From a168f8af7f9af53e7dd874afa4e8fb05bde719cc Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 2 Apr 2019 08:53:13 -0700 Subject: [PATCH] new build 4/2/2019 8:53 AM --- ...ndows-diagnostic-events-and-fields-1703.md | 2 +- ...ndows-diagnostic-events-and-fields-1709.md | 2 +- ...ndows-diagnostic-events-and-fields-1803.md | 2 +- ...ndows-diagnostic-events-and-fields-1809.md | 125 +++++++++++++++++- 4 files changed, 125 insertions(+), 6 deletions(-) diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 1d21304909..c7bbf928bd 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/01/2019 +ms.date: 04/02/2019 --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index e06f5187b6..72b3a95d4c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/01/2019 +ms.date: 04/02/2019 --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 0606766261..48424772ba 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/01/2019 +ms.date: 04/02/2019 --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 25ff1cd99e..f86d9d6c9c 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 04/01/2019 +ms.date: 04/02/2019 --- @@ -1774,6 +1774,7 @@ The following fields are available: - **WmdrmInUse** WmdrmIndicators AND dismissible block in setup was not dismissed. - **WmdrmNonPermanent** Indicates if the system has any files with non-permanent licenses. - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +- **聗mdrmNonPermanent** No content is currently available. ### Microsoft.Windows.Appraiser.General.WmdrmRemove @@ -1960,7 +1961,9 @@ The following fields are available: - **MEID** Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. - **MNC0** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. - **MNC1** Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage. +- **Mobi�eOperatorNetwork1** No content is currently available. - **MobileOperatorBilling** Represents the telephone company that provides services for mobile phone users. +- **MobileOperatorCommercia�ized** No content is currently available. - **MobileOperatorCommercialized** Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US. - **MobileOperatorNetwork0** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. - **MobileOperatorNetwork1** Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage. @@ -2719,7 +2722,9 @@ Fired by UTC at startup to signal what data we are allowed to collect. The following fields are available: +- **CanAddMsagoMsTelemetry** No content is currently available. - **CanAddMsaToMsTelemetry** True if we can add MSA PUID and CID to telemetry, false otherwise. +- **CanCollactAnyTelemetry** No content is currently available. - **CanCollectAnyTelemetry** True if we are allowed to collect partner telemetry, false otherwise. - **CanCollectCoreTelemetry** True if we can collect CORE/Basic telemetry, false otherwise. - **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise. @@ -2727,7 +2732,9 @@ The following fields are available: - **CanCollectWindowsAnalyticsEvents** True if we can collect Windows Analytics data, false otherwise. - **CanPerformDiagnosticEscalations** True if we can perform diagnostic escalation collection, false otherwise. - **CanPerformTraceEscalations** True if we can perform trace escalation collection, false otherwise. +- **CanPerfotmDiagnosticEscalations** No content is currently available. - **CanReportScenarios** True if we can report scenario completions, false otherwise. +- **Can䁃ollectCoreTelemetry** No content is currently available. - **PreviousPermissions** Bitmask of previous telemetry state. - **TransitionFromEverythingOff** True if we are transitioning from all telemetry being disabled, false otherwise. @@ -2742,6 +2749,7 @@ The following fields are available: - **CensusStartTime** Returns timestamp corresponding to last successful census run. - **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. +- **LastGonnectivityLossTime** No content is currently available. - **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2754,9 +2762,18 @@ This event sends data about the health and quality of the diagnostic data from t The following fields are available: - **AgentConnectionErrorsCount** Number of non-timeout errors associated with the host/agent channel. +- **AggregationFlags** No content is currently available. +- **AggregationPeriodMS** No content is currently available. +- **AudioInMS** No content is currently available. +- **AudioOutMS** No content is currently available. +- **BackgroundMouseSec** No content is currently available. +- **BitPeriodMS** No content is currently available. - **CensusExitCode** The last exit code of the Census task. - **CensusStartTime** Time of last Census run. - **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **CompositionDirtyGeneratedSec** No content is currently available. +- **CompositionDirtyPropagatedSec** No content is currently available. +- **CompositionRenderedSec** No content is currently available. - **CompressedBytesUploaded** Number of compressed bytes uploaded. - **ConsumerDroppedCount** Number of events dropped at consumer layer of telemetry client. - **CriticalDataDbDroppedCount** Number of critical data sampled events dropped at the