **SigVersion** Version of signature VDMs
|
||||
|
||||
|
||||
### Microsoft.Windows.OneSettingsClient.Heartbeat
|
||||
|
||||
This event indicates the config state heartbeat. The data collected with this event is used to help keep Windows up to date, secure, and performing properly.
|
||||
@ -5600,6 +5652,20 @@ The following fields are available:
|
||||
- **Configs** Array of configs.
|
||||
|
||||
|
||||
### Microsoft.Windows.Security.SBServicing.ApplySecureBootUpdateFailed
|
||||
|
||||
Event that indicates that an attempt to apply secure boot updates failed
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **Action** Action string when error occured
|
||||
- **hr** Error code in HRESULT
|
||||
- **IsResealNeeded** BOOL value to indicate if TPM Reseal was needed
|
||||
- **SecureBootUpdateCaller** Scenario in which function was called. Could be Update or Upgrade
|
||||
- **UpdateType** Indicates if it is DB or DBX update
|
||||
- **WillResealSucceed** Indicates if TPM reseal operation is expected to succeed
|
||||
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -5730,6 +5796,16 @@ The following fields are available:
|
||||
|
||||
## Software update events
|
||||
|
||||
### SoftwareUpdateClientTelemetry.BadUpdateMetadata
|
||||
|
||||
Provides information on bad update metadata detection. This information is used to understand the impacted update and ensure correct updates to keep windows up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **RevisionId** Update metadata revision Id.
|
||||
- **ServiceGuid** The service endpoint (pre-defined GUID) which client is checking updates against.
|
||||
|
||||
|
||||
### SoftwareUpdateClientTelemetry.CheckForUpdates
|
||||
|
||||
This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date.
|
||||
@ -5749,7 +5825,7 @@ The following fields are available:
|
||||
- **CachedEngineVersion** For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
|
||||
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
|
||||
- **CapabilityDetectoidGuid** The GUID for a hardware applicability detectoid that could not be evaluated.
|
||||
- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNCountryCode** Two letter country or region abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNId** The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
|
||||
- **ClientVersion** The version number of the software distribution client.
|
||||
- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0.
|
||||
@ -5870,7 +5946,7 @@ The following fields are available:
|
||||
- **CallerApplicationName** The name provided by the caller who initiated API calls into the software distribution client.
|
||||
- **CbsDownloadMethod** Indicates whether the download was a full- or a partial-file download.
|
||||
- **CbsMethod** The method used for downloading the update content related to the Component Based Servicing (CBS) technology.
|
||||
- **CDNCountryCode** Two letter country abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNCountryCode** Two letter country or region abbreviation for the Content Distribution Network (CDN) location.
|
||||
- **CDNId** ID which defines which CDN the software distribution client downloaded the content from.
|
||||
- **ClientVersion** The version number of the software distribution client.
|
||||
- **CommonProps** A bitmask for future flags associated with the Windows Update client behavior.
|
||||
@ -6370,6 +6446,25 @@ The following fields are available:
|
||||
- **Ver** Schema version.
|
||||
|
||||
|
||||
### Microsoft.Surface.Battery.Prod.BatteryInfoEventV3
|
||||
|
||||
Hardware level data about battery performance.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **BatteryTelemetry** Hardware Level Data about battery performance.
|
||||
- **ComponentId** Component ID.
|
||||
- **FwVersion** FW version that created this log.
|
||||
- **LogClass** LOG CLASS.
|
||||
- **LogInstance** Log instance within class (1..n).
|
||||
- **LogVersion** LOG MGR VERSION.
|
||||
- **MCUInstance** Instance id used to identify multiple MCU's in a product.
|
||||
- **ProductId** ProductId ID.
|
||||
- **SeqNum** Sequence Number.
|
||||
- **TimeStamp** UTC seconds when log was created.
|
||||
- **Ver** Schema version.
|
||||
|
||||
|
||||
### Microsoft.Surface.Health.Binary.Prod.McuHealthLog
|
||||
|
||||
This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly.
|
||||
@ -6923,10 +7018,10 @@ The following fields are available:
|
||||
- **CV** The correlation vector.
|
||||
- **GlobalEventCounter** Counts the events at the global level for telemetry.
|
||||
- **PackageVersion** The package version for currency tools.
|
||||
- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is Azure Active Directory joined.
|
||||
- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is Microsoft Entra joined.
|
||||
- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy.
|
||||
- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy.
|
||||
- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is Azure Active Directory joined.
|
||||
- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is Microsoft Entra joined.
|
||||
- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined.
|
||||
- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined.
|
||||
- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU.
|
||||
@ -7053,7 +7148,7 @@ The following fields are available:
|
||||
- **PackageVersion** The package version of the label.
|
||||
- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file.
|
||||
- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer.
|
||||
- **UpdateHealthToolsDssDeviceId** The Azure Active Directory ID of the device used to create the device ID hash.
|
||||
- **UpdateHealthToolsDssDeviceId** The ID in Microsoft Entra ID of the device used to create the device ID hash.
|
||||
- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer.
|
||||
- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash.
|
||||
- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id.
|
||||
@ -7062,7 +7157,7 @@ The following fields are available:
|
||||
|
||||
### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoDSSJoin
|
||||
|
||||
This event is sent when the device is not joined to Azure Active Directory. The data collected with this event is used to help keep Windows up to date and secure.
|
||||
This event is sent when the device is not Microsoft Entra joined. The data collected with this event is used to help keep Windows up to date and secure.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -8804,6 +8899,19 @@ The following fields are available:
|
||||
|
||||
- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.Client.UpdatePolicyCacheRefresh
|
||||
|
||||
This ensures the update policies are refreshed in the cache so that we can properly determine what updates the device should be offered and how the device should take the updates (e.g. how and when to scan, download, install, and reboot).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **configuredPoliciescount** Number of configured policies
|
||||
- **policiesNamevaluesource** Name of the policies
|
||||
- **updateInstalluxsetting** Whether the update install setting is set
|
||||
- **wuDeviceid** Device ID.
|
||||
|
||||
|
||||
### Microsoft.Windows.Update.Orchestrator.DeferRestart
|
||||
|
||||
This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user