database layer. @@ -2773,43 +2790,72 @@ The following fields are available: - **DbDroppedFailureCount** Number of events dropped due to DB failures. - **DbDroppedFullCount** Number of events dropped due to DB fullness. - **DecodingDroppedCount** Number of events dropped due to decoding failures. +- **Decoding刁刁刁刁刁刁刁刁刁刁刁刁** No content is currently available. - **EnteringCriticalOverflowDroppedCounter** Number of events dropped due to critical overflow mode being initiated. - **EnteringCrrancalOverflowDroppedCounter** No content is currently available. - **EtwDroppedBufferCount** Number of buffers dropped in the UTC ETW session. +- **EtwDroppedBuffertorFlags** No content is currently available. - **EtwDroppedCount** Number of events dropped at ETW layer of telemetry client. +- **Eve~tStoreResetSizeSum** No content is currently available. +- **EventSequence** No content is currently available. - **EventsPersistedCount** Number of events that reached the PersistEvent stage. - **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC. - **EventStoreResetCounter** Number of times event DB was reset. - **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance. +- **EventStOreResetSizeSum** No content is currently available. - **EventSubStoreResetCounter** Number of times event DB was reset. - **EventSubStoreResetSizeSum** Total size of event DB across all resets reports in this instance. - **EventsUploaded** Number of events uploaded. - **Flags** Flags indicating device state such as network state, battery state, and opt-in state. - **FullTriggerBufferDroppedCount** Number of events dropped due to trigger buffer being full. +- **FullTriggerBuvferDroppedCount** No content is currently available. +- **GameInputSec** No content is currently available. - **HeartBeatSequenceNumber** The sequence number of this heartbeat. +- **InteractiveTimeoutPeriodMS** No content is currently available. - **InvalidHttpCodeCount** Number of invalid HTTP codes received from contacting Vortex. +- **InvalidHttpCodECount** No content is currently available. - **LastAgentConnectionError** Last non-timeout error encountered in the host/agent channel. - **LastEventSizeOffender** Event name of last event which exceeded max event size. - **LastInvalidHttpCode** Last invalid HTTP code received from Vortex. - **MaxActiveAgentConnectionCount** The maximum number of active agents during this heartbeat timeframe. +- **MaxIn]seScenarioCounter** No content is currently available. - **MaxInUseScenarioCounter** Soft maximum number of scenarios loaded by UTC. +- **MaxInUseScenarioCountev** No content is currently available. - **PreviousHeartBeatTime** Time of last heartbeat event (allows chaining of events). - **PrivacyBlockedCount** The number of events blocked due to privacy settings or tags. +- **Repe`tedUploadFailureDropped** No content is currently available. - **RepeatedUploadFailureDropped** Number of events lost due to repeated upload failures for a single buffer. +- **SettingsHttpAtsempts** No content is currently available. - **SettingsHttpAttempts** Number of attempts to contact OneSettings service. - **SettingsHttpFailures** The number of failures from contacting the OneSettings service. +- **SinceFirstInteractivityMS** No content is currently available. +- **SpeechRecognitionSec** No content is currently available. +- **SummaryRound** No content is currently available. +- **TargetAsId** No content is currently available. - **ThrottledDroppedCount** Number of events dropped due to throttling of noisy providers. - **TopUploaderErrors** List of top errors received from the upload endpoint. - **UploaderDroppedCount** Number of events dropped at the uploader layer of telemetry client. - **UploaderErrorCount** Number of errors received from the upload endpoint. +- **ViewFlags** No content is currently available. +- **VodtexFailuresTimeout** No content is currently available. +- **VodtexHttpAttempts** No content is currently available. +- **VodtexHttpFailures4xx** No content is currently available. +- **VodtexHttpFailures5xx** No content is currently available. +- **VodtexHttpResponseFailures** No content is currently available. +- **VodtexHttpResponsesWithDroppedEvents** No content is currently available. - **VortexFailuresTimeout** The number of timeout failures received from Vortex. +- **VortexHttpAtsempts** No content is currently available. - **VortexHttpAttempts** Number of attempts to contact Vortex. - **VortexHttpeReponseFailures** No content is currently available. - **VortexHttpeReponsesWithDroppedEvents** No content is currently available. - **VortexHttpFailures4xx** Number of 400-499 error codes received from Vortex. - **VortexHttpFailures5xx** Number of 500-599 error codes received from Vortex. +- **VortexHttpFailures5xz** No content is currently available. - **VortexHttpResponseFailures** Number of Vortex responses that are not 2XX or 400. - **VortexHttpResponsesWithDroppedEvents** Number of Vortex responses containing at least 1 dropped event. +- **VortexHttpResponsesWythDroppedEvents** No content is currently available. +- **WindowFlags** No content is currently available. +- **刁刁刁刁刁merDroppedCoᕵnt** No content is currently available. ### TelClientSynthetic.HeartBeat_Aria_5 @@ -3414,12 +3460,17 @@ The following fields are available: - **AdapterTypeValue** The numeric value indicating the type of Graphics adapter. - **aiSeqId** The event sequence ID. +- **bootAd** No content is currently available. - **bootId** The system boot ID. - **BrightnessVersionViaDDI** The version of the Display Brightness Interface. +- **CompupePreemptionLevel** No content is currently available. - **ComputePreemptionLevel** The maximum preemption level supported by GPU for compute payload. +- **ComputePreeMptionLevel** No content is currently available. - **DedicatedSystemMemoryB** The amount of system memory dedicated for GPU use (in bytes). +- **DedicatedViddoMemoryB** No content is currently available. - **DedicatedVideoMemoryB** The amount of dedicated VRAM of the GPU (in bytes). - **DedicatedVidmoMemoryB** No content is currently available. +- **DedicatedVifeoMemoryB** No content is currently available. - **DisplayAdapterLuid** The display adapter LUID. - **DriverDate** The date of the display driver. - **DriverRank** The rank of the display driver. @@ -3432,6 +3483,7 @@ The following fields are available: - **GPUPreemptionLevel** The maximum preemption level supported by GPU for graphics payload. - **GPURevisionID** The GPU revision ID. - **GPUVendorID** The GPU vendor ID. +- **IntarfaceId** No content is currently available. - **InterfaceId** The GPU interface ID. - **IsDisplayDevice** Does the GPU have displaying capabilities? - **IsHwSchSupported** Indicates whether the adapter supports hardware scheduling. @@ -3440,6 +3492,7 @@ The following fields are available: - **IsLDA** Is the GPU comprised of Linked Display Adapters? - **IsMiracastSupported** Does the GPU support Miracast? - **IsMismatchLDA** Is at least one device in the Linked Display Adapters chain from a different vendor? +- **IsMismat-hLDA** No content is currently available. - **IsMPOSupported** Does the GPU support Multi-Plane Overlays? - **IsMsMiracastSupported** Are the GPU Miracast capabilities driven by a Microsoft solution? - **IsPostAdapter** Is this GPU the POST GPU in the device? @@ -3448,6 +3501,7 @@ The following fields are available: - **IsSoftwareDevice** Is this a software implementation of the GPU? - **KMDF** No content is currently available. - **KMDFilePath** The file path to the location of the Display Kernel Mode Driver in the Driver Store. +- **MeasureEnablad** No content is currently available. - **MeasureEnabled** Is the device listening to MICROSOFT_KEYWORD_MEASURES? - **MsHybridDiscrete** Indicates whether the adapter is a discrete adapter in a hybrid configuration. - **NumVidPnSources** The number of supported display output sources. @@ -3457,6 +3511,7 @@ The following fields are available: - **SubVendorID** The GPU sub vendor ID. - **TelemetryEnabled** Is the device listening to MICROSOFT_KEYWORD_TELEMETRY? - **TelInvEvntTrigger** What triggered this event to be logged? Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling) +- **TelINvEvntTrigger** No content is currently available. - **TmlemetryEnabled** No content is currently available. - **version** The event version. - **WDDMVersion** The Windows Display Driver Model version. @@ -3546,27 +3601,39 @@ This event sends data about crashes for both native and managed applications, to The following fields are available: - **AppName** The name of the app that has crashed. +- **AppSassionGuid** No content is currently available. +- **AppSessionGqid** No content is currently available. - **AppSessionGuid** GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend. +- **AppTimestamp** No content is currently available. - **AppTimeStamp** The date/time stamp of the app. - **AppVersion** The version of the app that has crashed. +- **ExcaptionCode** No content is currently available. - **ExceptionCode** The exception code returned by the process that has crashed. - **ExceptionOffset** The address where the exception had occurred. - **Flags** Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting. - **FriendlyAppName** The description of the app that has crashed, if different from the AppName. Otherwise, the process name. - **IsFatal** True/False to indicate whether the crash resulted in process termination. - **ModName** Exception module name (e.g. bar.dll). +- **ModTimaStamp** No content is currently available. - **ModTimeStamp** The date/time stamp of the module. +- **ModVarsion** No content is currently available. - **ModVersion** The version of the module that has crashed. +- **PackageFullNama** No content is currently available. - **PackageFullName** Store application identity. - **PackageRelativeAppId** Store application identity. - **ProcessArchitecture** Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64. +- **ProcessArinetecture** No content is currently available. - **ProcessCreateTime** The time of creation of the process that has crashed. - **ProcessId** The ID of the process that has crashed. - **ReportId** A GUID used to identify the report. This can used to track the report across Watson. +- **TargepAsId** No content is currently available. - **TargetAppId** The kernel reported AppId of the application being reported. - **TargetAppVer** The specific version of the application being reported - **TargetAppVr** No content is currently available. - **TargetAsId** The sequence number for the hanging process. +- **TarSetAppId** No content is currently available. +- **TarSetAppVer** No content is currently available. +- **TarSetAsId** No content is currently available. ## Feature update events @@ -3684,6 +3751,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic The following fields are available: +- **HiddenAr`** No content is currently available. - **HiddenArp** Indicates whether a program hides itself from showing up in ARP. - **InstallDate** The date the application was installed (a best guess based on folder creation date heuristics). - **InstallDateArpLastModified** The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015 00:00:00 @@ -3692,12 +3760,15 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. +- **MsiPqckageCode** No content is currently available. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. +- **OSVersionAtI~stallTi}e** No content is currently available. - **OSVersionAtInstallTime** The four octets from the OS version at the time of the application's install. - **PackageFullName** The package full name for a Store application. - **ProgramInstanceId** A hash of the file IDs in an app. - **Publisher** The Publisher of the application. Location pulled from depends on the 'Source' field. +- **RootDibPath** No content is currently available. - **RootDirPath** The path to the root directory where the program was installed. - **Source** How the program was installed (for example, ARP, MSI, Appx). - **StoreAppType** A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp. @@ -3906,6 +3977,8 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic The following fields are available: +- **** No content is currently available. +- **€** No content is currently available. - **BusReportedDescription** The description of the device reported by the bux. - **Class** The device setup class of the driver loaded for the device. - **ClassGuid** The device class unique identifier of the driver package loaded on the device. @@ -3919,6 +3992,8 @@ The following fields are available: - **DriverId** The unique identifier for the installed driver. - **DriverName** The name of the driver image file. - **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **DriverPackageStrongName** No content is currently available. +- **DriverV** No content is currently available. - **DriverVerDate** The date associated with the driver installed on the device. - **DriverVerVersion** The version number of the driver installed on the device. - **Enumerator** Identifies the bus that enumerated the device. @@ -4538,12 +4613,15 @@ The following fields are available: - **BootType** Identifies the type of boot (e.g.: "Cold", "Hiber", "Resume"). - **EventTimestamp** Seconds elapsed since an arbitrary time point. This can be used to identify the time difference in successive boot attempts being made. - **FirmwareResetReasonEmbeddedController** Reason for system reset provided by firmware. +- **FirmwareresetReasonEmbeddedControllerAdditional** No content is currently available. - **FirmwareResetReasonEmbeddedControllerAdditional** Additional information on system reset reason provided by firmware if needed. - **FirmwareResetReasonPch** Reason for system reset provided by firmware. - **FirmwareResetReasonPchAdditional** Additional information on system reset reason provided by firmware if needed. +- **FirmwareResetReasonPchADditional** No content is currently available. - **FirmwareResetReasonSupplied** Flag indicating that a reason for system reset was provided by firmware. - **IO** Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io). - **LastBootSucceeded** Flag indicating whether the last boot was successful. +- **LastBootSucceedEd** No content is currently available. - **LastShutdownSucceeded** Flag indicating whether the last shutdown was successful. - **MaxAbove4GbFreeRange** This field describes the largest memory range available above 4Gb. - **MaxBelow4GbFreeRange** This field describes the largest memory range available below 4Gb. @@ -4792,8 +4870,6 @@ The following fields are available: - **fileName** The file name where the failure occurred. - **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **hresult€threadId** No content is currently available. -- **hrutTyp** No content is currently available. - **lineNumber** The line number where the failure occurred. - **message** The message of the failure that occurred. - **module** The module where the failure occurred. @@ -4877,8 +4953,10 @@ This service retrieves events generated by SetupPlatform, the engine that drives The following fields are available: +- **CroupName** No content is currently available. - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **Valqe** No content is currently available. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -4890,6 +4968,8 @@ Scan process event on Windows Update client. See the EventScenario field for spe The following fields are available: +- **Ä7G§