diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index fc3ba2d75a..a241aced69 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -81,7 +82,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -This event sends compatibility information about a file to help keep Windows up-to-date. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -97,7 +98,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -108,7 +109,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -136,7 +137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -147,7 +148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -167,7 +168,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -198,7 +199,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -209,7 +210,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -229,7 +230,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -240,7 +241,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -260,7 +261,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -271,7 +272,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -292,7 +293,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -303,7 +304,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -341,7 +342,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -352,7 +353,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -386,7 +387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -397,7 +398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -This event indicates that the DecisionDevicePnp object is no longer present. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -422,7 +423,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -433,7 +434,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -459,7 +460,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -470,7 +471,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -492,7 +493,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -503,7 +504,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -527,7 +528,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -538,7 +539,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -564,7 +565,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -575,7 +576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -619,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.EnterpriseScenarioWithDiagTrackServiceRunning -This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. +This event indicates that Appraiser has been triggered to run an enterprise scenario while the DiagTrack service is installed. This event can only be sent if a special flag is used to trigger the enterprise scenario. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -643,7 +644,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -666,7 +667,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -677,7 +678,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +700,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -710,7 +711,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -737,7 +738,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -748,7 +749,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -759,7 +760,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -772,7 +773,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -783,7 +784,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -794,7 +795,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -819,7 +820,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -830,7 +831,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -841,7 +842,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -871,7 +872,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -882,7 +883,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -904,7 +905,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -915,7 +916,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -937,7 +938,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -948,7 +949,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -971,7 +972,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1004,7 +1005,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1015,7 +1016,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1037,7 +1038,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1048,7 +1049,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1070,7 +1071,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1081,7 +1082,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1103,7 +1104,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1114,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1147,7 +1148,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1173,7 +1174,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1184,7 +1185,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1258,7 +1259,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1271,7 +1272,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1281,7 +1282,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1292,19 +1293,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1321,14 +1312,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. - **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier. ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1340,7 +1331,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1355,7 +1346,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1391,7 +1382,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1401,7 +1392,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1424,7 +1415,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1482,13 +1473,13 @@ The following fields are available: ### Census.Security -Provides information on several important data points about security settings. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1505,7 +1496,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1516,7 +1507,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1526,7 +1517,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1548,7 +1539,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1574,7 +1565,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1769,7 +1760,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. @@ -1868,7 +1859,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1887,7 +1878,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -1906,7 +1897,7 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: @@ -2168,7 +2159,7 @@ The following fields are available: ### ChecksumDictionary -The list of values sent by each object type. +This event provides the list of values sent by each object type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2178,7 +2169,7 @@ The following fields are available: ### COMPID -This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. +This event provides a device's internal application compatible ID, a vendor-defined identification that Windows uses to match a device to an INF file. A device can have a list of compatible IDs associated with it. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2188,7 +2179,7 @@ The following fields are available: ### HWID -This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. +This event provides a device's internal hardware ID, a vendor-defined identification that Windows uses to match a device to an INF file. In most cases, a device has associated with it a list of hardware IDs. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2198,7 +2189,7 @@ The following fields are available: ### InstallDateArpLastModified -This event indicates the date the add/remove program (ARP) entry was last modified by an update. +This event indicates the date the add/remove program (ARP) entry was last modified by an update. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2208,7 +2199,7 @@ The following fields are available: ### InstallDateFromLinkFile -This event provides the application installation date from the linked file. +This event provides the application installation date from the linked file. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2218,7 +2209,7 @@ The following fields are available: ### InstallDateMsi -The install date from the Microsoft installer (MSI) database. +This event provides the install date from the Microsoft installer (MSI) database. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2228,7 +2219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2254,7 +2245,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2266,7 +2257,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2283,7 +2274,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,31 +2303,31 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2347,7 +2338,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2358,7 +2349,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2382,7 +2373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2393,7 +2384,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2404,7 +2395,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2433,7 +2424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2444,7 +2435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2457,7 +2448,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2468,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2477,9 +2468,48 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd + +This event represents the basic metadata about a plug and play (PNP) device and its associated driver. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Class** The device setup class of the driver loaded for the device. +- **ClassGuid** The device class unique identifier of the driver package loaded on the device. +- **COMPID** The list of “Compatible IDs” for this device. See [COMPID](#compid). +- **ContainerId** The system-supplied unique identifier that specifies which group(s) the device(s) installed on the parent (main) device belong to. +- **Description** The description of the device. +- **DeviceState** Identifies the current state of the parent (main) device. +- **DriverId** The unique identifier for the installed driver. +- **DriverName** The name of the driver image file. +- **DriverPackageStrongName** The immediate parent directory name in the Directory field of InventoryDriverPackage. +- **DriverVerDate** The date of the driver loaded for the device +- **DriverVerVersion** The version of the driver loaded for the device +- **Enumerator** Identifies the bus that enumerated the device. +- **HWID** A list of hardware IDs for the device. See [HWID](#hwid). +- **Inf** The name of the INF file (possibly renamed by the OS, such as oemXX.inf). +- **InstallState** The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx +- **InventoryVersion** The version number of the inventory process generating the events. +- **LowerClassFilters** The identifiers of the Lower Class filters installed for the device. +- **LowerFilters** The identifiers of the Lower filters installed for the device. +- **Manufacturer** The manufacturer of the device. +- **MatchingID** The Hardware ID or Compatible ID that Windows uses to install a device instance. +- **Model** Identifies the model of the device. +- **objectInstanceId** Deprecated. The Device Instance ID of the device (uniquely identifies a device in the system). Example: pci\ven_8086&dev_0085&subsys_13118086&rev_34\4&2dded11c&0&00e1 +- **ParentId** The Device Instance ID of the parent of the device. +- **ProblemCode** The error code currently returned by the device, if applicable. +- **Provider** Identifies the device provider. +- **Service** The name of the device service. +- **STACKID** The list of hardware IDs for the stack. See [STACKID](#stackid). +- **UpperClassFilters** The identifiers of the Upper Class filters installed for the device. +- **UpperFilters** The identifiers of the Upper filters installed for the device. + + ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2490,7 +2520,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2501,19 +2531,19 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2540,7 +2570,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2551,7 +2581,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2562,7 +2592,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2581,7 +2611,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2592,7 +2622,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2601,9 +2631,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2630,7 +2668,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2642,115 +2680,121 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2760,7 +2804,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2772,7 +2816,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2780,7 +2824,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2788,7 +2832,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2796,7 +2840,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### STACKID -This event provides the internal compatible ID for the stack. +This event provides the internal compatible ID for the stack. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2818,7 +2862,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2843,7 +2887,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. +This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to help monitor reliability and performance of managed devices. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2868,15 +2912,21 @@ The following fields are available: ## Migration events +### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr + +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. + + + ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -2884,7 +2934,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2897,7 +2947,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2909,7 +2959,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,7 +2975,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2938,7 +2988,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2948,7 +2998,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OfficeRegistration -This event indicates the status of the OneDrive integration with Microsoft Office. +This event indicates the status of the OneDrive integration with Microsoft Office. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2957,7 +3007,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2967,7 +3017,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.RepairResult -The event determines the result of the installation repair. +The event determines the result of the installation repair. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2976,7 +3026,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.SetupBinaryDownloadHResult -This event indicates the status when downloading the OneDrive setup file. +This event indicates the status when downloading the OneDrive setup file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2985,7 +3035,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2996,7 +3046,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateTierReg -This event determines status of the update tier registry values. +This event determines status of the update tier registry values. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3006,7 +3056,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3015,7 +3065,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3026,7 +3076,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3043,7 +3093,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3055,7 +3105,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3067,7 +3117,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3079,7 +3129,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3093,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3141,7 +3191,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3268,7 +3318,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent -This event indicates that an unexpected error occurred during an update and provides information to help address the issue. +This event indicates that an unexpected error occurred during an update and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3282,7 +3332,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Error -This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. +This event indicates a Sediment Pack error (update stack failure) has been detected and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3293,7 +3343,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.FallbackError -This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. +This event indicates an error when Self Update results in a Fallback and provides information to help address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3303,7 +3353,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent -This event occurs when the Notify User task executes and provides information about the cause of the notification. +This event occurs when the Notify User task executes and provides information about the cause of the notification. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3319,7 +3369,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId -This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. +This event provides the modification of the date on which an Automatic App Update scheduled task failed and provides information about the failure. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3331,7 +3381,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId -This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. +This event identifies the remediation plug-in that returned an unexpected exception and provides information about the exception. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3343,7 +3393,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed -This event tracks the health of key update (Remediation) services and whether they are enabled. +This event tracks the health of key update (Remediation) services and whether they are enabled. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3382,7 +3432,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Started -deny +This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3452,7 +3502,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. @@ -3473,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DownloadServiceProgress -This event indicates the progress of the downloader in 1% increments. +This event indicates the progress of the downloader in 1% increments. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3574,7 +3624,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3637,7 +3687,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3648,7 +3698,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3662,7 +3712,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3693,7 +3743,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3797,7 +3847,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3813,7 +3863,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3828,7 +3878,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3839,7 +3889,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3848,7 +3898,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3909,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3872,7 +3922,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3897,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3913,7 +3963,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3935,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3946,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3955,7 +4005,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3966,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3979,7 +4029,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4070,7 +4120,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4095,7 +4145,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4122,19 +4172,19 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. @@ -4142,7 +4192,7 @@ This event reports the status of an action following a reboot, should one have b ### SoftwareUpdateClientTelemetry.CheckForUpdates -This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4339,7 +4389,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4361,7 +4411,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4466,7 +4516,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.SLSDiscovery -This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. +This event sends data about the ability of Windows to discover the location of a backend server with which it must connect to perform updates or content acquisition, in order to determine disruptions in availability of update services and provide context for Windows Update errors. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4482,7 +4532,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4497,7 +4547,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -This event identifies whether updates have been tampered with and protects against man-in-the-middle attacks. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4529,7 +4579,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4540,7 +4590,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4553,7 +4603,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4564,7 +4614,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4575,7 +4625,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4585,7 +4635,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4599,7 +4649,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4612,7 +4662,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4639,7 +4689,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4655,7 +4705,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4673,7 +4723,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4689,7 +4739,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4705,7 +4755,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4720,7 +4770,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4737,7 +4787,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4753,7 +4803,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4784,7 +4834,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4804,7 +4854,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4822,7 +4872,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4838,7 +4888,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4864,13 +4914,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4886,13 +4936,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,13 +4971,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -4975,7 +5025,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5122,19 +5172,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. @@ -5222,7 +5272,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5635,7 +5685,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5660,7 +5710,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5699,7 +5749,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5717,7 +5767,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5749,7 +5799,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5770,7 +5820,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5826,7 +5876,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5850,7 +5900,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5865,7 +5915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5880,7 +5930,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5895,7 +5945,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5910,7 +5960,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5925,7 +5975,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5940,7 +5990,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5955,7 +6005,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5970,7 +6020,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5980,7 +6030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5991,7 +6041,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6010,7 +6060,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6028,7 +6078,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6043,7 +6093,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6060,7 +6110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6085,7 +6135,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6097,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6109,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6125,7 +6175,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6137,7 +6187,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6146,7 +6196,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6166,7 +6216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6178,7 +6228,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6190,7 +6240,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6206,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6219,7 +6269,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6234,7 +6284,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6244,7 +6294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6257,7 +6307,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6293,7 +6343,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6315,7 +6365,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6324,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends data about a required reboot that is scheduled with no user interaction, to help keep Windows up to date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6342,7 +6392,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.ToastDisplayedToScheduleReboot -This event is sent when a toast notification is shown to the user about scheduling a device restart. +This event is sent when a toast notification is shown to the user about scheduling a device restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6351,7 +6401,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6371,7 +6421,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6395,7 +6445,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS Updates. +This event sends data specific to the FixupEditionId mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. @@ -6403,25 +6453,25 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 6c91cf051e..ea0817c0af 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -Invalid Signature - This event is superseded by an event that contains additional fields. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -89,7 +90,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -107,7 +108,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -118,7 +119,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -145,7 +146,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -156,7 +157,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -178,7 +179,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -189,7 +190,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -211,7 +212,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -222,7 +223,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -244,7 +245,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -255,7 +256,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -277,7 +278,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -288,7 +289,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -310,7 +311,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -321,7 +322,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -361,7 +362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -372,7 +373,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -409,7 +410,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -420,7 +421,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -447,7 +448,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -458,7 +459,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -486,7 +487,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -497,7 +498,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -521,7 +522,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -532,7 +533,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -558,7 +559,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -569,7 +570,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -597,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -608,7 +609,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -633,7 +634,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -644,7 +645,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -669,7 +670,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -698,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -709,7 +710,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +734,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -744,7 +745,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -773,7 +774,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -784,7 +785,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -795,7 +796,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -810,7 +811,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +822,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -857,7 +858,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -868,7 +869,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -879,7 +880,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -912,7 +913,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -923,7 +924,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -947,7 +948,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -958,7 +959,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -982,7 +983,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -993,7 +994,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1018,7 +1019,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1029,7 +1030,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1053,7 +1054,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1064,7 +1065,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1088,7 +1089,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1099,7 +1100,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1123,7 +1124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1134,7 +1135,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1158,7 +1159,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1169,7 +1170,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1193,7 +1194,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1204,7 +1205,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1232,7 +1233,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1243,7 +1244,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1306,7 +1307,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1317,7 +1318,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1330,7 +1331,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1348,7 +1349,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1359,19 +1360,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1389,14 +1380,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1408,7 +1399,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1423,7 +1414,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1464,7 +1455,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1474,7 +1465,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1497,7 +1488,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1539,7 +1530,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1561,7 +1552,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1578,7 +1569,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1595,7 +1586,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1606,7 +1597,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1616,7 +1607,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1637,7 +1628,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1650,7 +1641,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1665,7 +1656,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1888,7 +1879,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -1958,19 +1949,19 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. @@ -2016,6 +2007,25 @@ This event is triggered when UTC determines it needs to send information about p ## DxgKernelTelemetry events +### DxgKrnlTelemetry.BddDiag + +This event records Microsoft basic display driver diagnostic information. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **BiosFlags** Bitwise flags that contain graphics related firmware information on the device such as the system was booted with display or not, system was using VBIOS or UEFI GOP, and VBIOS has a valid display mode list or not. +- **CurrentMode** Information about the current display mode such as the resolution, rotation, and scaling. +- **DefaultModeReason** Numeric value indicating the reason that the Microsoft Basic Display Driver is in use. +- **DefaultModeResolution** Default resolution that Microsoft Basic Display Driver detected. +- **DefaultResolutionProvider** Numeric value indicating the source of the default resolution. +- **Flags** Bitwise flags containing Microsoft Basic Display Driver related information such as if it is running because there is no graphics driver or user PnP stopped the graphics driver, it has valid EDID or not on the connected monitor and where the EDID was from, it is running at gray scale mode or not, it is running without display or not. +- **HeadlessReason** Numeric value indicating why there is no display. +- **LogAssertionCount** Number of assertions that were encountered before this event was recorded. +- **LogErrorCount** Number of errors that were encountered before this event was recorded. +- **MonitorPowerState** Current power state of the monitor. +- **Version** Version of the schema for this event. + + ### DxgKrnlTelemetry.GPUAdapterInventoryV2 This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date. @@ -2169,7 +2179,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2179,7 +2189,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -2223,7 +2233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2250,7 +2260,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2260,7 +2270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2289,7 +2299,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2301,7 +2311,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -This event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2312,7 +2322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2326,7 +2336,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2337,7 +2347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2348,7 +2358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2359,7 +2369,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2383,7 +2393,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2394,7 +2404,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2405,7 +2415,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2435,7 +2445,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2446,7 +2456,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2459,7 +2469,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2470,7 +2480,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2520,7 +2530,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2531,7 +2541,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2542,7 +2552,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2555,7 +2565,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2566,7 +2576,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2593,7 +2603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2604,7 +2614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2615,7 +2625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2635,7 +2645,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2646,7 +2656,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2655,9 +2665,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2684,7 +2702,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2696,7 +2714,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Invalid variant - Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2730,7 +2748,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2738,7 +2756,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2749,7 +2767,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -This event provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2767,7 +2785,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2778,7 +2796,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -This event includes the Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2804,7 +2822,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2815,7 +2833,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -Provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2830,7 +2848,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2838,7 +2856,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2849,7 +2867,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -This event list all installed Office products +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2864,7 +2882,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2875,7 +2893,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2889,7 +2907,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2900,7 +2918,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2931,7 +2949,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2939,7 +2957,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2950,7 +2968,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -This event indicates that the particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2958,7 +2976,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2969,7 +2987,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2980,7 +2998,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -2995,7 +3013,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3003,7 +3021,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3011,7 +3029,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3021,7 +3039,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3032,7 +3050,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3040,7 +3058,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3060,7 +3078,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3087,19 +3105,19 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -3107,7 +3125,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3120,7 +3138,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3132,7 +3150,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3148,7 +3166,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3161,7 +3179,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3171,7 +3189,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3181,7 +3199,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3192,7 +3210,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3201,7 +3219,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3212,7 +3230,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3229,7 +3247,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -3241,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3253,7 +3271,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3265,7 +3283,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3279,7 +3297,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -3326,7 +3344,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -3362,7 +3380,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -3499,7 +3517,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -3530,7 +3548,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3594,7 +3612,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3657,7 +3675,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3668,7 +3686,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3682,7 +3700,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.ServiceInstaller.ApplicabilityCheckFailed -This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. +This event returns data relating to the error state after one of the applicability checks for the installer component of the Operating System Remediation System Service (OSRSS) has failed. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3783,7 +3801,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3799,7 +3817,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3814,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Error -Error occurred during execution of the plugin. +This event indicates an error occurred during the execution of the plug-in. The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3825,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.FallbackError -This event indicates that an error occurred during execution of the plug-in fallback. +This event indicates that an error occurred during execution of the plug-in fallback. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3835,7 +3853,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3846,7 +3864,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3859,7 +3877,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3884,7 +3902,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3900,7 +3918,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3922,7 +3940,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Error -This event indicates whether an error condition occurred in the plug-in. +This event indicates whether an error condition occurred in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3933,7 +3951,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.FallbackError -This event indicates whether an error occurred for a fallback in the plug-in. +This event indicates whether an error occurred for a fallback in the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3943,7 +3961,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Information -This event provides general information returned from the plug-in. +This event provides general information returned from the plug-in. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3954,7 +3972,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -3967,7 +3985,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.wilResult -This event provides the result from the Windows internal library. +This event provides the result from the Windows internal library. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4056,7 +4074,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4081,7 +4099,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4108,7 +4126,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4126,7 +4144,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4142,7 +4160,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4157,7 +4175,7 @@ The following fields are available: ### SIHEngineTelemetry.ServiceStateChange -This event reports the status of attempts to stop or start a service as part of executing an action. +This event reports the status of attempts to stop or start a service as part of executing an action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4174,7 +4192,7 @@ The following fields are available: ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4191,7 +4209,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -4274,7 +4292,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -4305,7 +4323,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -4382,7 +4400,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4404,7 +4422,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4504,7 +4522,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4519,7 +4537,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4551,7 +4569,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4562,7 +4580,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -4575,7 +4593,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4587,7 +4605,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4598,7 +4616,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4608,7 +4626,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4622,7 +4640,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4636,7 +4654,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_DownloadRequest -This event sends data during the download request phase of updating Windows. +This event sends data during the download request phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4663,7 +4681,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_FellBackToCanonical -This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4679,7 +4697,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Initialize -This event sends data during the initialize phase of updating Windows. +This event sends data during the initialize phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4697,7 +4715,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Install -This event sends data during the install phase of updating Windows. +This event sends data during the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4713,7 +4731,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_Merge -This event sends data on the merge phase when updating Windows. +This event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4729,7 +4747,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_ModeStart -This event sends data for the start of each mode during the process of updating Windows. +This event sends data for the start of each mode during the process of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4744,7 +4762,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgent_SetupBoxLaunch -This event sends data during the launching of the setup box when updating Windows. +This event sends data during the launching of the setup box when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4761,7 +4779,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4777,7 +4795,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4809,7 +4827,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4829,7 +4847,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4845,7 +4863,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4863,7 +4881,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4879,7 +4897,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4895,7 +4913,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4921,7 +4939,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4941,7 +4959,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4957,7 +4975,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4975,7 +4993,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4992,7 +5010,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5015,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5062,7 +5080,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5078,7 +5096,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5094,7 +5112,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5111,7 +5129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5127,7 +5145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5152,13 +5170,13 @@ This event indicates whether devices received additional or critical supplementa ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. @@ -5206,7 +5224,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5354,19 +5372,19 @@ This event helps determine whether the device received supplemental content duri ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5406,16 +5424,25 @@ The following fields are available: ### Microsoft.Windows.WaaSAssessment.Error -This event returns the name of the missing setting needed to determine the Operating System build age. +This event returns the name of the missing setting needed to determine the Operating System build age. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: - **m** The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String. +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. + + ### Microsoft.Windows.WaaSMedic.RemediationFailed -This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5427,7 +5454,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.Summary -This event provides the results of the WaaSMedic diagnostic run +This event provides the results of the WaaSMedic diagnostic run. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5446,7 +5473,7 @@ The following fields are available: ### Microsoft.Windows.WaaSMedic.SummaryEvent -This event provides the results from the WaaSMedic engine +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5488,7 +5515,7 @@ The following fields are available: ### Microsoft.Windows.Store.Partner.ReportApplication -Report application event for Microsoft Store client. +This is report application event for Microsoft Store client. The data collected with this event is used to help keep Windows up to date and secure. @@ -5882,7 +5909,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5915,7 +5942,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5963,7 +5990,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5983,7 +6010,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6020,7 +6047,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6043,7 +6070,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6059,7 +6086,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6075,7 +6102,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6102,7 +6129,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6120,7 +6147,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6136,7 +6163,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario. The update scenario is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6151,49 +6178,49 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -6211,25 +6238,25 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot -This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6239,7 +6266,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6251,7 +6278,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -6270,7 +6297,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6286,7 +6313,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -6303,7 +6330,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6319,7 +6346,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6330,7 +6357,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -6347,7 +6374,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -6372,7 +6399,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6385,7 +6412,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -6397,7 +6424,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -6414,13 +6441,13 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6429,7 +6456,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -6448,7 +6475,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -6460,7 +6487,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -6470,7 +6497,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -6484,9 +6511,20 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event indicates the data sent when the device pauses an in-progress update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -6499,7 +6537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -6514,7 +6552,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6524,7 +6562,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -6566,7 +6604,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6580,9 +6618,21 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event indicates that USO determined UUP needs to fall back. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6604,7 +6654,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6613,7 +6663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6622,7 +6672,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -6641,13 +6691,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6657,7 +6707,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6678,7 +6728,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,25 +6754,25 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 38c6834c3d..d8b6f689ba 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,6 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -47,7 +48,7 @@ You can learn more about Windows functional and diagnostic data through these ar ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -123,7 +124,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -141,7 +142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -152,7 +153,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -179,7 +180,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -190,7 +191,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -212,7 +213,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -223,7 +224,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -245,7 +246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -256,7 +257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -278,7 +279,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -289,7 +290,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -311,7 +312,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -322,7 +323,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -344,7 +345,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -355,7 +356,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -396,7 +397,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -407,7 +408,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -445,7 +446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -456,7 +457,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -484,7 +485,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -495,7 +496,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -523,7 +524,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -534,7 +535,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -570,7 +571,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -596,7 +597,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -607,7 +608,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +636,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -646,7 +647,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -671,7 +672,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -682,7 +683,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -707,7 +708,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -736,7 +737,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -747,7 +748,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -771,7 +772,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -782,7 +783,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -811,7 +812,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -822,7 +823,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -833,7 +834,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -848,7 +849,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -859,7 +860,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -870,7 +871,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -895,7 +896,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -906,7 +907,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -917,7 +918,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -949,7 +950,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -960,7 +961,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -984,7 +985,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -995,7 +996,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1019,7 +1020,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1030,7 +1031,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1055,7 +1056,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1066,7 +1067,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1090,7 +1091,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1101,7 +1102,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1125,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1136,7 +1137,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1160,7 +1161,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1171,7 +1172,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1195,7 +1196,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1206,7 +1207,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1230,13 +1231,13 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusEndSync -This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. +This event indicates that a full set of SystemWindowsActivationStatusAdd events has succeeded in being sent. The data collected with this event is used to help keep Windows up to date. ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1247,7 +1248,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1275,7 +1276,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1286,7 +1287,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1351,7 +1352,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1362,7 +1363,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1375,7 +1376,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1393,7 +1394,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1405,7 +1406,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1416,19 +1417,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1447,14 +1438,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1466,7 +1457,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1481,7 +1472,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1522,7 +1513,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1532,7 +1523,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1555,7 +1546,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1597,7 +1588,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1641,7 +1632,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1664,7 +1655,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1682,7 +1673,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1699,7 +1690,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1710,7 +1701,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1711,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1741,7 +1732,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1754,7 +1745,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1798,7 +1789,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1813,7 +1804,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2030,7 +2021,7 @@ The following fields are available: ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2066,7 +2057,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2193,7 +2184,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2207,7 +2198,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Initialize -This event indicates that the Deployment 360 APIs have been initialized for use. +This event indicates that the Deployment 360 APIs have been initialized for use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2220,7 +2211,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2233,7 +2224,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2247,7 +2238,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2261,7 +2252,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2280,7 +2271,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2312,6 +2303,21 @@ The following fields are available: - **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. +### TelClientSynthetic.ConnectivityHeartBeat_0 + +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. + +The following fields are available: + +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. +- **LastFreeNetworkLossTime** The FILETIME at which the last free network loss occurred. +- **NetworkState** The network state of the device. +- **NoNetworkTimeSec** The total number of seconds without network during this heartbeat period. +- **RestrictedNetworkTimeSec** The total number of seconds with restricted network during this heartbeat period. + + ### TelClientSynthetic.HeartBeat_5 This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device. @@ -2402,7 +2408,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -This event indicates that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2415,7 +2421,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2428,7 +2434,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2441,7 +2447,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2453,7 +2459,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2466,7 +2472,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2478,7 +2484,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2491,7 +2497,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2504,7 +2510,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2516,7 +2522,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2529,7 +2535,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2541,7 +2547,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2554,7 +2560,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2566,7 +2572,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2579,7 +2585,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2592,7 +2598,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2604,7 +2610,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2630,7 +2636,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2655,7 +2661,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2668,7 +2674,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2681,7 +2687,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2693,7 +2699,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2707,7 +2713,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2720,7 +2726,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2733,7 +2739,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2747,7 +2753,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckIfCoordinatorMinApplicableVersion call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2760,7 +2766,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2773,7 +2779,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2787,7 +2793,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2800,7 +2806,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabAlreadyDownloaded -This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. +This event indicates that the Handler Download and Extract cab returned a value indicating that the cab has already been downloaded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2812,7 +2818,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2826,7 +2832,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2838,7 +2844,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2851,7 +2857,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2863,7 +2869,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2877,7 +2883,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2890,7 +2896,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2903,7 +2909,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2915,7 +2921,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadyGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler SetCommitReady call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2928,7 +2934,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2940,7 +2946,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2953,7 +2959,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3127,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3137,7 +3143,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3179,7 +3185,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3213,7 +3219,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3223,7 +3229,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3252,7 +3258,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3264,7 +3270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3275,7 +3281,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3288,7 +3294,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3299,7 +3305,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3310,7 +3316,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3321,7 +3327,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3345,7 +3351,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3356,7 +3362,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3367,7 +3373,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3397,7 +3403,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3408,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3421,7 +3427,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3432,7 +3438,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3482,7 +3488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3493,7 +3499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3504,7 +3510,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3517,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3528,7 +3534,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3555,7 +3561,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3566,7 +3572,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3577,7 +3583,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3597,7 +3603,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3608,7 +3614,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3617,9 +3623,17 @@ The following fields are available: - **InventoryVersion** The version of the inventory file generating the events. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3649,7 +3663,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,9 +3675,17 @@ The following fields are available: - **StartTime** UTC date and time at which this event was sent. +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3696,7 +3718,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3707,7 +3729,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3718,7 +3740,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3736,7 +3758,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3747,7 +3769,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Office-related Internet Explorer features +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3773,7 +3795,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3784,7 +3806,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3799,7 +3821,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3810,7 +3832,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3821,7 +3843,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3836,7 +3858,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3847,7 +3869,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3861,7 +3883,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3872,7 +3894,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3904,7 +3926,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3912,7 +3934,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3923,7 +3945,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3931,7 +3953,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3942,7 +3964,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3953,7 +3975,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3968,7 +3990,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3976,7 +3998,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3984,7 +4006,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3994,7 +4016,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4005,7 +4027,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4013,7 +4035,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4033,7 +4055,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4062,7 +4084,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.OSStateChange -This event indicates an OS state change. +This event indicates an OS state change. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4183,7 +4205,104 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. + +The following fields are available: + +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. +- **appIid** A GUID that identifies a particular installation flow. For example, each download of a product installer is tagged with a unique GUID. Attempts to install using that installer can then be grouped. A client SHOULD NOT persist the IID GUID after the installation flow of a product is complete. +- **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. +- **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. +- **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. +- **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. +- **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. +- **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. +- **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. +- **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. +- **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse41** '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSse42** '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'. +- **hwHasSsse3** '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'. +- **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. +- **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. +- **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. +- **osVersion** The primary version of the operating system. '' if unknown. Default: ''. +- **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. +- **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. +- **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. +- **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. +- **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. +- **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. +- **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **container_client_id** The client ID of the container, if in WDAG mode. This will be different from the UMA log client ID, which is the client ID of the host in WDAG mode. +- **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. + + +### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping + +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4203,6 +4322,8 @@ The following fields are available: - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. - **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. +- **appPingEventDownloadMetricsCdnCCC** ISO 2 character country code that matches to the country updated binaries are delivered from. E.g.: US. +- **appPingEventDownloadMetricsCdnCID** Numeric value used to internally track the origins of the updated binaries. For example, 2. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. - **appPingEventDownloadMetricsDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. @@ -4250,49 +4371,26 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. - - -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. @@ -4300,7 +4398,7 @@ This event returns data to track the count of the migration objects across vario ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4375,7 +4473,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4388,7 +4486,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4400,7 +4498,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4416,7 +4514,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4429,7 +4527,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4439,7 +4537,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4449,7 +4547,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4460,7 +4558,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4469,7 +4567,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4480,7 +4578,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4492,7 +4590,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentPrep -This event is used to determine whether the user needs to see the privacy consent experience or not. +This event is used to determine whether the user needs to see the privacy consent experience or not. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4502,7 +4600,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4515,7 +4613,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.wilActivity -This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. +This event returns information if an error is encountered while computing whether the user needs to complete privacy consents in certain upgrade scenarios. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4539,7 +4637,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4556,7 +4654,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -4568,7 +4666,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4580,7 +4678,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4592,7 +4690,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -4606,7 +4704,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.Applicable -deny +This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates. The following fields are available: @@ -4654,7 +4752,7 @@ The following fields are available: - **RemediationNoisyHammerUserLoggedInAdmin** TRUE if there is the user currently logged in is an Admin. - **RemediationShellDeviceManaged** TRUE if the device is WSUS managed or Windows Updated disabled. - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceZeroExhaust** TRUE if the device has opted out of Windows Updates completely. - **RemediationTargetMachine** Indicates whether the device is a target of the specified fix. - **RemediationTaskHealthAutochkProxy** True/False based on the health of the AutochkProxy task. @@ -4690,7 +4788,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.ChangePowerProfileDetection -Indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates. +This event indicates whether the remediation system can put in a request to defer a system-initiated sleep to enable installation of security or quality updates, to keep Windows secure and up to date. The following fields are available: @@ -4831,7 +4929,7 @@ The following fields are available: ### Microsoft.Windows.Remediation.RemediationShellMainExeEventId -Enables tracking of completion of process that remediates issues preventing security and quality updates. +This event enables tracking of completion of process that remediates issues preventing security and quality updates keep Windows up to date. The following fields are available: @@ -4863,7 +4961,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4932,7 +5030,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.Error -This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. +This event indicates an error occurred in the Operating System Remediation System Service (OSRSS). The information provided helps ensure future upgrade/update attempts are more successful. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4995,7 +5093,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.SelfUpdate -This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. +This event returns metadata after Operating System Remediation System Service (OSRSS) successfully replaces itself with a new version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5006,7 +5104,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.OSRSS.UrlState -This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. +This event indicates the state the Operating System Remediation System Service (OSRSS) is in while attempting a download from the URL. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5080,7 +5178,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5096,7 +5194,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5111,7 +5209,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5124,7 +5222,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5140,7 +5238,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5162,7 +5260,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5239,7 +5337,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5264,7 +5362,7 @@ The following fields are available: ### wilResult -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5289,15 +5387,45 @@ The following fields are available: ## SIH events +### SIHEngineTelemetry.EvalApplicability + +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ActionReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **AdditionalReasons** If an action has been assessed as inapplicable, the additional logic prevented it. +- **CachedEngineVersion** The engine DLL version that is being used. +- **EventInstanceID** A unique identifier for event instance. +- **EventScenario** Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed. +- **HandlerReasons** If an action has been assessed as inapplicable, the installer technology-specific logic prevented it. +- **IsExecutingAction** If the action is presently being executed. +- **ServiceGuid** A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.). +- **SihclientVersion** The client version that is being used. +- **StandardReasons** If an action has been assessed as inapplicable, the standard logic the prevented it. +- **StatusCode** Result code of the event (success, cancellation, failure code HResult). +- **UpdateID** A unique identifier for the action being acted upon. +- **WuapiVersion** The Windows Update API version that is currently installed. +- **WuaucltVersion** The Windows Update client version that is currently installed. +- **WuauengVersion** The Windows Update engine version that is currently installed. +- **WUDeviceID** The unique identifier controlled by the software distribution client. + + ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. + + + +### SIHEngineTelemetry.PostRebootReport + +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. ### SIHEngineTelemetry.SLSActionData -This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. +This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5318,7 +5446,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client (see eventscenario field for specifics, e.g.: started/failed/succeeded) +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5401,7 +5529,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5431,7 +5559,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5505,7 +5633,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5527,7 +5655,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5623,7 +5751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5638,7 +5766,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5671,7 +5799,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId -The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. +The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5682,7 +5810,7 @@ The following fields are available: - **DeviceIsMdmManaged** This device is MDM managed. - **IsNetworkAvailable** If the device network is not available. - **IsNetworkMetered** If network is metered. -- **IsSccmManaged** This device is managed by Configuration Manager. +- **IsSccmManaged** This device is SCCM managed. - **NewlyInstalledOs** OS is newly installed quiet period. - **PausedByPolicy** Updates are paused by policy. - **RecoveredFromRS3** Previously recovered from RS3. @@ -5695,7 +5823,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId -The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. +The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5706,7 +5834,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId -Event to mark that Update Assistant Orchestrator failed to launch Update Assistant. +This event indicates that Update Assistant Orchestrator failed to launch Update Assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5718,7 +5846,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId -Event indicating One Settings was not queried by update assistant. +This event indicates that One Settings was not queried by update assistant. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5728,7 +5856,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId -This event sends basic information on whether the device should be updated to the latest Windows 10 version. +This event sends basic information on whether the device should be updated to the latest Windows 10 version. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5741,7 +5869,7 @@ The following fields are available: ### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId -The event sends basic info on whether the Windows 10 update notification has previously launched. +The event sends basic info on whether the Windows 10 update notification has previously launched. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5754,7 +5882,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5771,7 +5899,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5787,7 +5915,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5819,7 +5947,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5839,7 +5967,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5855,7 +5983,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5873,7 +6001,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5891,7 +6019,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5907,7 +6035,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5933,7 +6061,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5953,7 +6081,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5969,7 +6097,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5987,7 +6115,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6003,13 +6131,13 @@ The following fields are available: ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6032,7 +6160,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.JavascriptJavascriptCriticalGenericMessage -This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. +This event indicates that Javascript is reporting a schema and a set of values for critical telemetry. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6079,7 +6207,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6095,7 +6223,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerCleaningCampaign -This event indicates that the Campaign Manager is cleaning up the campaign content. +This event indicates that the Campaign Manager is cleaning up the campaign content. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6111,7 +6239,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerGetIsCamppaignCompleteFailed -This event is sent when a campaign completion status query fails. +This event is sent when a campaign completion status query fails. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6128,7 +6256,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6144,7 +6272,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6177,7 +6305,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6187,7 +6315,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6245,7 +6373,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6409,7 +6537,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6434,7 +6562,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6453,7 +6581,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6492,9 +6620,45 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,7 +6711,7 @@ The following fields are available: ### Microsoft.Windows.WER.MTT.Value -This event is used for differential privacy. +This event is used for differential privacy to help keep Windows up to date. The following fields are available: @@ -6953,7 +7117,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6968,7 +7132,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6982,19 +7146,19 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureSucceeded -This event sends basic telemetry on the success of the rollback of feature updates. +This event sends basic telemetry on the success of the rollback of feature updates. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed -This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7009,7 +7173,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable -This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7023,13 +7187,13 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted -This event indicates that the Quality Rollback process has started. +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualitySucceeded -This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. +This event sends basic telemetry on the success of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. @@ -7037,7 +7201,7 @@ This event sends basic telemetry on the success of the rollback of the Quality/L ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7069,7 +7233,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7118,7 +7282,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7138,7 +7302,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7177,7 +7341,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7199,7 +7363,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7215,7 +7379,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7239,7 +7403,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7419,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7282,7 +7446,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7300,7 +7464,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7316,7 +7480,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7331,7 +7495,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7357,7 +7521,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7373,7 +7537,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7389,7 +7553,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedPrecursorDialog -This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "forced precursor" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7405,7 +7569,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootForcedWarningDialog -This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. +This event indicates that the Enhanced Engaged "forced warning" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7421,7 +7585,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7437,7 +7601,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7453,7 +7617,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7469,7 +7633,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootSecondReminderDialog -This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. +This event indicates that the second reminder dialog box was displayed for Enhanced Engaged restart. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7485,7 +7649,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootThirdReminderDialog -This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. +This event indicates that the third reminder dialog box for Enhanced Engaged restart was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7507,7 +7671,7 @@ This event is sent when a second reminder dialog is displayed during Enhanced En ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7526,7 +7690,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7537,7 +7701,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7550,7 +7714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7563,7 +7727,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7573,7 +7737,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7592,7 +7756,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -7614,7 +7778,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -7627,7 +7791,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7643,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -7660,7 +7824,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7669,7 +7833,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7678,7 +7842,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7689,7 +7853,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Escalation -This event is sent when USO takes an Escalation action on a device. +This event is sent when USO takes an Escalation action on a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7702,7 +7866,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7719,7 +7883,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationsRefreshFailed -USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. +USO has a set of escalation actions to prevent a device from becoming out-of-date, and the actions are triggered based on the Escalation configuration that USO obtains from OneSettings. This event is sent when USO fails to refresh the escalation configuration from OneSettings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7894,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7746,7 +7910,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.GameActive -This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. +This event indicates that an enabled GameMode process prevented the device from restarting to complete an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7921,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -7774,7 +7938,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -7799,7 +7963,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7812,7 +7976,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -7822,9 +7986,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data to device when Oobe Update download is in progress. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An update ID. +- **updateScenarioType** A type of update scenario. +- **wuDeviceid** A device ID associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -7841,7 +8018,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PowerMenuOptionsChanged -This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. +This event is sent when the options in power menu changed, usually due to an update pending reboot, or after a update is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7853,7 +8030,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7862,7 +8039,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Progress -This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. +This event is sent when the download of a update reaches a milestone change, such as a change in network cost policy, completion of an internal phase, or change in a transient state. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7880,7 +8057,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -7899,7 +8076,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -7911,7 +8088,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -7921,7 +8098,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7939,7 +8116,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -7952,7 +8129,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -7965,7 +8142,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -7981,7 +8158,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7993,7 +8170,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8003,9 +8180,20 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.UpdateInstallPause + +This event sends data when a device pauses an in-progress update, to help keep Windows secure and up to date. + +The following fields are available: + +- **updateClassificationGUID** The classification GUID for the update that was paused. +- **updateId** An update ID for the update that was paused. +- **wuDeviceid** A unique Device ID. + + ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8018,7 +8206,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8033,7 +8221,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8043,7 +8231,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.USODiagnostics -This event sends data on whether the state of the update attempt, to help keep Windows up to date. +This event sends data on whether the state of the update attempt, to help keep Windows secure and up to date. The following fields are available: @@ -8079,9 +8267,21 @@ The following fields are available: - **wuDeviceid** Unique ID for Device +### Microsoft.Windows.Update.Orchestrator.UUPFallBack + +This event sends data when UUP needs to fall back, to help keep Windows secure and up to date. + +The following fields are available: + +- **EventPublishedTime** The current event time. +- **UUPFallBackConfigured** The fall back error code. +- **UUPFallBackErrorReason** The reason for fall back error. +- **wuDeviceid** A Windows Update device ID. + + ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8103,7 +8303,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8112,7 +8312,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootRequestReasonsToIgnore -This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. +This event is sent when the reboot can be deferred based on some reasons, before reboot attempts. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8121,7 +8321,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8140,13 +8340,13 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerFirstReadyToReboot -This event is fired the first time when the reboot is required. +This event is fired the first time when the reboot is required. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8156,7 +8356,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8177,7 +8377,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8201,7 +8401,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8223,7 +8423,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8248,37 +8448,37 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index 8be2e02435..d15f59c958 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 ms.reviewer: --- @@ -33,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -303,7 +303,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -594,7 +594,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -612,7 +612,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -623,7 +623,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -655,7 +655,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -666,7 +666,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -688,7 +688,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -699,7 +699,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,7 +722,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove -This event indicates that the DataSourceMatchingInfoBlock object is no longer present. +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -733,7 +733,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -755,7 +755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove -This event indicates that the DataSourceMatchingInfoPassive object is no longer present. +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -766,7 +766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -788,7 +788,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove -This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -799,7 +799,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -821,7 +821,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove -This event indicates that the DatasourceSystemBios object is no longer present. +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -832,7 +832,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -873,7 +873,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -884,7 +884,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -922,7 +922,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -933,7 +933,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -962,7 +962,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -973,7 +973,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1003,7 +1003,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove -This event indicates that the DecisionMatchingInfoBlock object is no longer present. +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1014,7 +1014,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1039,7 +1039,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveRemove -This event Indicates that the DecisionMatchingInfoPassive object is no longer present. +This event Indicates that the DecisionMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1050,7 +1050,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1076,7 +1076,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove -This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1087,7 +1087,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1115,7 +1115,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove -This event indicates that the DecisionMediaCenter object is no longer present. +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1126,7 +1126,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1151,7 +1151,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that the DecisionSystemBios object is no longer present. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1162,7 +1162,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1187,7 +1187,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1216,7 +1216,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1227,7 +1227,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1251,7 +1251,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1262,7 +1262,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1291,7 +1291,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1302,7 +1302,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1313,7 +1313,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1332,7 +1332,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove -This event indicates that the InventorySystemBios object is no longer present. +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1343,7 +1343,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1354,7 +1354,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1379,7 +1379,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1390,7 +1390,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1401,7 +1401,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1435,7 +1435,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryRemove -This event that the SystemMemory object is no longer present. +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1446,7 +1446,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1470,7 +1470,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove -This event indicates that the SystemProcessorCompareExchange object is no longer present. +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1481,7 +1481,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1505,7 +1505,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove -This event indicates that the SystemProcessorLahfSahf object is no longer present. +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1516,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1541,7 +1541,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove -This event indicates that the SystemProcessorNx object is no longer present. +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1552,7 +1552,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,7 +1576,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove -This event indicates that the SystemProcessorPrefetchW object is no longer present. +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1587,7 +1587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1611,7 +1611,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove -This event indicates that the SystemProcessorSse2 object is no longer present. +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1622,7 +1622,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1646,7 +1646,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchRemove -This event indicates that the SystemTouch object is no longer present. +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1657,7 +1657,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1681,7 +1681,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimRemove -This event indicates that the SystemWim object is no longer present. +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1692,7 +1692,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1716,7 +1716,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1727,7 +1727,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1755,7 +1755,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanRemove -This event indicates that the SystemWlan object is no longer present. +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1766,7 +1766,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1833,7 +1833,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmRemove -This event indicates that the Wmdrm object is no longer present. +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1844,7 +1844,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1857,7 +1857,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1875,7 +1875,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1889,7 +1889,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1914,7 +1914,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1932,7 +1932,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1943,7 +1943,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1954,19 +1954,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1985,14 +1975,14 @@ The following fields are available: - **IsEDPEnabled** Represents if Enterprise data protected on the device. - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. - **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2004,7 +1994,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2019,7 +2009,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2062,7 +2052,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2072,7 +2062,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2095,7 +2085,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2137,7 +2127,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2183,7 +2173,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2206,7 +2196,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2224,7 +2214,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2243,7 +2233,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2255,7 +2245,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2268,7 +2258,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2289,7 +2279,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2302,7 +2292,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2348,7 +2338,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2364,7 +2354,7 @@ The following fields are available: ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2470,7 +2460,6 @@ The following fields are available: - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_cs** Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). - **ext_user** Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser). @@ -2483,14 +2472,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.os @@ -2570,8 +2551,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. - -## Common data fields +## Common Data Fields ### Ms.Device.DeviceInventoryChange @@ -2579,18 +2559,17 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. - +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. +- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. ## Compatibility events ### Microsoft.Windows.Compatibility.Apphelp.SdbFix -Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. +Product instrumentation for helping debug/troubleshoot issues with inbox compatibility components. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2626,7 +2605,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2763,7 +2742,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_End -This event indicates that a Deployment 360 API has completed. +This event indicates that a Deployment 360 API has completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2777,7 +2756,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxLaunch -This event indicates that the Deployment 360 APIs have launched Setup Box. +This event indicates that the Deployment 360 APIs have launched Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2790,7 +2769,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_SetupBoxResult -This event indicates that the Deployment 360 APIs have received a return from Setup Box. +This event indicates that the Deployment 360 APIs have received a return from Setup Box. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2804,7 +2783,7 @@ The following fields are available: ### DeploymentTelemetry.Deployment_Start -This event indicates that a Deployment 360 API has been called. +This event indicates that a Deployment 360 API has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2818,7 +2797,7 @@ The following fields are available: ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2887,7 +2866,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2906,7 +2885,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2925,15 +2904,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -3089,7 +3068,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability -Event to indicate that the Coordinator CheckApplicability call succeeded. +This event indicates that the Coordinator CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3105,7 +3084,7 @@ The following fields are available: - **IsDeviceNetworkMetered** Indicates whether the device is connected to a metered network. - **IsDeviceOobeBlocked** Indicates whether user approval is required to install updates on the device. - **IsDeviceRequireUpdateApproval** Indicates whether user approval is required to install updates on the device. -- **IsDeviceSccmManaged** Indicates whether the device is running the Configuration Manager client to keep the operating system and applications up to date. +- **IsDeviceSccmManaged** Indicates whether the device is running the Microsoft SCCM (System Center Configuration Manager) to keep the operating system and applications up to date. - **IsDeviceUninstallActive** Indicates whether the OS (operating system) on the device was recently updated. - **IsDeviceUpdateNotificationLevel** Indicates whether the device has a set policy to control update notifications. - **IsDeviceUpdateServiceManaged** Indicates whether the device uses WSUS (Windows Server Update Services). @@ -3116,7 +3095,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure -This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. +This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3129,7 +3108,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Cleanup call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3142,7 +3121,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCleanupSuccess -This event indicates that the Coordinator Cleanup call succeeded. +This event indicates that the Coordinator Cleanup call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3154,7 +3133,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3167,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCommitSuccess -This event indicates that the Coordinator Commit call succeeded. +This event indicates that the Coordinator Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3179,7 +3158,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3192,7 +3171,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Download call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3205,7 +3184,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorDownloadSuccess -This event indicates that the Coordinator Download call succeeded. +This event indicates that the Coordinator Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3217,7 +3196,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator HandleShutdown call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3230,7 +3209,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorHandleShutdownSuccess -This event indicates that the Coordinator HandleShutdown call succeeded. +This event indicates that the Coordinator HandleShutdown call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3242,7 +3221,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3255,7 +3234,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInitializeSuccess -This event indicates that the Coordinator Initialize call succeeded. +This event indicates that the Coordinator Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3267,7 +3246,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Coordinator Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3280,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallIgnoredFailure -This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. +This event indicates that we have received an error in the Direct to Update (DTU) Coordinator Install call that will be ignored. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3293,7 +3272,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3305,7 +3284,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorProgressCallBack -This event indicates that the Coordinator's progress callback has been called. +This event indicates that the Coordinator's progress callback has been called. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3318,7 +3297,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorSetCommitReadySuccess -This event indicates that the Coordinator SetCommitReady call succeeded. +This event indicates that the Coordinator SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3330,7 +3309,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiNotShown -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3343,7 +3322,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSelection -This event indicates that the user selected an option on the Reboot UI. +This event indicates that the user selected an option on the Reboot UI. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3356,7 +3335,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorWaitForRebootUiSuccess -This event indicates that the Coordinator WaitForRebootUi call succeeded. +This event indicates that the Coordinator WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3368,7 +3347,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3382,7 +3361,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3395,7 +3374,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalSuccess -This event indicates that the Handler CheckApplicabilityInternal call succeeded. +This event indicates that the Handler CheckApplicabilityInternal call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3408,7 +3387,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilitySuccess -This event indicates that the Handler CheckApplicability call succeeded. +This event indicates that the Handler CheckApplicability call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3422,7 +3401,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckIfCoordinatorMinApplicableVersionSuccess -This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. +This event indicates that the Handler CheckIfCoordinatorMinApplicableVersion call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3435,7 +3414,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Commit call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3449,7 +3428,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerCommitSuccess -This event indicates that the Handler Commit call succeeded. +This event indicates that the Handler Commit call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3462,7 +3441,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabFailure -This event indicates that the Handler Download and Extract cab call failed. +This event indicates that the Handler Download and Extract cab call failed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3476,7 +3455,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadAndExtractCabSuccess -This event indicates that the Handler Download and Extract cab call succeeded. +This event indicates that the Handler Download and Extract cab call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3488,7 +3467,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Download call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3501,7 +3480,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerDownloadSuccess -This event indicates that the Handler Download call succeeded. +This event indicates that the Handler Download call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3513,7 +3492,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Initialize call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3527,7 +3506,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInitializeSuccess -This event indicates that the Handler Initialize call succeeded. +This event indicates that the Handler Initialize call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3540,7 +3519,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler Install call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3553,7 +3532,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerInstallSuccess -This event indicates that the Coordinator Install call succeeded. +This event indicates that the Coordinator Install call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3565,7 +3544,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerSetCommitReadySuccess -This event indicates that the Handler SetCommitReady call succeeded. +This event indicates that the Handler SetCommitReady call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3577,7 +3556,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler WaitForRebootUi call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3590,7 +3569,7 @@ The following fields are available: ### Microsoft.Windows.DirectToUpdate.DTUHandlerWaitForRebootUiSuccess -This event indicates that the Handler WaitForRebootUi call succeeded. +This event indicates that the Handler WaitForRebootUi call succeeded. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -3602,9 +3581,83 @@ The following fields are available: ## DISM events +### Microsoft.Windows.StartRep.DISMLatesInstalledLCU + +This event indicates that LCU is being uninstalled by DISM. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMInstalledLCUPackageName** Package name of LCU that's uninstalled by using DISM + + +### Microsoft.Windows.StartRep.DISMPendingInstall + +This event indicates that installation for the package is pending during recovery session. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **DISMPendingInstallPackageName** The name of the pending package. + + +### Microsoft.Windows.StartRep.DISMRevertPendingActions + +This event indicates that the revert pending packages operation has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The result from the operation to revert pending packages. + + +### Microsoft.Windows.StartRep.DISMUninstallLCU + +This event indicates the uninstall operation. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is being reported by DISM. + + +### Microsoft.Windows.StartRep.SRTRepairActionEnd + +This event indicates that the SRT Repair has been completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The error code that is reported. +- **SRTRepairAction** The action that was taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRepairActionStart + +This event sends data when SRT repair has started. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRepairAction** The action that is being taken by SRT. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagEnd + +This event sends data when the root cause operation has completed. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ErrorCode** The final result code for the root cause operation. +- **SRTRootCauseDiag** The name of the root cause operation that ran. + + +### Microsoft.Windows.StartRep.SRTRootCauseDiagStart + +This event indicates that a diagnostic in the recovery environment has been initiated. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **SRTRootCauseDiag** The name of a specific diagnostic. + + ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3613,16 +3666,49 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: - **dismPendingInstallPackageName** The name of the pending package. +### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions + +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd + +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **errorCode** The result code returned by the event. +- **failedUninstallCount** The number of driver updates that failed to uninstall. +- **failedUninstallFlightIds** The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall. +- **foundDriverUpdateCount** The number of found driver updates. +- **srtRepairAction** The scenario name for a repair. +- **successfulUninstallCount** The number of successfully uninstalled driver updates. +- **successfulUninstallFlightIds** The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates. + + +### Microsoft.Windows.StartRepairCore.SRTRepairActionStart + +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. + +The following fields are available: + +- **srtRepairAction** The scenario name for a repair. + + ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3634,7 +3720,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -3645,7 +3731,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3699,7 +3785,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3718,7 +3804,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3910,7 +3996,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3952,7 +4038,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4005,7 +4091,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4013,9 +4099,27 @@ The following fields are available: - **devinv** The file version of the Device inventory component. +### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd + +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **CatalogSigners** Signers from catalog. Each signer starts with Chain. +- **DigestAlgorithm** The pseudonymizing (hashing) algorithm used when the file or package was signed. +- **DriverPackageStrongName** Optional. Available only if FileSigningInfo is collected on a driver package. +- **EmbeddedSigners** Embedded signers. Each signer starts with Chain. +- **FileName** The file name of the file whose signatures are listed. +- **FileType** Either exe or sys, depending on if a driver package or application executable. +- **InventoryVersion** The version of the inventory file generating the events. +- **Thumbprint** Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma. + + ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4044,7 +4148,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4056,7 +4160,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4067,7 +4171,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4080,7 +4184,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4091,7 +4195,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4102,7 +4206,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4113,7 +4217,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4241,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4148,7 +4252,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4159,7 +4263,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4189,7 +4293,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4200,7 +4304,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4215,7 +4319,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4226,7 +4330,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4282,7 +4386,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4293,7 +4397,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4304,7 +4408,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4317,7 +4421,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4328,7 +4432,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4355,7 +4459,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4366,7 +4470,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4377,7 +4481,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4399,7 +4503,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4410,7 +4514,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4437,21 +4541,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General. InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the ObjectInstanceId is no longer present, to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd -This event sends details collected for a specific application on the source device. +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync -This event indicates the beginning of a series of AppHealthStaticAdd events. +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration per DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4484,7 +4621,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4495,7 +4632,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4506,7 +4643,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4524,7 +4661,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4535,7 +4672,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4561,7 +4698,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4572,7 +4709,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4587,7 +4724,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4598,7 +4735,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4609,7 +4746,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4624,7 +4761,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4635,7 +4772,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4649,7 +4786,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4660,7 +4797,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4692,7 +4829,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4703,7 +4840,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4715,7 +4852,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4726,7 +4863,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4737,7 +4874,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4748,7 +4885,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4763,7 +4900,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4771,7 +4908,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4779,7 +4916,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4790,7 +4927,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4802,7 +4939,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4810,7 +4947,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4827,10 +4964,9 @@ The following fields are available: - **BytesRead** The total number of bytes read from or read by the OS upon system startup. - **BytesWritten** The total number of bytes written to or written by the OS upon system startup. - ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4861,7 +4997,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4886,7 +5022,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4901,7 +5037,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4949,6 +5085,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -4974,6 +5111,7 @@ This config event sends basic device connectivity and configuration information The following fields are available: +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. - **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. - **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). - **Channel** An integer indicating the channel of the installation (Canary or Dev). @@ -5021,24 +5159,24 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: -- **appAp** Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''. -- **appAppId** The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update. -- **appBrandCode** The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown). -- **appChannel** An integer indicating the channel of the installation (e.g. Canary or Dev). -- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. -- **appCohort** A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. -- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appAp** Any additional parameters for the specified application. Default: ''. +- **appAppId** The GUID that identifies the product. Compatible clients must transmit this attribute. Please see the wiki for additional information. Default: undefined. +- **appBrandCode** The brand code under which the product was installed, if any. A brand code is a short (4-character) string used to identify installations that took place as a result of partner deals or website promotions. Default: ''. +- **appChannel** An integer indicating the channel of the installation (i.e. Canary or Dev). +- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''. +- **appCohort** A machine-readable string identifying the release cohort (channel) that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortHint** A machine-readable enum indicating that the client has a desire to switch to a different release cohort. The exact legal values are app-specific and should be shared between the server and app implementations. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. +- **appCohortName** A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort Name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''. - **appConsentState** Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited. -- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown). -- **appExperiments** A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''. +- **appDayOfInstall** The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. The client MAY fuzz this value to the week granularity (e.g. send '0' for 0 through 6, '7' for 7 through 13, etc.). The first communication to the server should use a special value of '-1'. A value of '-2' indicates that this value is not known. Please see the wiki for additional information. Default: '-2'. +- **appExperiments** A key/value list of experiment identifiers. Experiment labels are used to track membership in different experimental groups, and may be set at install or update time. The experiments string is formatted as a semicolon-delimited concatenation of experiment label strings. An experiment label string is an experiment Name, followed by the '=' character, followed by an experimental label value. For example: 'crdiff=got_bsdiff;optimized=O3'. The client should not transmit the expiration date of any experiments it has, even if the server previously specified a specific expiration date. Default: ''. - **appInstallTimeDiffSec** The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'. - **appLang** The language of the product install, in IETF BCP 47 representation. Default: ''. -- **appNextVersion** The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'. +- **appNextVersion** The version of the app that the update flow to which this event belongs attempted to reach, regardless of the success or failure of the update operation. Please see the wiki for additional information. Default: '0.0.0.0'. - **appPingEventAppSize** The total number of bytes of all downloaded packages. Default: '0'. - **appPingEventDownloadMetricsDownloadedBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. - **appPingEventDownloadMetricsDownloader** A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''. @@ -5046,24 +5184,24 @@ The following fields are available: - **appPingEventDownloadMetricsError** The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'. - **appPingEventDownloadMetricsServerIpHint** For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadMetricsTotalBytes** For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'. -- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. +- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''. - **appPingEventDownloadTimeMs** For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'. - **appPingEventErrorCode** The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'. -- **appPingEventEventResult** An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error). -- **appPingEventEventType** An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown). +- **appPingEventEventResult** An enum indicating the result of the event. Please see the wiki for additional information. Default: '0'. +- **appPingEventEventType** An enum indicating the type of the event. Compatible clients MUST transmit this attribute. Please see the wiki for additional information. - **appPingEventExtraCode1** Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'. - **appPingEventInstallTimeMs** For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appPingEventNumBytesDownloaded** The number of bytes downloaded for the specified application. Default: '0'. -- **appPingEventSequenceId** An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. -- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a tag. -- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. +- **appPingEventSequenceId** An id that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event. +- **appPingEventSourceUrlIndex** For events representing a download, the position of the download URL in the list of URLs supplied by the server in a "urls" tag. +- **appPingEventUpdateCheckTimeMs** For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'. - **appUpdateCheckIsUpdateDisabled** The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not. -- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''. -- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''. -- **appVersion** The version of the product install. Default: '0.0.0.0'. +- **appUpdateCheckTargetVersionPrefix** A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The server should not return an update instruction to a version number that does not match the prefix or complete version number. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' must match '1.2.3.4' but must not match '1.2.34'). Default: ''. +- **appUpdateCheckTtToken** An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request should be sent over SSL or another secure protocol. Default: ''. +- **appVersion** The version of the product install. Please see the wiki for additional information. Default: '0.0.0.0'. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **eventType** A string representation of appPingEventEventType indicating the type of the event. -- **hwHasAvx** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. +- **eventType** A string indicating the type of the event. Please see the wiki for additional information. +- **hwHasAvx** '1' if the client's hardware supports the AVX instruction set. '0' if the client's hardware does not support the AVX instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse** '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse2** '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'. - **hwHasSse3** '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'. @@ -5073,26 +5211,52 @@ The following fields are available: - **hwPhysmemory** The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'. - **isMsftDomainJoined** '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'. - **osArch** The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''. -- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''. +- **osPlatform** The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system Name should be transmitted in lowercase with minimal formatting. Default: ''. - **osServicePack** The secondary version of the operating system. '' if unknown. Default: ''. - **osVersion** The primary version of the operating system. '' if unknown. Default: ''. - **requestCheckPeriodSec** The update interval in seconds. The value is read from the registry. Default: '-1'. - **requestDlpref** A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''. -- **requestDomainJoined** '1' if the device is part of a managed enterprise domain. Otherwise '0'. +- **requestDomainJoined** '1' if the machine is part of a managed enterprise domain. Otherwise '0'. - **requestInstallSource** A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''. - **requestIsMachine** '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'. - **requestOmahaShellVersion** The version of the Omaha installation folder. Default: ''. - **requestOmahaVersion** The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'. -- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined. -- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''. +- **requestProtocolVersion** The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients must always transmit this attribute. Default: undefined. +- **requestRequestId** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Each request attempt should have (with high probability) a unique request id. Default: ''. - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. -- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''. +- **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. + + +### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config + +This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. + +The following fields are available: + +- **app_sample_rate** A number representing how often the client sends telemetry, expressed as a percentage. Low values indicate that said client sends more events and high values indicate that said client sends fewer events. +- **app_version** The internal Edge build version string, taken from the UMA metrics field system_profile.app_version. +- **appConsentState** Bit flags describing consent for data collection on the machine or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). +- **Channel** An integer indicating the channel of the installation (Canary or Dev). +- **client_id** A unique identifier with which all other diagnostic client data is associated, taken from the UMA metrics provider. This ID is effectively unique per device, per OS user profile, per release channel (e.g. Canary/Dev/Beta/Stable). client_id is not durable, based on user preferences. client_id is initialized on the first application launch under each OS user profile. client_id is linkable, but not unique across devices or OS user profiles. client_id is reset whenever UMA data collection is disabled, or when the application is uninstalled. +- **ConnectionType** The first reported type of network connection currently connected. This can be one of Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth. +- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. +- **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. +- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. +- **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). +- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. +- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. +- **PayloadLogType** The log type for the event correlating with 0 for unknown, 1 for stability, 2 for on-going, 3 for independent, 4 for UKM, or 5 for instance level. +- **pop_sample** A value indicating how the device's data is being sampled. +- **reconsentConfigs** A comma separated list of all reconsent configurations the current installation has received. Each configuration follows a well-defined format: 2DigitMonth-2DigitYear-3LetterKeyword. +- **session_id** An identifier that is incremented each time the user launches the application, irrespective of any client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. +- **utc_flags** Event Tracing for Windows (ETW) flags required for the event as part of the data collection process. + ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -5166,7 +5330,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5178,7 +5342,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5189,7 +5353,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -5203,7 +5367,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -5277,7 +5441,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.APIOperation -This event includes basic data about install and uninstall OneDrive API operations. +This event includes basic data about install and uninstall OneDrive API operations. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5290,7 +5454,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.EndExperience -This event includes a success or failure summary of the installation. +This event includes a success or failure summary of the installation. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5302,7 +5466,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5318,7 +5482,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.RegisterStandaloneUpdaterAPIOperation -This event is related to registering or unregistering the OneDrive update task. +This event is related to registering or unregistering the OneDrive update task. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5331,7 +5495,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.ComponentInstallState -This event includes basic data about the installation state of dependent OneDrive components. +This event includes basic data about the installation state of dependent OneDrive components. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5341,7 +5505,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.OverlayIconStatus -This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken +This event indicates if the OneDrive overlay icon is working correctly. 0 = healthy; 1 = can be fixed; 2 = broken. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5351,7 +5515,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateOverallResult -This event sends information describing the result of the update. +This event sends information describing the result of the update. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5362,7 +5526,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.UpdateXmlDownloadHResult -This event determines the status when downloading the OneDrive update configuration file. +This event determines the status when downloading the OneDrive update configuration file. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5371,7 +5535,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Updater.WebConnectionStatus -This event determines the error code that was returned when verifying Internet connectivity. +This event determines the error code that was returned when verifying Internet connectivity. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5379,11 +5543,38 @@ The following fields are available: - **winInetError** The HResult of the operation. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5395,7 +5586,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5409,26 +5600,11 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. - **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. - **threadId** The ID of the thread on which the activity is executing. @@ -5436,7 +5612,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted -This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. +This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5453,7 +5629,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5470,7 +5646,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5487,7 +5663,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5507,7 +5683,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5662,7 +5838,7 @@ The following fields are available: - **RemediationShellDeviceNewOS** TRUE if the device has a recently installed OS. - **RemediationShellDeviceProSku** Indicates whether a Windows 10 Professional edition is detected. - **RemediationShellDeviceQualityUpdatesPaused** Indicates whether Quality Updates are paused on the device. -- **RemediationShellDeviceSccm** TRUE if the device is managed by Configuration Manager. +- **RemediationShellDeviceSccm** TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager). - **RemediationShellDeviceSedimentMutexInUse** Indicates whether the Sediment Pack mutual exclusion object (mutex) is in use. - **RemediationShellDeviceSetupMutexInUse** Indicates whether device setup is in progress. - **RemediationShellDeviceWuRegistryBlocked** Indicates whether the Windows Update is blocked on the device via the registry. @@ -5874,7 +6050,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5912,7 +6088,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Applicable -This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5930,7 +6106,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Completed -This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5945,7 +6121,7 @@ The following fields are available: ### Microsoft.Windows.SedimentLauncher.Started -This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5958,7 +6134,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Applicable -This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5976,7 +6152,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Completed -This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6000,7 +6176,7 @@ The following fields are available: ### Microsoft.Windows.SedimentService.Started -This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. +This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates. A sediment device is one that has been on a previous OS version for an extended period. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6021,6 +6197,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -6054,7 +6231,7 @@ The following fields are available: ### SIHEngineTelemetry.EvalApplicability -This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. +This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6078,7 +6255,7 @@ The following fields are available: ### SIHEngineTelemetry.ExecuteAction -This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. +This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6098,7 +6275,7 @@ The following fields are available: ### SIHEngineTelemetry.PostRebootReport -This event reports the status of an action following a reboot, should one have been required. +This event reports the status of an action following a reboot, should one have been required. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -6119,7 +6296,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -6204,7 +6381,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -6235,7 +6412,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -6326,7 +6503,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6348,7 +6525,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6423,6 +6600,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether the update succeeded and then failed after a restart. - **IsWUfBDualScanEnabled** Indicates whether Windows Update for Business dual scan is enabled on the device. - **IsWUfBEnabled** Indicates whether Windows Update for Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether the OS update and a BSP update merged for installation. - **MsiAction** The stage of MSI installation where it failed. - **MsiProductCode** The unique identifier of the MSI installer. @@ -6452,7 +6630,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6479,6 +6657,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6497,7 +6676,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6513,7 +6692,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6557,7 +6736,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6572,7 +6751,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6633,7 +6812,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6651,7 +6830,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6667,7 +6846,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6704,7 +6883,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6724,7 +6903,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentFellBackToCanonical -This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6740,7 +6919,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6758,7 +6937,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6776,7 +6955,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6793,7 +6972,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6819,7 +6998,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6839,7 +7018,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6855,7 +7034,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6873,7 +7052,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6882,14 +7061,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6908,7 +7089,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6932,7 +7113,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat -This event is sent at the start of each campaign, to be used as a heartbeat. +This event is sent at the start of each campaign, to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6948,7 +7129,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6964,7 +7145,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed -This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. +This event is sent when the Campaign Manager encounters an unexpected error while running the campaign. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6998,7 +7179,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7008,7 +7189,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7066,7 +7247,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7230,7 +7411,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7255,7 +7436,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7274,7 +7455,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7313,9 +7494,65 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.DetectionsOnlyFailed + +Failed to apply the named diagnostic. + +The following fields are available: + +- **hResult** The error code from attempting the diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.EngineFailed + +This event indicates failure during medic engine execution. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **hResult** Error code from the execution. +- **versionString** Version of Medic engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + +### Microsoft.Windows.WaaSMedic.RemediationsOnlyFailed + +This event indicates that some plugins failed to complete remediation. This data collected with this event is used to help keep Windows secure. + +The following fields are available: + +- **hResult** A resulting error code. +- **versionString** The string for which plugins failed. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7776,7 +8013,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. +This event sends data when the Windows System Kit is used to create new OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate “image” creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7791,7 +8028,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskImageCustomization -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. +This event sends data when the Windows System Kit is used to create/modify configuration files allowing the customization of a new OS image with Apps or Drivers. The data includes the version of the Windows System Kit, the state of the event, the customization type (drivers or apps) and the mode (new or updating) and is used to help investigate configuration file creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7807,7 +8044,7 @@ The following fields are available: ### Microsoft.Windows.Kits.WSK.WskWorkspaceCreate -This event sends simple Product and Service usage data when a user is using the Windows System Kit to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. +This event sends data when the Windows System Kit is used to create new workspace for generating OS “images”. The data includes the version of the Windows System Kit and the state of the event and is used to help investigate workspace creation failures. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7825,15 +8062,29 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **wUfBConnected** Result of WUfB connection check. + + ## Windows Update Delivery Optimization events ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7867,7 +8118,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7922,7 +8173,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7942,7 +8193,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7978,7 +8229,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8000,7 +8251,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8016,7 +8267,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8040,7 +8291,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8056,7 +8307,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8083,7 +8334,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8101,7 +8352,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8117,7 +8368,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8132,7 +8383,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8158,7 +8409,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8174,7 +8425,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootFirstReminderDialog -This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed.. +This event indicates that the Enhanced Engaged restart "first reminder" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8441,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8206,7 +8457,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8222,7 +8473,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8238,7 +8489,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderToast -This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. +This event indicates that the Enhanced Engaged restart reminder pop-up banner was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8254,7 +8505,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -8272,9 +8523,18 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8283,9 +8543,19 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.AttemptImmediateReboot + +This event sends data when the Windows Update Orchestrator is set to reboot immediately after installing the update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **isOnAC** The power source for AC or battery power. +- **scanTriggerSource** The source of a triggered scan. + + ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8297,7 +8567,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8309,7 +8579,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.CommitFailed -This event indicates that a device was unable to restart after an update. +This event indicates that a device was unable to restart after an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8319,7 +8589,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8338,7 +8608,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8380,7 +8650,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DetectionResult -This event runs when an update is detected. This helps ensure Windows is kept up to date. +This event runs when an update is detected. This helps ensure Windows is secure and kept up to date. The following fields are available: @@ -8393,7 +8663,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8409,7 +8679,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8426,7 +8696,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUCompletedWhenWuFlightPendingCommit -This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. +This event indicates that DTU completed installation of the electronic software delivery (ESD), when Windows Update was already in Pending Commit phase of the feature update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8435,7 +8705,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUEnabled -This event indicates that Inbox DTU functionality was enabled. +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8444,7 +8714,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DTUInitiated -This event indicates that Inbox DTU functionality was intiated. +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8455,7 +8725,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8472,7 +8742,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8482,7 +8752,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8499,7 +8769,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8516,7 +8786,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8542,7 +8812,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8556,7 +8826,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8566,9 +8836,22 @@ The following fields are available: - **wuDeviceid** The Windows Update Device GUID (Globally-Unique ID). +### Microsoft.Windows.Update.Orchestrator.OobeUpdate + +This event sends data when Oobe Update download is in progress, to help keep Windows secure and up to date. + +The following fields are available: + +- **flightID** A flight ID. +- **revisionNumber** A revision number. +- **updateId** An ID associated with an update. +- **updateScenarioType** A type of USO session. +- **wuDeviceid** A device Id associated with Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.PostInstall -This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows up to date. +This event sends data about lite stack devices (mobile, IOT, anything non-PC) immediately before data migration is launched to help keep Windows secure and up to date. The following fields are available: @@ -8585,7 +8868,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8594,7 +8877,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8613,7 +8896,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8625,7 +8908,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8637,7 +8920,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8656,7 +8939,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8669,7 +8952,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8682,7 +8965,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8692,7 +8975,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8708,7 +8991,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8720,7 +9003,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel -This event is sent when update activity was stopped due to a low battery level. +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8732,7 +9015,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8742,7 +9025,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8755,7 +9038,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8770,7 +9053,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8780,7 +9063,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8796,7 +9079,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8818,7 +9101,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8827,7 +9110,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8847,7 +9130,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.UxBrokerScheduledTask -This event is sent when MUSE broker schedules a task. +This event is sent when MUSE broker schedules a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8857,7 +9140,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up to date. +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8875,9 +9158,192 @@ The following fields are available: - **wuDeviceid** The Windows Update device GUID. +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that updates have been blocked requiring intervention. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the required UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the device has completed the reboot after installing expected update. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus -This event is received when there is status on a push notification. +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8891,11 +9357,33 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Windows Update mitigation events ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8919,7 +9407,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8941,7 +9429,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8962,11 +9450,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8976,7 +9485,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8989,7 +9498,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9004,7 +9513,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -9014,13 +9523,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index adb454d3a2..629309f9a2 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 03/27/2020 +ms.date: 09/30/2020 --- @@ -38,7 +38,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - +- [Windows 10, version 2004 and Windows 10, version 2010 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) @@ -266,7 +266,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount -This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. +This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -486,6 +486,7 @@ The following fields are available: - **DecisionSystemBios_TH1** The count of the number of this particular object type present on this device. - **DecisionSystemBios_TH2** The count of the number of this particular object type present on this device. - **DecisionSystemProcessor_RS2** The count of the number of this particular object type present on this device. +- **DecisionTest_20H1** The count of the number of this particular object type present on this device. - **DecisionTest_20H1Setup** The count of the number of this particular object type present on this device. - **DecisionTest_21H1** The count of the number of this particular object type present on this device. - **DecisionTest_21H1Setup** The count of the number of this particular object type present on this device. @@ -530,7 +531,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd -Represents the basic metadata about specific application files installed on the system. +This event represents the basic metadata about specific application files installed on the system. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -548,7 +549,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove -This event indicates that the DatasourceApplicationFile object is no longer present. +This event indicates that the DatasourceApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -559,7 +560,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync -This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. +This event indicates that a new set of DatasourceApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -578,12 +579,7 @@ The following fields are available: - **ActiveNetworkConnection** Indicates whether the device is an active network device. - **AppraiserVersion** The version of the appraiser file generating the events. -- **CosDeviceRating** An enumeration that indicates if there is a driver on the target operating system. -- **CosDeviceSolution** An enumeration that indicates how a driver on the target operating system is available. -- **CosDeviceSolutionUrl** Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string -- **CosPopulatedFromId** The expected uplevel driver matching ID based on driver coverage data. - **IsBootCritical** Indicates whether the device boot is critical. -- **UplevelInboxDriver** Indicates whether there is a driver uplevel for this device. - **WuDriverCoverage** Indicates whether there is a driver uplevel for this device, according to Windows Update. - **WuDriverUpdateId** The Windows Update ID of the applicable uplevel driver. - **WuPopulatedFromId** The expected uplevel driver matching ID based on driver coverage from Windows Update. @@ -591,7 +587,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove -This event indicates that the DatasourceDevicePnp object is no longer present. +This event indicates that the DatasourceDevicePnp object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -602,7 +598,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync -This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. +This event indicates that a new set of DatasourceDevicePnpAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -624,7 +620,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove -This event indicates that the DatasourceDriverPackage object is no longer present. +This event indicates that the DatasourceDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -635,7 +631,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync -This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. +This event indicates that a new set of DatasourceDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -656,9 +652,20 @@ The following fields are available: - **ResolveAttempted** This will always be an empty string when sending diagnostic data. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove + +This event indicates that the DataSourceMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync -This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent. +This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events has completed being sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -678,9 +685,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveRemove + +This event indicates that the DataSourceMatchingInfoPassive object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync -This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent. This event is used to make compatibility decisions about files to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -700,9 +718,20 @@ The following fields are available: - **AppraiserVersion** The version of the appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeRemove + +This event indicates that the DataSourceMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -722,9 +751,20 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file generating the events. +### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosRemove + +This event indicates that the DatasourceSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync -This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. +This event indicates that a new set of DatasourceSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -765,7 +805,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove -This event indicates that the DecisionApplicationFile object is no longer present. +This event indicates that the DecisionApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -776,7 +816,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync -This event indicates that a new set of DecisionApplicationFileAdd events will be sent. +This event indicates that a new set of DecisionApplicationFileAdd events will be sent. This event is used to make compatibility decisions about a file to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -814,7 +854,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove -This event indicates that the DecisionDevicePnp object is no longer present. +This event Indicates that the DecisionDevicePnp object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -825,7 +865,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync -The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent. +This event indicates that a new set of DecisionDevicePnpAdd events will be sent. This event is used to make compatibility decisions about PNP devices to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -847,14 +887,13 @@ The following fields are available: - **DriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? - **DriverIsDeviceBlocked** Was the driver package was blocked because of a device block? - **DriverIsDriverBlocked** Is the driver package blocked because of a driver block? -- **DriverIsTroubleshooterBlocked** Indicates whether the driver package is blocked because of a troubleshooter block. - **DriverShouldNotMigrate** Should the driver package be migrated during upgrade? - **SdbDriverBlockOverridden** Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden? ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove -This event indicates that the DecisionDriverPackage object is no longer present. +This event indicates that the DecisionDriverPackage object represented by the objectInstanceId is no longer present. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -865,7 +904,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync -This event indicates that a new set of DecisionDriverPackageAdd events will be sent. +The DecisionDriverPackageStartSync event indicates that a new set of DecisionDriverPackageAdd events will be sent. This event is used to make compatibility decisions about driver packages to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -893,9 +932,20 @@ The following fields are available: - **SdbReinstallUpgradeWarn** The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade. +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove + +This event indicates that the DecisionMatchingInfoBlock object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync -This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -920,7 +970,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync -This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -944,9 +994,20 @@ The following fields are available: - **SdbReinstallUpgrade** The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade). +### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeRemove + +This event indicates that the DecisionMatchingInfoPostUpgrade object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync -This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. +This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -972,9 +1033,20 @@ The following fields are available: - **NeedsDismissAction** Are there any actions that can be dismissed coming from Windows Media Center? +### Microsoft.Windows.Appraiser.General.DecisionMediaCenterRemove + +This event indicates that the DecisionMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync -This event indicates that a new set of DecisionMediaCenterAdd events will be sent. +This event indicates that a new set of DecisionMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -997,9 +1069,9 @@ The following fields are available: - **HasBiosBlock** Does the device have a BIOS block? -### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosRemove -This event indicates that a new set of DecisionSystemBiosAdd events will be sent. +This event indicates that the DecisionSystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1008,6 +1080,30 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser file that is generating the events. +### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync + +This event indicates that a new set of DecisionSystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + +### Microsoft.Windows.Appraiser.General.DecisionTestAdd + +This event provides diagnostic data for testing decision add events. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the appraiser binary generating the events. +- **TestDecisionDataPoint1** Test data point 1. +- **TestDecisionDataPoint2** Test data point 2. + + ### Microsoft.Windows.Appraiser.General.DecisionTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1046,7 +1142,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd -This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. +This event represents the basic metadata about a file on the system. The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1075,7 +1171,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove -This event indicates that the InventoryApplicationFile object is no longer present. +This event indicates that the InventoryApplicationFile object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1086,7 +1182,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync -This event indicates that a new set of InventoryApplicationFileAdd events will be sent. +This event indicates that a new set of InventoryApplicationFileAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1110,7 +1206,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove -This event indicates that the InventoryLanguagePack object is no longer present. +This event indicates that the InventoryLanguagePack object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1121,7 +1217,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync -This event indicates that a new set of InventoryLanguagePackAdd events will be sent. +This event indicates that a new set of InventoryLanguagePackAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1150,7 +1246,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove -This event indicates that the InventoryMediaCenter object is no longer present. +This event indicates that the InventoryMediaCenter object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1161,7 +1257,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync -This event indicates that a new set of InventoryMediaCenterAdd events will be sent. +This event indicates that a new set of InventoryMediaCenterAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1172,7 +1268,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd -This event sends basic metadata about the BIOS to determine whether it has a compatibility block. +This event sends basic metadata about the BIOS to determine whether it has a compatibility block. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1185,9 +1281,20 @@ The following fields are available: - **Model** The model field from Win32_ComputerSystem. +### Microsoft.Windows.Appraiser.General.InventorySystemBiosRemove + +This event indicates that the InventorySystemBios object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync -This event indicates that a new set of InventorySystemBiosAdd events will be sent. +This event indicates that a new set of InventorySystemBiosAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1198,7 +1305,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync -This event indicates that a full set of InventorySystemProcessorAdd events has been sent. +This event indicates that a full set of InventorySystemProcessorAdd events has been sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1209,7 +1316,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync -This event indicates that a new set of InventorySystemProcessorAdd events will be sent. +This event indicates that a new set of InventorySystemProcessorAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1218,6 +1325,19 @@ The following fields are available: - **AppraiserVersion** The version of the Appraiser binary (executable) generating the events. +### Microsoft.Windows.Appraiser.General.InventoryTestAdd + +This event provides diagnostic data for testing event adds. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the component sending the data. +- **TestInvDataPoint1** Test inventory data point 1. +- **TestInvDataPoint2** Test inventory data point 2. + + ### Microsoft.Windows.Appraiser.General.InventoryTestRemove This event provides data that allows testing of “Remove” decisions to help keep Windows up to date. @@ -1242,7 +1362,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd -This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. +This event runs only during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. It is critical in understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1267,7 +1387,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove -This event indicates that the InventoryUplevelDriverPackage object is no longer present. +This event indicates that the InventoryUplevelDriverPackage object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1278,7 +1398,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync -This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1289,7 +1409,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.RunContext -This event indicates what should be expected in the data payload. +This event is sent at the beginning of an appraiser run, the RunContext indicates what should be expected in the following data payload. This event is used with the other Appraiser events to make compatibility decisions to keep Windows up to date. The following fields are available: @@ -1321,9 +1441,20 @@ The following fields are available: - **virtualKB** The amount of virtual memory (in KB). +### Microsoft.Windows.Appraiser.General.SystemMemoryRemove + +This event that the SystemMemory object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync -This event indicates that a new set of SystemMemoryAdd events will be sent. +This event indicates that a new set of SystemMemoryAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1345,9 +1476,20 @@ The following fields are available: - **CompareExchange128Support** Does the CPU support CompareExchange128? +### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeRemove + +This event indicates that the SystemProcessorCompareExchange object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync -This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. +This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1369,9 +1511,20 @@ The following fields are available: - **LahfSahfSupport** Does the CPU support LAHF/SAHF? +### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfRemove + +This event indicates that the SystemProcessorLahfSahf object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync -This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. +This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1394,9 +1547,20 @@ The following fields are available: - **NXProcessorSupport** Does the processor support NX? +### Microsoft.Windows.Appraiser.General.SystemProcessorNxRemove + +This event indicates that the SystemProcessorNx object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync -This event indicates that a new set of SystemProcessorNxAdd events will be sent. +This event indicates that a new set of SystemProcessorNxAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1418,9 +1582,20 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? +### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWRemove + +This event indicates that the SystemProcessorPrefetchW object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync -This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. +This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1442,9 +1617,20 @@ The following fields are available: - **SSE2ProcessorSupport** Does the processor support SSE2? +### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Remove + +This event indicates that the SystemProcessorSse2 object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync -This event indicates that a new set of SystemProcessorSse2Add events will be sent. +This event indicates that a new set of SystemProcessorSse2Add events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1466,9 +1652,20 @@ The following fields are available: - **MaximumTouches** The maximum number of touch points supported by the device hardware. +### Microsoft.Windows.Appraiser.General.SystemTouchRemove + +This event indicates that the SystemTouch object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemTouchStartSync -This event indicates that a new set of SystemTouchAdd events will be sent. +This event indicates that a new set of SystemTouchAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1490,9 +1687,20 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. +### Microsoft.Windows.Appraiser.General.SystemWimRemove + +This event indicates that the SystemWim object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWimStartSync -This event indicates that a new set of SystemWimAdd events will be sent. +This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1516,7 +1724,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove -This event indicates that the SystemWindowsActivationStatus object is no longer present. +This event indicates that the SystemWindowsActivationStatus object is no longer present. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1527,7 +1735,7 @@ The following fields are available: ### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync -This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. +This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1553,9 +1761,20 @@ The following fields are available: - **WlanNativeDriver** Does the device have a non-emulated WLAN driver? +### Microsoft.Windows.Appraiser.General.SystemWlanRemove + +This event indicates that the SystemWlan object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.SystemWlanStartSync -This event indicates that a new set of SystemWlanAdd events will be sent. +This event indicates that a new set of SystemWlanAdd events will be sent. The data collected with this event is used to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1576,6 +1795,8 @@ The following fields are available: - **AppraiserVersion** The file version (major, minor and build) of the Appraiser DLL, concatenated without dots. - **AuxFinal** Obsolete, always set to false. - **AuxInitial** Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app. +- **CountCustomSdbs** The number of custom Sdbs used by Appraiser. +- **CustomSdbGuids** Guids of the custom Sdbs used by Appraiser; Semicolon delimited list. - **DeadlineDate** A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan. - **EnterpriseRun** Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter. - **FullSync** Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent. @@ -1619,9 +1840,20 @@ The following fields are available: - **WmdrmPurchased** Indicates if the system has any files with permanent licenses. +### Microsoft.Windows.Appraiser.General.WmdrmRemove + +This event indicates that the Wmdrm object is no longer present. The data collected with this event is used to help keep Windows up to date. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **AppraiserVersion** The version of the Appraiser file that is generating the events. + + ### Microsoft.Windows.Appraiser.General.WmdrmStartSync -This event indicates that a new set of WmdrmAdd events will be sent. +The WmdrmStartSync event indicates that a new set of WmdrmAdd events will be sent. This event is used to understand the usage of older digital rights management on the system, to help keep Windows up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -1634,7 +1866,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1652,7 +1884,7 @@ The following fields are available: ### MicCoords -This event provides information about the location and orientation of the microphone element. +This event provides information about the location and orientation of the microphone element. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1666,7 +1898,7 @@ The following fields are available: ### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo -This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. +This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -1702,7 +1934,7 @@ The following fields are available: ### Census.App -This event sends version data about the Apps running on this device, to help keep Windows up to date. +This event sends version data about the Apps running on this device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1720,7 +1952,7 @@ The following fields are available: ### Census.Azure -This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. +This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1731,7 +1963,7 @@ The following fields are available: ### Census.Battery -This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date. +This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1742,19 +1974,9 @@ The following fields are available: - **IsAlwaysOnAlwaysConnectedCapable** Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value. -### Census.Camera - -This event sends data about the resolution of cameras on the device, to help keep Windows up to date. - -The following fields are available: - -- **FrontFacingCameraResolution** Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0. -- **RearFacingCameraResolution** Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0. - - ### Census.Enterprise -This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. +This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1774,14 +1996,14 @@ The following fields are available: - **IsMDMEnrolled** Whether the device has been MDM Enrolled or not. - **MDMServiceProvider** A hash of the specific MDM authority, such as Microsoft Intune, that is managing the device. - **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID -- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in a Configuration Manager environment. -- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. -- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier +- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment. +- **ServerFeatures** Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers. +- **SystemCenterID** The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier ### Census.Firmware -This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date. +This event sends data about the BIOS and startup embedded in the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1793,7 +2015,7 @@ The following fields are available: ### Census.Flighting -This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date. +This event sends Windows Insider data from customers participating in improvement testing and feedback programs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1809,7 +2031,7 @@ The following fields are available: ### Census.Hardware -This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date. +This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1853,7 +2075,7 @@ The following fields are available: ### Census.Memory -This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date. +This event sends data about the memory on the device, including ROM and RAM. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1863,7 +2085,7 @@ The following fields are available: ### Census.Network -This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date. +This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors). The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1886,7 +2108,7 @@ The following fields are available: ### Census.OS -This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date. +This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1928,7 +2150,7 @@ The following fields are available: ### Census.PrivacySettings -This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -1974,7 +2196,7 @@ The following fields are available: ### Census.Processor -This event sends data about the processor to help keep Windows up to date. +This event sends data about the processor. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -1997,7 +2219,7 @@ The following fields are available: ### Census.Security -This event provides information on about security settings used to help keep Windows up to date and secure. +This event provides information about security settings. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2010,6 +2232,7 @@ The following fields are available: - **IsWdagFeatureEnabled** Indicates whether Windows Defender Application Guard is enabled. - **RequiredSecurityProperties** Describes the required security properties to enable virtualization-based security. - **SecureBootCapable** Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting. +- **ShadowStack** The bit fields of SYSTEM_SHADOW_STACK_INFORMATION representing the state of the Intel CET (Control Enforcement Technology) hardware security feature. - **SModeState** The Windows S mode trail state. - **SystemGuardState** Indicates the SystemGuard state. NotCapable (0), Capable (1), Enabled (2), Error (0xFF). - **TpmReadyState** Indicates the TPM ready state. NotReady (0), ReadyForStorage (1), ReadyForAttestation (2), Error (0xFF). @@ -2019,7 +2242,7 @@ The following fields are available: ### Census.Speech -This event is used to gather basic speech settings on the device. +This event is used to gather basic speech settings on the device. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2038,7 +2261,7 @@ The following fields are available: ### Census.Storage -This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date. +This event sends data about the total capacity of the system volume and primary disk. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2050,7 +2273,7 @@ The following fields are available: ### Census.Userdefault -This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date. +This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2064,7 +2287,7 @@ The following fields are available: ### Census.UserDisplay -This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date. +This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2085,7 +2308,7 @@ The following fields are available: ### Census.UserNLS -This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date. +This event sends data about the default app language, input, and display language preferences set by the user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2098,7 +2321,7 @@ The following fields are available: ### Census.UserPrivacySettings -This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. +This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings. The data collected with this event is used to help keep Windows secure. The following fields are available: @@ -2144,7 +2367,7 @@ The following fields are available: ### Census.VM -This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date. +This event sends data indicating whether virtualization is enabled on the device, and its various characteristics. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2153,14 +2376,16 @@ The following fields are available: - **IOMMUPresent** Represents if an input/output memory management unit (IOMMU) is present. - **IsVDI** Is the device using Virtual Desktop Infrastructure? - **IsVirtualDevice** Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors. +- **IsWVDSessionHost** Indicates if this is a Windows Virtual Device session host. - **SLATSupported** Represents whether Second Level Address Translation (SLAT) is supported by the hardware. - **VirtualizationFirmwareEnabled** Represents whether virtualization is enabled in the firmware. - **VMId** A string that identifies a virtual machine. +- **WVDEnvironment** Represents the WVD service environment to which this session host has been joined. ### Census.WU -This event sends data about the Windows update server and other App store policies, to help keep Windows up to date. +This event sends data about the Windows update server and other App store policies. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2169,6 +2394,7 @@ The following fields are available: - **AppStoreAutoUpdateMDM** Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured - **AppStoreAutoUpdatePolicy** Retrieves the Microsoft Store App Auto Update group policy setting - **DelayUpgrade** Retrieves the Windows upgrade flag for delaying upgrades. +- **IsHotPatchEnrolled** Represents the current state of the device in relation to enrollment in the hotpatch program. - **OSAssessmentFeatureOutOfDate** How many days has it been since a the last feature update was released but the device did not install it? - **OSAssessmentForFeatureUpdate** Is the device is on the latest feature update? - **OSAssessmentForQualityUpdate** Is the device on the latest quality update? @@ -2185,6 +2411,7 @@ The following fields are available: - **WUDeferUpdatePeriod** Retrieves if deferral is set for Updates. - **WUDeferUpgradePeriod** Retrieves if deferral is set for Upgrades. - **WUDODownloadMode** Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network. +- **WULCUVersion** Version of the LCU Installed on the machine. - **WUMachineId** Retrieves the Windows Update (WU) Machine Identifier. - **WUPauseState** Retrieves WU setting to determine if updates are paused. - **WUServer** Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default). @@ -2243,7 +2470,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2255,14 +2481,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2403,7 +2621,7 @@ The following fields are available: ### CbsServicingProvider.CbsCapabilitySessionFinalize -This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. +This event provides information about the results of installing or uninstalling optional Windows content from Windows Update. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -2546,7 +2764,7 @@ This event reports the results of deferring Windows Content to keep Windows up t ### TelClientSynthetic.AbnormalShutdown_0 -This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date. +This event sends data about boot IDs for which a normal clean shutdown was not observed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2617,7 +2835,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition -This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect. +This event is fired by UTC at state transitions to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2635,7 +2853,7 @@ The following fields are available: ### TelClientSynthetic.AuthorizationInfo_Startup -Fired by UTC at startup to signal what data we are allowed to collect. +This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2653,15 +2871,15 @@ The following fields are available: ### TelClientSynthetic.ConnectivityHeartBeat_0 -This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. +This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network. This event is fired by UTC during periods of no network as a heartbeat signal, to keep Windows secure and up to date. The following fields are available: -- **CensusExitCode** Returns last execution codes from census client run. -- **CensusStartTime** Returns timestamp corresponding to last successful census run. -- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine. +- **CensusExitCode** Last exit code of the Census task. +- **CensusStartTime** Time of last Census run. +- **CensusTaskEnabled** True if Census is enabled, false otherwise. - **LastConnectivityLossTime** Retrieves the last time the device lost free network. -- **NetworkState** Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network. +- **NetworkState** The network state of the device. - **NoNetworkTime** Retrieves the time spent with no network (since the last time) in seconds. - **RestrictedNetworkTime** Retrieves the time spent on a metered (cost restricted) network in seconds. @@ -2885,7 +3103,7 @@ This event is a low latency health alert that is part of the 4Nines device healt ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure -This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. +This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -2901,7 +3119,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU -The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. +The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2910,7 +3128,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMPendingInstall -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2919,7 +3137,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions -The DISM Pending Install event sends information to report pending package installation found. +The DISM Pending Install event sends information to report pending package installation found. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2928,7 +3146,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.DISMUninstallLCU -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2937,7 +3155,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd -The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU. +The SRT Repair Action End event sends information to report repair operation ended for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2952,7 +3170,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRepairActionStart -The SRT Repair Action Start event sends information to report repair operation started for given plug-in. +The SRT Repair Action Start event sends information to report repair operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2961,7 +3179,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd -The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. +The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2973,7 +3191,7 @@ The following fields are available: ### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart -The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. +The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -2984,7 +3202,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.DeviceInstall -This critical event sends information about the driver installation that took place. +This critical event sends information about the driver installation that took place. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3041,7 +3259,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd -This event sends data about the driver installation once it is completed. +This event sends data about the driver installation once it is completed. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3060,7 +3278,7 @@ The following fields are available: ### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart -This event sends data about the driver that the new driver installation is replacing. +This event sends data about the driver that the new driver installation is replacing. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3247,7 +3465,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed -This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. +This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -3257,7 +3475,7 @@ The following fields are available: ### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered -This event indicates that the uninstall was properly configured and that a system reboot was initiated. +This event indicates that the uninstall was properly configured and that a system reboot was initiated. The data collected with this event is used to help keep Windows up to date and performing properly. @@ -3293,7 +3511,7 @@ The following fields are available: ### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated -This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. +This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3305,7 +3523,7 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated -This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. +This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3318,13 +3536,13 @@ The following fields are available: ### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming -This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. +This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. ### TraceLoggingOasisUsbHostApiProvider.DeviceInformation -This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. +This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3366,7 +3584,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum -This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. +This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3407,7 +3625,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions -This event sends inventory component versions for the Device Inventory data. +This event sends inventory component versions for the Device Inventory data. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -3417,7 +3635,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd -This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. +This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3435,7 +3653,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd -This event sends basic metadata about an application on the system to help keep Windows up to date. +This event sends basic metadata about an application on the system. The data collected with this event is used to keep Windows performing properly and up to date. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3448,6 +3666,7 @@ The following fields are available: - **InstallDateMsi** The install date if the application was installed via Microsoft Installer (MSI). Passed as an array. - **InventoryVersion** The version of the inventory file generating the events. - **Language** The language code of the program. +- **MsiInstallDate** The install date recorded in the program's MSI package. - **MsiPackageCode** A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage. - **MsiProductCode** A GUID that describe the MSI Product. - **Name** The name of the application. @@ -3464,7 +3683,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd -This event represents what drivers an application installs. +This event represents what drivers an application installs. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3476,7 +3695,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync -The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. +The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3513,7 +3732,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd -This event provides the basic metadata about the frameworks an application may depend on. +This event provides the basic metadata about the frameworks an application may depend on. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3526,7 +3745,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync -This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. +This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3537,7 +3756,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3548,9 +3767,9 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync -This event indicates that a new set of InventoryApplicationAdd events will be sent. +This event indicates that a new set of InventoryApplicationAdd events will be sent. The data collected with this event is used to keep Windows performing properly. -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange) The following fields are available: @@ -3559,7 +3778,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd -This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date. +This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device). The data collected with this event is used to help keep Windows up to date and to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3583,7 +3802,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove -This event indicates that the InventoryDeviceContainer object is no longer present. +This event indicates that the InventoryDeviceContainer object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3594,7 +3813,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync -This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. +This event indicates that a new set of InventoryDeviceContainerAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3605,7 +3824,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd -This event retrieves information about what sensor interfaces are available on the device. +This event retrieves information about what sensor interfaces are available on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3635,7 +3854,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync -This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. +This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3646,7 +3865,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd -This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload. +This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3661,7 +3880,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove -This event indicates that the InventoryDeviceMediaClassRemove object is no longer present. +This event indicates that the InventoryDeviceMediaClass object represented by the objectInstanceId is no longer present. This event is used to understand a PNP device that is specific to a particular class of devices. The data collected with this event is used to help keep Windows up to date and performing properly while reducing overall size of data payload. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3672,7 +3891,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync -This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. +This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3728,7 +3947,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove -This event indicates that the InventoryDevicePnpRemove object is no longer present. +This event indicates that the InventoryDevicePnpRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3739,7 +3958,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync -This event indicates that a new set of InventoryDevicePnpAdd events will be sent. +This event indicates that a new set of InventoryDevicePnpAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3750,7 +3969,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd -This event sends basic metadata about the USB hubs on the device. +This event sends basic metadata about the USB hubs on the device. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3763,7 +3982,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync -This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. +This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3774,7 +3993,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd -This event sends basic metadata about driver binaries running on the system to help keep Windows up to date. +This event sends basic metadata about driver binaries running on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3801,7 +4020,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove -This event indicates that the InventoryDriverBinary object is no longer present. +This event indicates that the InventoryDriverBinary object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3812,7 +4031,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync -This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. +This event indicates that a new set of InventoryDriverBinaryAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3823,7 +4042,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd -This event sends basic metadata about drive packages installed on the system to help keep Windows up to date. +This event sends basic metadata about drive packages installed on the system. The data collected with this event is used to help keep Windows up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3845,7 +4064,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove -This event indicates that the InventoryDriverPackageRemove object is no longer present. +This event indicates that the InventoryDriverPackageRemove object is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3856,7 +4075,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync -This event indicates that a new set of InventoryDriverPackageAdd events will be sent. +This event indicates that a new set of InventoryDriverPackageAdd events will be sent. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3883,9 +4102,54 @@ The following fields are available: - **key** The globally unique identifier (GUID) used to identify the specific Json Trace logging session. +### Microsoft.Windows.Inventory.General.AppHealthStaticAdd + +This event sends details collected for a specific application on the source device. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync + +This event indicates the beginning of a series of AppHealthStaticAdd events. The data collected with this event is used to keep Windows performing properly. + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoAdd + +This event provides basic information about active memory slots on the device. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + +The following fields are available: + +- **Capacity** Memory size in bytes +- **Manufacturer** Name of the DRAM manufacturer +- **Model** Model and sub-model of the memory +- **Slot** Slot to which the DRAM is plugged into the motherboard. +- **Speed** MHZ the memory is currently configured & used at. +- **Type** Reports DDR, etc. as an enumeration value as per the DMTF SMBIOS standard version 3.3.0, section 7.18.2. +- **TypeDetails** Reports Non-volatile, etc. as a bit flag enumeration according to the DMTF SMBIOS standard version 3.3.0, section 7.18.3. + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + +### Microsoft.Windows.Inventory.General.InventoryMiscellaneousMemorySlotArrayInfoStartSync + +This diagnostic event indicates a new sync is being generated for this object type. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd -Provides data on the installed Office Add-ins. +This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3918,7 +4182,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3929,7 +4193,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3940,7 +4204,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd -Provides data on the Office identifiers. +This event provides data on the Office identifiers. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3958,7 +4222,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3969,7 +4233,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd -Provides data on Office-related Internet Explorer features. +This event provides data on Office-related Internet Explorer features. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -3995,7 +4259,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4006,7 +4270,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd -This event provides insight data on the installed Office products +This event provides insight data on the installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4021,7 +4285,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4032,7 +4296,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync -This diagnostic event indicates that a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4043,7 +4307,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd -Describes Office Products installed. +This event describes all installed Office products. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4058,7 +4322,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4069,7 +4333,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd -This event describes various Office settings +This event describes various Office settings. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4083,7 +4347,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync -Indicates a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4094,7 +4358,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd -This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions +This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4126,7 +4390,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4137,7 +4401,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd -This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule +This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4149,7 +4413,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4160,7 +4424,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync -This event indicates that a new sync is being generated for this object type. +This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4171,7 +4435,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This diagnostic event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4182,7 +4446,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd -Provides data on Unified Update Platform (UUP) products and what version they are at. +This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4197,7 +4461,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove -Indicates that this particular data object represented by the objectInstanceId is no longer present. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4205,7 +4469,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync -Diagnostic event to indicate a new sync is being generated for this object type. +This is a diagnostic event that indicates a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4213,7 +4477,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.Checksum -This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. +This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4224,7 +4488,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd -These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date. +This event represents the basic metadata about the OS indicators installed on the system. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4235,7 +4499,7 @@ The following fields are available: ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date. +This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. The data collected with this event helps ensure the device is up to date and keeps Windows performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4243,7 +4507,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove -This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4251,7 +4515,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync -This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent. +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). @@ -4261,7 +4525,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic ### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted -This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. +This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup. The data collected with this event is used to keep Windows performing properly. @@ -4279,7 +4543,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch -OS information collected during Boot, used to evaluate the success of the upgrade process. +This event includes basic data about the Operating System, collected during Boot and used to evaluate the success of the upgrade process. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4310,7 +4574,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig -This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. +This critical device configuration event provides information about drivers for a driver installation that took place within the kernel. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4335,7 +4599,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem -This event is sent when a problem code is cleared from a device. +This event is sent when a problem code is cleared from a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4348,7 +4612,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem -This event is sent when a new problem code is assigned to a device. +This event is sent when a new problem code is assigned to a device. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -4363,7 +4627,7 @@ The following fields are available: ### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown -This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. +This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4484,7 +4748,7 @@ The following fields are available: ### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. +This Ping event sends a detailed inventory of software and hardware information about the EdgeUpdate service, Edge applications, and the current system environment including app configuration, update configuration, and hardware capabilities. This event contains Device Connectivity and Configuration, Product and Service Performance, and Software Setup and Inventory data. One or more events is sent each time any installation, update, or uninstallation occurs with the EdgeUpdate service or with Edge applications. This event is used to measure the reliability and performance of the EdgeUpdate service and if Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4584,7 +4848,7 @@ The following fields are available: ### Microsoft.WebBrowser.Installer.EdgeUpdate.Ping -This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date +This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date. This is an indication that the event is designed to keep Windows secure and up to date. The following fields are available: @@ -4651,36 +4915,14 @@ The following fields are available: - **requestSessionCorrelationVectorBase** A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''. - **requestSessionId** A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) SHOULD have (with high probability) a single unique session ID. Default: ''. - **requestTestSource** Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''. -- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''. +- **requestUid** A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt SHOULD have (with high probability) a unique request id. Default: ''. -### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config - -This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure. - -The following fields are available: - -- **app_version** The internal Microsoft Edge build version string. -- **appConsentState** Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000). -- **Channel** An integer indicating the channel of the installation (Canary or Dev). -- **client_id** A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled. -- **ConnectionType** The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth -- **container_client_id** The client ID of the container if the device is in Windows Defender Application Guard mode. -- **container_session_id** The session ID of the container if the device is in Windows Defender Application Guard mode. -- **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level. -- **EventInfo.Level** The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full -- **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. -- **installSource** An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). -- **PayloadClass** The base class used to serialize and deserialize the Protobuf binary payload. -- **PayloadGUID** A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission. -- **PayloadLogType** The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level -- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade. - ## Migration events ### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4692,7 +4934,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFSys -This event returns data about the count of the migration objects across various phases during feature update. +This event returns data about the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4703,7 +4945,7 @@ The following fields are available: ### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr -This event returns data to track the count of the migration objects across various phases during feature update. +This event returns data to track the count of the migration objects across various phases during feature update. The data collected with this event is used to help keep Windows secure and to track data loss scenarios. The following fields are available: @@ -4717,7 +4959,7 @@ The following fields are available: ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd -This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session +This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4791,7 +5033,7 @@ The following fields are available: ### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded -This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. +This event indicates Windows Mixed Reality device state. This event is also used to count WMR device. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -4809,7 +5051,7 @@ The following fields are available: ### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation -This event is related to the OS version when the OS is upgraded with OneDrive installed. +This event is related to the OS version when the OS is upgraded with OneDrive installed. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -4823,11 +5065,386 @@ The following fields are available: - **SourceOSVersion** The source version of the operating system. +## ONNX runtime events + +### Microsoft.ML.ONNXRuntime.ProcessInfo + +This event collects information when an application loads ONNXRuntime.dll. The data collected with this event is used to keep Windows product and service performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **isRedist** Indicates if the ONNXRuntime usage is from redistributable package or inbox. +- **runtimeVersion** The version number of ONNXRuntime. +- **schemaVersion** Blueprint version of how the database is constructed. + + +### Microsoft.ML.ONNXRuntime.RuntimePerf + +This event collects information about ONNXRuntime performance. The data collected with this event is used to keep Windows performing properly. + +The following fields are available: + +- **AppSessionGuid** An identifier of a particular application session starting at process creation time and persisting until process end. +- **schemaVersion** Blueprint version of how the database is constructed. +- **sessionId** Identifier for each created session. +- **totalRunDuration** Total running/evaluation time from last time. +- **totalRuns** Total number of running/evaluation from last time. + + +## Surface events + +### Microsoft.Surface.Health.Binary.Prod.McuHealthLog + +This event collects information to keep track of health indicator of the built-in micro controller. For example, the number of abnormal shutdowns due to power issues during boot sequence, type of display panel attached to base, thermal indicator, throttling data in hardware etc. The data collected with this event is used to help keep Windows secure and performing properly. + +The following fields are available: + +- **CUtility::GetTargetNameA(Target)** Sub component name. +- **HealthLog** Health indicator log. +- **healthLogSize** 4KB. +- **productId** Identifier for product model. + +## Update health events + +### Microsoft.Windows.UpdateHealthTools.ExpediteBlocked + +This event indicates that an update detection has occurred and the targeted install has been blocked. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** An Update Id of the LCU expected to be expedited +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteCompleted + +This event indicates that the update has been completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** The Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** The list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version of the label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDetectionStarted + +This event indicates that the detection phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteDownloadStarted + +This event indicates that the download phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** A list of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteInstallStarted + +This event indicates that the install phase of USO has started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** List of update IDs in progress. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterAlreadyExpectedUbr + +This event indicates that the device is already on the expected UBR. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterExpectedUbr** The expected ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterFailedToUpdateToExpectedUbr + +This event indicates the expected UBR of the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootComplete + +This event indicates that the expedite update is completed with reboot. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The ubr of the device. +- **ExpediteUpdaterOfferedUpdateId** Update Id of the LCU expected to be expedited. +- **ExpediteUpdaterPolicyRestoreResult** HRESULT of the policy restore. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterRebootRequired + +This event indicates that the device has finished servicing and a reboot is required. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdatesInProgress** Comma delimited list of update IDs currently being offered. +- **ExpediteUsoCorrelationVector** The correlation vector from the USO session. +- **ExpediteUsoLastError** Last HResult from the current USO session. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanCompleted + +This event sends results of the expedite USO scan. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy ID of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteScheduledTaskCreated** Indicates whether the scheduled task was created (true/false). +- **ExpediteScheduledTaskHresult** HRESULT for scheduled task creation. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterMonitorResult** HRESULT of the USO monitoring. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterScanResult** HRESULT of the expedite USO scan. +- **ExpediteUpdaterUsoResult** HRESULT of the USO initialization and resume API calls. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.ExpediteUpdaterScanStarted + +This event sends telemetry that USO scan has been started. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **ExpediteErrorBitMap** Bit map value for any error code. +- **ExpeditePolicyId** The policy Id of the expedite request. +- **ExpediteResult** Boolean value for success or failure. +- **ExpediteUpdaterCurrentUbr** The UBR of the device. +- **ExpediteUpdaterExpectedUbr** The expected UBR of the device. +- **ExpediteUpdaterOfferedUpdateId** UpdateId of the LCU expected to be expedited. +- **ExpediteUpdaterUsoIntiatedScan** True when USO scan has been called. +- **ExpediteUsoCorrelationVector** The correlation vector for the current USO session. +- **ExpediteUsoLastError** The last error returned by USO. +- **GlobalEventCounter** Counts the number of events for this provider. +- **PackageVersion** The package version label. +- **UsoFrequencyKey** Indicates whether the USO frequency key was found on the device (true/false). + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerEnd + +This event indicates that the unified installer has completed. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** The event counter for telemetry events on the device for currency tools. +- **PackageVersion** The package version label for currency tools. +- **UnifiedInstallerInstallResult** The final result code for the unified installer. +- **UnifiedInstallerPlatformResult** The result code from determination of the platform type. +- **UnifiedInstallerPlatformType** The enum indicating the platform type. + + +### Microsoft.Windows.UpdateHealthTools.UnifiedInstallerStart + +This event indicates that the installation has started for the unified installer. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** The correlation vector. +- **GlobalEventCounter** Counts the events at the global level for telemetry. +- **PackageVersion** The package version for currency tools. +- **UnifiedInstallerDeviceAADJoinedHresult** The result code after checking if device is AAD joined. +- **UnifiedInstallerDeviceInDssPolicy** Boolean indicating whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceInDssPolicyHresult** The result code for checking whether the device is found to be in a DSS policy. +- **UnifiedInstallerDeviceIsAADJoined** Boolean indicating whether a device is AADJ. +- **UnifiedInstallerDeviceIsAdJoined** Boolean indicating whether a device is AD joined. +- **UnifiedInstallerDeviceIsAdJoinedHresult** The result code for checking whether a device is AD joined. +- **UnifiedInstallerDeviceIsEducationSku** Boolean indicating whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEducationSkuHresult** The result code from checking whether a device is Education SKU. +- **UnifiedInstallerDeviceIsEnterpriseSku** Boolean indicating whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsEnterpriseSkuHresult** The result code from checking whether a device is Enterprise SKU. +- **UnifiedInstallerDeviceIsHomeSku** Boolean indicating whether a device is Home SKU. +- **UnifiedInstallerDeviceIsHomeSkuHresult** The result code from checking whether device is Home SKU. +- **UnifiedInstallerDeviceIsMdmManaged** Boolean indicating whether a device is MDM managed. +- **UnifiedInstallerDeviceIsMdmManagedHresult** The result code from checking whether a device is MDM managed. +- **UnifiedInstallerDeviceIsProSku** Boolean indicating whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsProSkuHresult** The result code from checking whether a device is Pro SKU. +- **UnifiedInstallerDeviceIsSccmManaged** Boolean indicating whether a device is SCCM managed. +- **UnifiedInstallerDeviceIsSccmManagedHresult** The result code from checking whether a device is SCCM managed. +- **UnifiedInstallerDeviceWufbManaged** Boolean indicating whether a device is Wufb managed. +- **UnifiedInstallerDeviceWufbManagedHresult** The result code from checking whether a device is Wufb managed. +- **UnifiedInstallerPlatformResult** The result code from checking what platform type the device is. +- **UnifiedInstallerPlatformType** The enum indicating the type of platform detected. +- **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded + +This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. +- **UpdateHealthToolsDeviceUbrChanged** 1 if the Ubr just changed, 0 otherwise. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploadFailed + +This event provides information for device which failed to upload the details. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Telemetry event counter. +- **PackageVersion** Version label of the package sending telemetry. +- **UpdateHealthToolsEnterpriseActionResult** Result of running the tool expressed as an HRESULT. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationCompleted + +This event is received when a push notification has been completed by the UpdateHealthTools service. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsEnterpriseActionResult** The HRESULT return by the enterprise action. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationReceived + +This event is received when the UpdateHealthTools service receives a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentChannel** The channel used to receive notification. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsPushNotificationStatus + +This event is received when there is status on a push notification. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. +- **UpdateHealthToolsDeviceUri** The URI to be used for push notifications on this device. +- **UpdateHealthToolsEnterpriseActionType** Enum describing the type of action requested by the push. +- **UpdateHealthToolsPushCurrentRequestId** The request ID for the push. +- **UpdateHealthToolsPushCurrentResults** The results from the push request. +- **UpdateHealthToolsPushCurrentStep** The current step for the push notification + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin + +This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of UpdateHealthTools. + + +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted + +This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by this user. +- **PackageVersion** Current package version of remediation. + + ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted -This event is used to determine whether the user successfully completed the privacy consent experience. +This event is used to determine whether the user successfully completed the privacy consent experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4839,7 +5456,7 @@ The following fields are available: ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus -Event tells us effectiveness of new privacy experience. +This event provides the effectiveness of new privacy experience. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -4851,672 +5468,11 @@ The following fields are available: - **userRegionCode** The current user's region setting -## Push Button Reset events - -### Microsoft.Windows.PBR.BitLockerWipeFinished - -This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe. - -The following fields are available: - -- **error** The error code if there were any issues during the BitLocker wipe. -- **sessionID** This is the session ID. -- **succeeded** Indicates the BitLocker wipe successful completed. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.BootState - -This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful. - -The following fields are available: - -- **BsdSummaryInfo** Summary of the last boot. -- **sessionID** The ID of the push-button reset session. -- **timestamp** The timestamp of the boot state. - - -### Microsoft.Windows.PBR.ClearTPMStarted - -This event sends basic data about the recovery operation on the device to allow investigation. - -The following fields are available: - -- **sessionID** The ID for this push-button restart session. -- **timestamp** The time when the Trusted Platform Module will be erased. - - -### Microsoft.Windows.PBR.ClientInfo - -This event indicates whether push-button reset (PBR) was initiated while the device was online or offline. - -The following fields are available: - -- **name** Name of the user interface entry point. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The time when this event occurred. - - -### Microsoft.Windows.PBR.Completed - -This event sends data about the recovery operation on the device to allow for investigation. - -The following fields are available: - -- **sessionID** The ID of the push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.DataVolumeCount - -This event provides the number of additional data volumes that the push-button reset operation has detected. - -The following fields are available: - -- **count** The number of attached data drives. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.DiskSpaceRequired - -This event sends the peak disk usage required for the push-button reset operation. - -The following fields are available: - -- **numBytes** The number of bytes required for the reset operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Time the event occurred. - - -### Microsoft.Windows.PBR.EnterAPI - -This event is sent at the beginning of each push-button reset (PRB) operation. - -The following fields are available: - -- **apiName** Name of the API command that is about to execute. -- **sessionID** The session ID. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.EnteredOOBE - -This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.LeaveAPI - -This event is sent when the push-button reset operation is complete. - -The following fields are available: - -- **apiName** Name of the API command that completed. -- **errorCode** Error code if an error occurred during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation is successfully completed. -- **success** Indicates whether the API call was successful. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionFinished - -This event is sent when the OEM extensibility scripts have completed. - -The following fields are available: - -- **exitCode** The exit code from OEM extensibility scripts to push-button reset. -- **param** Parameters used for the OEM extensibility script. -- **phase** Name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the OEM extensibility script executed successfully. -- **timedOut** Indicates whether the OEM extensibility script timed out. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OEMExtensionStarted - -This event is sent when the OEM extensibility scripts start to execute. - -The following fields are available: - -- **param** The parameters used by the OEM extensibility script. -- **phase** The name of the OEM extensibility script phase. -- **script** The path to the OEM extensibility script. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteFinished - -This event is sent at the end of a push-button reset (PBR) operation. - -The following fields are available: - -- **error** Indicates the result code of the event. -- **index** The operation index. -- **operation** The name of the operation. -- **phase** The name of the operation phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationExecuteStarted - -This event is sent at the beginning of a push-button reset operation. - -The following fields are available: - -- **index** The index of this operation. -- **operation** The name of this operation. -- **phase** The phase of this operation. -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. -- **weight** The weight of the operation used to distribute the change in percentage. - - -### Microsoft.Windows.PBR.OperationQueueConstructFinished - -This event is sent when construction of the operation queue for push-button reset is finished. - -The following fields are available: - -- **error** The result code for operation queue construction. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the operation successfully completed. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.OperationQueueConstructStarted - -This event is sent when construction of the operation queue for push-button reset is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** Timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.PBRClearTPMFailed - -This event is sent when there was a failure while clearing the Trusted Platform Module (TPM). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed - -This event is sent when the push-button reset operation fails to construct a new copy of the operating system. - -The following fields are available: - -- **HRESULT** Indicates the result code of the event. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. -- **SPErrorCode** The error code for the Setup Platform operation. -- **SPOperation** The last Setup Platform operation. -- **SPPhase** The last phase of the Setup Platform operation. - - -### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionSucceed - -This event is sent when the push-button reset operation succeeds in constructing a new copy of the operating system. - -The following fields are available: - -- **CBSPackageCount** The Component Based Servicing package count. -- **CustomizationPackageCount** The Customization package count. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFailed - -This event is sent when the push-button reset operation fails and rolls back to the previous state. - -The following fields are available: - -- **ErrorType** The result code for the push-button reset error. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFinalUserSelection - -This event is sent when the user makes the final selection in the user interface. - -The following fields are available: - -- **PBREraseData** Indicates whether the option to erase data is selected. -- **PBRRecoveryStrategy** The recovery strategy for the push-button reset operation. -- **PBRRepartitionDisk** Indicates whether the user has selected the option to repartition the disk. -- **PBRVariation** Indicates the push-button reset type. -- **PBRWipeDataDrives** Indicates whether the option to wipe the data drives is selected. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRFormatOSVolumeSucceed - -This event is sent when the operation to format the operating system volume succeeds during push-button reset (PBR). - -The following fields are available: - -- **JustDeleteFiles** Indicates whether disk formatting was skipped. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRIOCTLErasureSucceed - -This event is sent when the erasure operation succeeds during push-button reset (PBR). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRLayoutImageFailed - -This event is sent when push-button reset fails to create a new image of Windows. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBROEM1Failed - -This event is sent when the first OEM extensibility operation is successfully completed. - -The following fields are available: - -- **HRESULT** The result error code from the OEM extensibility script. -- **Parameters** The parameters that were passed to the OEM extensibility script. -- **PBRType** The type of push-button reset. -- **ScriptName** The path to the OEM extensibility script. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReachedOOBE - -This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience). - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRReconstructionInitiated - -This event returns data when a PBR (Push Button Reset) reconstruction operation begins. - -The following fields are available: - -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecks - -This event returns data when PBR (Push Button Reset) requirement checks begin. - -The following fields are available: - -- **DeploymentType** The type of deployment. -- **InstallType** The type of installation. -- **PBRType** The type of push-button reset. -- **SessionID** The ID for this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksFailed - -This event returns data when PBR (Push Button Reset) requirement checks fail. - -The following fields are available: - -- **DiskSpaceAvailable** The disk space available for the push-button reset. -- **DiskSpaceRequired** The disk space required for the push-button reset. -- **ErrorType** The type of error that occurred during the requirement checks phase of the push-button reset operation. -- **PBRImageVersion** The image version of the push-button reset tool. -- **PBRRecoveryStrategy** The recovery strategy for this phase of push-button reset. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **PBRType** The type of push-button reset specified by the user interface. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRRequirementChecksPassed - -This event returns data when PBR (Push Button Reset) requirement checks are passed. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRImageType** The push-button reset image type. -- **PBRImageVersion** The version of the push-button reset image. -- **PBRRecoveryStrategy** The push-button reset recovery strategy. -- **PBRStartedFrom** Identifies the push-button reset entry point. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PBRSucceed - -This event returns data when PBR (Push Button Reset) succeeds. - -The following fields are available: - -- **OSVersion** The OS version installed on the device. -- **PBRType** The type of push-button reset. -- **SessionID** The ID of this push-button reset session. - - -### Microsoft.Windows.PBR.PhaseFinished - -This event returns data when a phase of PBR (Push Button Reset) has completed. - -The following fields are available: - -- **error** The result code for this phase of push-button reset. -- **phase** The name of this push-button reset phase. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether this phase of push-button reset executed successfully. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.PhaseStarted - -This event is sent when a phase of the push-button reset (PBR) operation starts. - -The following fields are available: - -- **phase** The name of this phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.ReconstructionInfo - -This event returns data about the PBR (Push Button Reset) reconstruction. - -The following fields are available: - -- **numPackagesAbandoned** The number of packages that were abandoned during the reconstruction operation of push-button reset. -- **numPackagesFailed** The number of packages that failed during the reconstruction operation of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **slowMode** The mode of reconstruction. -- **targetVersion** The target version of the OS for the reconstruction. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ResetOptions - -This event returns data about the PBR (Push Button Reset) reset options selected by the user. - -The following fields are available: - -- **overwriteSpace** Indicates whether the option was selected to erase data during push-button reset. -- **preserveWorkplace** Indicates whether the option was selected to reserve the workplace during push-button reset. -- **scenario** The selected scenario for the push-button on reset operation. -- **sessionID** The ID of this push-button on reset session. -- **timestamp** The timestamp of this push-button on reset event. -- **usePayload** Indicates whether Cloud PBR or Reconstruction was used. -- **wipeData** Indicates whether the option was selected to wipe additional drives during push-button reset. - - -### Microsoft.Windows.PBR.RetryQueued - -This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot. - -The following fields are available: - -- **attempt** The number of retry attempts that were made -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnedToOldOS - -This event returns data after PBR (Push Button Reset) has completed the rollback. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed - -This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery). - -The following fields are available: - -- **errorCode** The error that occurred while scheduling the task. -- **sessionID** The ID of this push-button reset session. -- **taskName** The name of the task. -- **timestamp** The ID of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackFinished - -This event returns data when the PBR (Push Button Reset) rollback completes. - -The following fields are available: - -- **error** Any errors that occurred during rollback to the old operating system. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the rollback succeeded. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.RollbackStarted - -This event returns data when the PBR (Push Button Reset) rollback begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.ScenarioNotSupported - -This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device. - -The following fields are available: - -- **errorCode** The error that occurred. -- **reason** The reason why this push-button reset scenario is not supported. -- **sessionID** The ID for this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionCreated - -This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionResumed - -This event returns data when the PRB (Push Button Reset) session is resumed after reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SessionSaved - -This event returns data when the PRB (Push Button Reset) session is suspended between reboots. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteFinished - -This event returns data when the PBR (Push Button Reset) setup finishes. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **systemState** Information about the system state of the Setup Platform operation. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SetupExecuteStarted - -This event returns data when the PBR (Push Button Reset) setup starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupFinalizeStarted - -This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset). - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.SetupOperationFailed - -This event returns data when a PRB (Push Button Reset) setup operation fails. - -The following fields are available: - -- **errorCode** An error that occurred during the setup phase of push-button reset. -- **sessionID** The ID of this push-button reset session. -- **setupExecutionOperation** The name of the Setup Platform operation. -- **setupExecutionPhase** The phase of the setup operation that failed. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoField - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user. - -The following fields are available: - -- **name** Name of the system information field. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp of this push-button reset event. -- **value** The system information field value. - - -### Microsoft.Windows.PBR.SystemInfoListItem - -This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user. - -The following fields are available: - -- **index** The index number associated with the system information item. -- **name** The name of the list of system information items. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. -- **value** The value of the system information item. - - -### Microsoft.Windows.PBR.SystemInfoSenseFinished - -This event returns data when System Info Sense is finished. - -The following fields are available: - -- **error** The error code if an error occurred while querying for system information. -- **errorCode** Represents any error code during the API call. -- **sessionID** The ID of this push-button reset session. -- **succeeded** Indicates whether the query for system information was successful. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.SystemInfoSenseStarted - -This event returns data when System Info Sense is started. - -The following fields are available: - -- **sessionID** The ID of this push-button reset event. -- **timestamp** The timestamp of this push-button reset event. - - -### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning - -This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserCancel - -This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface. - -The following fields are available: - -- **pageID** The page ID for the page the user canceled. -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.UserConfirmStart - -This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallFinished - -This event returns data when WinRE (Windows Recovery) installation is complete. - -The following fields are available: - -- **errorCode** Any error that occurred during the Windows Recovery Environment (WinRE) installation. -- **sessionID** The ID of this push-button reset session. -- **success** Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed. -- **timestamp** The timestamp for this push-button reset event. - - -### Microsoft.Windows.PBR.WinREInstallStarted - -This event returns data when WinRE (Windows Recovery) installation starts. - -The following fields are available: - -- **sessionID** The ID of this push-button reset session. -- **timestamp** The timestamp for this push-button reset event. - - ## Quality Update Assistant events ### Microsoft.Windows.QualityUpdateAssistant.Applicability -This event sends basic info on whether the device should be updated to the latest cumulative update. +This event sends basic info on whether the device should be updated to the latest cumulative update. The data collected with this event is used to help keep Windows up to date and secure. The following fields are available: @@ -5532,7 +5488,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.DeviceReadinessCheck -This event sends basic info on whether the device is ready to download the latest cumulative update. +This event sends basic info on whether the device is ready to download the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5547,7 +5503,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Download -This event sends basic info when download of the latest cumulative update begins. +This event sends basic info when download of the latest cumulative update begins. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5566,7 +5522,7 @@ The following fields are available: ### Microsoft.Windows.QualityUpdateAssistant.Install -This event sends basic info on the result of the installation of the latest cumulative update. +This event sends basic info on the result of the installation of the latest cumulative update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -5591,7 +5547,7 @@ The following fields are available: ### Microsoft.Windows.Sediment.Info.DetailedState -This event is sent when detailed state information is needed from an update trial run. +This event is sent when detailed state information is needed from an update trial run. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -5623,6 +5579,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Value associated with the corresponding event name. For example, time-related events will include the system time @@ -5649,6 +5606,7 @@ The following fields are available: - **FieldName** Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc. - **GroupName** Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc. +- **InstanceID** This is a unique GUID to track individual instances of SetupPlatform that will help us tie events from a single instance together. - **Value** Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time. @@ -5656,7 +5614,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.CheckForUpdates -Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client check for content that is applicable to a device, to help keep Windows up to date. The following fields are available: @@ -5743,7 +5701,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Commit -This event tracks the commit process post the update installation when software update client is trying to update the device. +This event sends data on whether the Update Service has been called to execute an upgrade, to help keep Windows up to date. The following fields are available: @@ -5774,7 +5732,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Download -Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded). +This event sends tracking data about the software distribution client download of the content for that update, to help keep Windows up to date. The following fields are available: @@ -5865,7 +5823,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadCheckpoint -This event provides a checkpoint between each of the Windows Update download phases for UUP content +This event provides a checkpoint between each of the Windows Update download phases for UUP content. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5887,7 +5845,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.DownloadHeartbeat -This event allows tracking of ongoing downloads and contains data to explain the current state of the download +This event allows tracking of ongoing downloads and contains data to explain the current state of the download. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -5990,7 +5948,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Revert -Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is a revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6037,7 +5995,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.TaskRun -Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). +This is a start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6053,7 +6011,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.Uninstall -Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). +This is an uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded). The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6080,6 +6038,7 @@ The following fields are available: - **IsSuccessFailurePostReboot** Indicates whether an initial success was then a failure after a reboot. - **IsWUfBDualScanEnabled** Flag indicating whether WU-for-Business dual scan is enabled on the device. - **IsWUfBEnabled** Flag indicating whether WU-for-Business is enabled on the device. +- **IsWUfBTargetVersionEnabled** Flag that indicates if the WU-for-Business target version policy is enabled on the device. - **MergedUpdate** Indicates whether an OS update and a BSP update were merged for install. - **ProcessName** Process name of the caller who initiated API calls into the software distribution client. - **QualityUpdatePause** Indicates whether quality OS updates are paused on the device. @@ -6098,7 +6057,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateDetected -This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. +This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6113,7 +6072,7 @@ The following fields are available: ### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity -Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. +This event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack. The data collected with this event is used to help keep Windows up to date, secure, and performing properly. The following fields are available: @@ -6146,13 +6105,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallCancel -This event indicates the customer has cancelled uninstallation of Windows. +This event indicates the customer has cancelled uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallError -This event sends an error code when the Windows uninstallation fails. +This event sends an error code when the Windows uninstallation fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6161,19 +6120,19 @@ The following fields are available: ### Microsoft.Windows.SysReset.FlightUninstallReboot -This event is sent to signal an upcoming reboot during uninstallation of Windows. +This event is sent to signal an upcoming reboot during uninstallation of Windows. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallStart -This event indicates that the Windows uninstallation has started. +This event indicates that the Windows uninstallation has started. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.FlightUninstallUnavailable -This event sends diagnostic data when the Windows uninstallation is not available. +This event sends diagnostic data when the Windows uninstallation is not available. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6185,13 +6144,13 @@ The following fields are available: ### Microsoft.Windows.SysReset.HasPendingActions -This event is sent when users have actions that will block the uninstall of the latest quality update. +This event is sent when users have actions that will block the uninstall of the latest quality update. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. ### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled -This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. +This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6200,7 +6159,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.LCUUninstall -This event is sent when the latest cumulative Windows update was uninstalled on a device. +This event is sent when the latest cumulative Windows update was uninstalled on a device. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6211,7 +6170,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRBlockedByPolicy -This event is sent when a push-button reset operation is blocked by the System Administrator. +This event is sent when a push-button reset operation is blocked by the System Administrator. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6221,7 +6180,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitFailed -This event signals a failed handoff between two recovery binaries. +This event signals a failed handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6230,7 +6189,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBREngineInitSucceed -This event signals successful handoff between two recovery binaries. +This event signals successful handoff between two recovery binaries. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6239,7 +6198,7 @@ The following fields are available: ### Microsoft.Windows.SysReset.PBRFailedOffline -This event reports the error code when recovery fails. +This event reports the error code when recovery fails. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6250,7 +6209,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.EsimPresentCheck -This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). +This event is sent when a device is checked to see whether it has an embedded SIM (eSIM). The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6261,7 +6220,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption -This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. +This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6273,7 +6232,7 @@ The following fields are available: ### Microsoft.Windows.SystemReset.RepairNeeded -This event provides information about whether a system reset needs repair. +This event provides information about whether a system reset needs repair. The data collected with this event is used to keep Windows performing properly and helps with tracking the health of recovery and OSUninstall scenarios. The following fields are available: @@ -6285,7 +6244,7 @@ The following fields are available: ### Microsoft.Windows.UEFI.ESRT -This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date. +This event sends basic data during boot about the firmware loaded or recently installed on the machine. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -6313,7 +6272,7 @@ The following fields are available: ### Update360Telemetry.Revert -This event sends data relating to the Revert phase of updating Windows. +This event sends data relating to the Revert phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6331,10 +6290,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentCommit -This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **FlightId** Unique ID for each flight. - **ObjectId** Unique value for each Update Agent mode. @@ -6347,13 +6307,18 @@ The following fields are available: ### Update360Telemetry.UpdateAgentDownloadRequest -This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. +This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean indicating whether a cancel was requested. - **ContainsSafeOSDUPackage** Boolean indicating whether Safe DU packages are part of the payload. - **DeletedCorruptFiles** Boolean indicating whether corrupt payload was deleted. - **DownloadComplete** Indicates if the download is complete. +- **DownloadedSizeCanonical** Cumulative size (in bytes) of downloaded canonical content. +- **DownloadedSizeDiff** Cumulative size (in bytes) of downloaded diff content. +- **DownloadedSizeExpress** Cumulative size (in bytes) of downloaded express content. +- **DownloadedSizePSFX** Cumulative size (in bytes) of downloaded PSFX content. - **DownloadRequests** Number of times a download was retried. - **ErrorCode** The error code returned for the current download request phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. @@ -6384,10 +6349,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentExpand -This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. +This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean that indicates whether a cancel was requested. - **CanonicalRequestedOnError** Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE). - **ElapsedTickCount** Time taken for expand phase. - **EndFreeSpace** Free space after expand phase. @@ -6405,7 +6371,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInitialize -This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. +This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6423,10 +6389,11 @@ The following fields are available: ### Update360Telemetry.UpdateAgentInstall -This event sends data for the install phase of updating Windows. +This event sends data for the install phase of updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: +- **CancelRequested** Boolean to indicate whether a cancel was requested. - **ErrorCode** The error code returned for the current install phase. - **ExtensionName** Indicates whether the payload is related to Operating System content or a plugin. - **FlightId** Unique value for each Update Agent mode (same concept as InstanceId for Setup360). @@ -6441,7 +6408,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMerge -The UpdateAgentMerge event sends data on the merge phase when updating Windows. +The UpdateAgentMerge event sends data on the merge phase when updating Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6458,7 +6425,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationResult -This event sends data indicating the result of each update agent mitigation. +This event sends data indicating the result of each update agent mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6484,7 +6451,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentMitigationSummary -This event sends a summary of all the update agent mitigations available for an this update. +This event sends a summary of all the update agent mitigations available for an this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6504,7 +6471,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. +This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6520,7 +6487,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentOneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6538,7 +6505,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentPostRebootResult -This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. +This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6547,14 +6514,16 @@ The following fields are available: - **ObjectId** Unique value for each Update Agent mode. - **PostRebootResult** Indicates the Hresult. - **RelatedCV** Correlation vector value generated from the latest USO scan. +- **RollbackFailureReason** Indicates the cause of the rollback. - **ScenarioId** The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate. - **SessionId** Unique value for each update attempt. - **UpdateId** Unique ID for each update. +- **UpdateOutputState** A numeric value indicating the state of the update at the time of reboot. ### Update360Telemetry.UpdateAgentReboot -This event sends information indicating that a request has been sent to suspend an update. +This event sends information indicating that a request has been sent to suspend an update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6573,7 +6542,7 @@ The following fields are available: ### Update360Telemetry.UpdateAgentSetupBoxLaunch -The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. +The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6596,7 +6565,7 @@ The following fields are available: ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat -This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. +This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6629,7 +6598,7 @@ The following fields are available: ### FacilitatorTelemetry.DUDownload -This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. +This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6639,7 +6608,7 @@ The following fields are available: ### FacilitatorTelemetry.InitializeDU -This event determines whether devices received additional or critical supplemental content during an OS upgrade. +This event determines whether devices received additional or critical supplemental content during an OS upgrade. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6697,7 +6666,7 @@ The following fields are available: ### Setup360Telemetry.OsUninstall -This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. +This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6861,7 +6830,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationResult -This event sends data indicating the result of each setup mitigation. +This event sends data indicating the result of each setup mitigation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6886,7 +6855,7 @@ The following fields are available: ### Setup360Telemetry.Setup360MitigationSummary -This event sends a summary of all the setup mitigations available for this update. +This event sends a summary of all the setup mitigations available for this update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6905,7 +6874,7 @@ The following fields are available: ### Setup360Telemetry.Setup360OneSettings -This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. +This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6944,9 +6913,35 @@ The following fields are available: ## Windows as a Service diagnostic events +### Microsoft.Windows.WaaSMedic.DetectionFailed + +This event is sent when WaaSMedic fails to apply the named diagnostic. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the diagnostic failed. +- **hResult** Error code from attempting the diagnostic. +- **isDetected** Flag indicating whether the condition was detected. +- **pluginName** Name of the attempted diagnostic. +- **versionString** The version number of the remediation engine. + + +### Microsoft.Windows.WaaSMedic.RemediationFailed + +This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **diagnostic** Parameter where the resolution failed. +- **hResult** Error code that resulted from attempting the resolution. +- **isRemediated** Indicates whether the condition was remediated. +- **pluginName** Name of the attempted resolution. +- **versionString** Version of the engine. + + ### Microsoft.Windows.WaaSMedic.SummaryEvent -Result of the WaaSMedic operation. +This event provides the result of the WaaSMedic operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -6997,7 +6992,7 @@ The following fields are available: ### Value -This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. +This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7024,7 +7019,7 @@ The following fields are available: ### WheaProvider.WheaErrorRecord -This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. +This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism. The data collected with this event is used to help keep Windows up to date and performing properly. The following fields are available: @@ -7045,7 +7040,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion -This event provides information about the datastore migration and whether it was successful. +This event provides information about the datastore migration and whether it was successful. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -7056,7 +7051,7 @@ The following fields are available: ### Microsoft.Windows.Security.WSC.GetCallerViaWdsp -This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. +This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation. The data collected with this event is used to help keep Windows secure and performing properly. The following fields are available: @@ -7466,7 +7461,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed -This event sends basic telemetry on the failure of the Feature Rollback. +This event sends basic telemetry on the failure of the Feature Rollback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7482,7 +7477,7 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable -This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. +This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7497,7 +7492,44 @@ The following fields are available: ### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted -This event sends basic information indicating that Feature Rollback has started. +This event sends basic information indicating that Feature Rollback has started. The data collected with this event is used to help keep Windows secure and up to date. + + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityFailed + +This event sends basic telemetry on the failure of the rollback of the Quality/LCU builds. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **hResult** Failure Error code. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Release Channel. +- **wUfBConnected** Result of Windows Update for Business connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityNotApplicable + +This event informs you whether a rollback of Quality updates is applicable to the devices that you are attempting to rollback. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **current** Result of currency check. +- **dismOperationSucceeded** Dism uninstall operation status. +- **oSVersion** Build number of the device. +- **paused** Indicates whether the device is paused. +- **rebootRequestSucceeded** Reboot Configuration Service Provider (CSP) call success status. +- **sacDevice** Device in the semi-annual channel. +- **wUfBConnected** Result of WUfB connection check. + + +### Microsoft.Windows.UpdateCsp.ExecuteRollBackQualityStarted + +This event indicates that the Quality Rollback process has started. The data collected with this event is used to help keep Windows secure and up to date. @@ -7505,7 +7537,7 @@ This event sends basic information indicating that Feature Rollback has started. ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled -This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7539,7 +7571,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted -This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7595,7 +7627,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused -This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7615,7 +7647,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted -This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. +This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7652,7 +7684,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication -This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. +This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7674,7 +7706,7 @@ The following fields are available: ### Microsoft.OSG.DU.DeliveryOptClient.JobError -This event represents a Windows Update job error. It allows for investigation of top errors. +This event represents a Windows Update job error. It allows for investigation of top errors. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -7690,7 +7722,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary -This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7714,7 +7746,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit -This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7730,7 +7762,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest -This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7757,7 +7789,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize -This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7775,7 +7807,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall -This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7791,7 +7823,7 @@ The following fields are available: ### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart -This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. +This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7806,7 +7838,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed -This event indicates that a notification dialog box is about to be displayed to user. +This event indicates that a notification dialog box is about to be displayed to user. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7832,7 +7864,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog -This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7849,7 +7881,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog -This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7866,7 +7898,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog -This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. +This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7883,7 +7915,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog -This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. +This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7900,7 +7932,7 @@ The following fields are available: ### Microsoft.Windows.Update.NotificationUx.RebootScheduled -Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update. +This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows secure and up-to-date by indicating when a reboot is scheduled by the system or a user for a security, quality, or feature update. The following fields are available: @@ -7918,9 +7950,36 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.ActivityError + +This event measures overall health of UpdateOrchestrator. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureCount** Number of failures. +- **failureId** Id of the failure. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **fileName** Source code file name where the error occurred. +- **function** Function where the failure occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source code file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **PartA_PrivTags** Privacy tags. +- **threadId** Identifier of the thread the error occurred on. +- **wilActivity** This struct provides a Windows Internal Library context used for Product and Service diagnostics. See [wilActivity](#wilactivity). + + ### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy -This event indicates a policy is present that may restrict update activity to outside of active hours. +This event indicates a policy is present that may restrict update activity to outside of active hours. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7931,7 +7990,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours -This event indicates that update activity was blocked because it is within the active hours window. +This event indicates that update activity was blocked because it is within the active hours window. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7943,7 +8002,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel -This event indicates that Windows Update activity was blocked due to low battery level. +This event indicates that Windows Update activity was blocked due to low battery level. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7955,7 +8014,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DeferRestart -This event indicates that a restart required for installing updates was postponed. +This event indicates that a restart required for installing updates was postponed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -7974,7 +8033,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Detection -This event indicates that a scan for a Windows Update occurred. +This event sends launch data for a Windows Update scan to help keep Windows secure and up to date. The following fields are available: @@ -8016,7 +8075,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded -This event indicates the reboot was postponed due to needing a display. +This event indicates the reboot was postponed due to needing a display. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8032,7 +8091,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Download -This event sends launch data for a Windows Update download to help keep Windows up to date. +This event sends launch data for a Windows Update download to help keep Windows secure and up to date. The following fields are available: @@ -8047,9 +8106,30 @@ The following fields are available: - **wuDeviceid** Unique device ID used by Windows Update. +### Microsoft.Windows.Update.Orchestrator.DTUEnabled + +This event indicates that Inbox DTU functionality was enabled. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **wuDeviceid** Device ID used by Windows Update. + + +### Microsoft.Windows.Update.Orchestrator.DTUInitiated + +This event indicates that Inbox DTU functionality was initiated. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **dtuErrorCode** Return code from creating the DTU Com Server. +- **isDtuApplicable** Determination of whether DTU is applicable to the machine it is running on. +- **utilizeDtuOverWu** Whether DTU should be utilized over Windows Update. +- **wuDeviceid** Device ID used by Windows Update. + + ### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels -This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. +This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8066,7 +8146,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask -This event indicated that USO failed to add a trigger time to a task. +This event indicated that USO failed to add a trigger time to a task. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8076,7 +8156,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.FlightInapplicable -This event sends data on whether the update was applicable to the device, to help keep Windows up to date. +This event sends data on whether the update was applicable to the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8093,7 +8173,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.InitiatingReboot -This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date. +This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows secure and up to date. The following fields are available: @@ -8110,7 +8190,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.Install -This event sends launch data for a Windows Update install to help keep Windows up to date. +This event sends launch data for a Windows Update install to help keep Windows secure and up to date. The following fields are available: @@ -8136,7 +8216,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.LowUptimes -This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. +This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8150,7 +8230,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection -This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date. +This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows secure and up to date. The following fields are available: @@ -8162,7 +8242,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart -This event is generated before the shutdown and commit operations. +This event is generated before the shutdown and commit operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8171,7 +8251,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RebootFailed -This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date. +This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows secure and up to date. The following fields are available: @@ -8190,7 +8270,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RefreshSettings -This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date. +This event sends basic data about the version of upgrade settings applied to the system to help keep Windows secure and up to date. The following fields are available: @@ -8202,7 +8282,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask -This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date. +This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows secure and up to date. The following fields are available: @@ -8214,7 +8294,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.ScanTriggered -This event indicates that Update Orchestrator has started a scan operation. +This event indicates that Update Orchestrator has started a scan operation. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8231,7 +8311,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable -This event defines when an optional update is available for the device to help keep Windows up to date. +This event defines when an optional update is available for the device to help keep Windows secure and up to date. The following fields are available: @@ -8244,7 +8324,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SeekUpdate -This event occurs when user initiates "seeker" scan. This helps keep Windows up to date. +This event occurs when user initiates "seeker" scan. This helps keep Windows secure and up to date. The following fields are available: @@ -8257,7 +8337,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.StickUpdate -This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8267,7 +8347,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.SystemNeeded -This event sends data about why a device is unable to reboot, to help keep Windows up to date. +This event sends data about why a device is unable to reboot, to help keep Windows secure and up to date. The following fields are available: @@ -8283,7 +8363,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours -This event indicates that update activity was stopped due to active hours starting. +This event indicates that update activity was stopped due to active hours starting. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8293,9 +8373,21 @@ The following fields are available: - **wuDeviceid** The device identifier. +### Microsoft.Windows.Update.Orchestrator.TerminatedByBatteryLevel + +This event is sent when update activity was stopped due to a low battery level. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **batteryLevel** The current battery charge capacity. +- **batteryLevelThreshold** The battery capacity threshold to stop update activity. +- **updatePhase** The current state of the update process. +- **wuDeviceid** The device identifier. + + ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature -This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. +This event is sent when an updater has attempted to register a binary that is not signed by Microsoft. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8306,7 +8398,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd -This event indicates a critical error with the callback binary requested by the updater. +This event indicates a critical error with the callback binary requested by the updater. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8317,7 +8409,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UnstickUpdate -This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. +This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8337,7 +8429,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh -This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date. +This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows secure and up to date. The following fields are available: @@ -8350,7 +8442,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed -This event is sent when an updater failed to execute the registered callback. +This event is sent when an updater failed to execute the registered callback. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8362,7 +8454,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired -This event sends data about whether an update required a reboot to help keep Windows up to date. +This event sends data about whether an update required a reboot to help keep Windows secure and up to date. The following fields are available: @@ -8388,7 +8480,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed -This event sends information about an update that encountered problems and was not able to complete. +This event sends information about an update that encountered problems and was not able to complete. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8398,7 +8490,7 @@ The following fields are available: ### Microsoft.Windows.Update.Orchestrator.UsoSession -This event represents the state of the USO service at start and completion. +This event represents the state of the USO service at start and completion. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8414,7 +8506,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState -This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. +This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8436,7 +8528,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded -This event is sent when a security update has successfully completed. +This event is sent when a security update has successfully completed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8445,7 +8537,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled -This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date. +This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows secure and up to date. The following fields are available: @@ -8465,7 +8557,7 @@ The following fields are available: ### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled -This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date +This event sends basic information for scheduling a device restart to install security updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8485,7 +8577,7 @@ The following fields are available: ### wilActivity -This event provides a Windows Internal Library context used for Product and Service diagnostics. +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. The following fields are available: @@ -8512,7 +8604,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages -This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. +This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8536,7 +8628,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints -This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. +This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8558,7 +8650,7 @@ The following fields are available: ### Mitigation360Telemetry.MitigationCustom.FixupEditionId -This event sends data specific to the FixupEditionId mitigation used for OS updates. +This event sends data specific to the FixupEditionId mitigation used for OS updates. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8579,11 +8671,32 @@ The following fields are available: - **WuId** Unique ID for the Windows Update client. +### Mitigation360Telemetry.MitigationCustom.FixupWimmountSysPath + +This event sends data specific to the FixupWimmountSysPath mitigation used for OS Updates. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **ClientId** In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value. +- **FlightId** Unique identifier for each flight. +- **ImagePathDefault** Default path to wimmount.sys driver defined in the system registry. +- **ImagePathFixedup** Boolean indicating whether the wimmount.sys driver path was fixed by this mitigation. +- **InstanceId** Unique GUID that identifies each instances of setuphost.exe. +- **MitigationScenario** The update scenario in which the mitigations were attempted. +- **RelatedCV** Correlation vector value. +- **Result** HResult of this operation. +- **ScenarioId** Setup360 flow type. +- **ScenarioSupported** Whether the updated scenario that was passed in was supported. +- **SessionId** The UpdateAgent “SessionId” value. +- **UpdateId** Unique identifier for the Update. +- **WuId** Unique identifier for the Windows Update client. + + ## Windows Update Reserve Manager events ### Microsoft.Windows.UpdateReserveManager.BeginScenario -This event is sent when the Update Reserve Manager is called to begin a scenario. +This event is sent when the Update Reserve Manager is called to begin a scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8599,7 +8712,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ClearReserve -This event is sent when the Update Reserve Manager clears one of the reserves. +This event is sent when the Update Reserve Manager clears one of the reserves. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8610,7 +8723,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment -This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. +This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8620,7 +8733,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.EndScenario -This event is sent when the Update Reserve Manager ends an active scenario. +This event is sent when the Update Reserve Manager ends an active scenario. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8636,7 +8749,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError -This event is sent when the Update Reserve Manager returns an error from one of its internal functions. +This event is sent when the Update Reserve Manager returns an error from one of its internal functions. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8649,7 +8762,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeReserves -This event is sent when reserves are initialized on the device. +This event is sent when reserves are initialized on the device. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8678,7 +8791,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager -This event returns data about the Update Reserve Manager, including whether it’s been initialized. +This event returns data about the Update Reserve Manager, including whether it’s been initialized. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8693,7 +8806,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization -This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. +This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8703,7 +8816,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy -This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. +This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8714,13 +8827,13 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. +This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment. The data collected with this event is used to help keep Windows secure and up to date. ### Microsoft.Windows.UpdateReserveManager.TurnOffReserves -This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. +This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: @@ -8735,7 +8848,7 @@ The following fields are available: ### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment -This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. +This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed. The data collected with this event is used to help keep Windows secure and up to date. The following fields are available: diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index da656fd6ef..f5e56db553 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,6 +1,6 @@ --- description: Use this article to learn more about what required Windows diagnostic data is gathered. -title: Windows 10, version 2004 required diagnostic events and fields (Windows 10) +title: Windows 10, version 2010 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 ms.mktglfcycl: manage @@ -13,11 +13,11 @@ manager: dansimp ms.collection: M365-security-compliance ms.topic: article audience: ITPro -ms.date: 08/31/2020 +ms.date: 09/30/2020 --- -# Windows 10, version 2004 required Windows diagnostic events and fields +# Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic events and fields > [!IMPORTANT] @@ -26,6 +26,7 @@ ms.date: 08/31/2020 **Applies to** +- Windows 10, version 2010 - Windows 10, version 2004 @@ -37,7 +38,6 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: - - [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md) - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md) - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) @@ -1166,14 +1166,6 @@ The following fields are available: - **PrefetchWSupport** Does the processor support PrefetchW? -### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWEndSync - -Deprecated in RS3. This event indicates that a full set of SystemProcessorPrefetchWAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1257,14 +1249,6 @@ The following fields are available: - **RegistryWimBootValue** The raw value from the registry that is used to indicate if the device is running from a WIM. -### Microsoft.Windows.Appraiser.General.SystemWimEndSync - -Deprecated in RS3. This event indicates that a full set of SystemWimAdd events has been sent. The data collected with this event is used to help keep Windows up to date. - -This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). - - - ### Microsoft.Windows.Appraiser.General.SystemWimStartSync This event indicates that a new set of SystemWimAdd events will be sent. The data collected with this event is used to help keep Windows up to date. @@ -1411,7 +1395,7 @@ The following fields are available: ### MicArrayGeometry -This event provides information about the layout of the individual microphone elements in the microphone array. +This event provides information about the layout of the individual microphone elements in the microphone array. The data collected with this event is used to keep Windows performing properly. The following fields are available: @@ -2005,7 +1989,6 @@ The following fields are available: - **ext_app** Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp). - **ext_container** Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer). - **ext_device** Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice). -- **ext_m365a** Describes the Microsoft 365-related fields. See [Common Data Extensions.m365a](#common-data-extensionsm365a). - **ext_mscv** Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv). - **ext_os** Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos). - **ext_sdk** Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk). @@ -2017,14 +2000,6 @@ The following fields are available: - **time** Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format. - **ver** Represents the major and minor version of the extension. -### Common Data Extensions.m365a - -Describes the Microsoft 365-related fields. - -The following fields are available: - -- **enrolledTenantId** The enrolled tenant ID. -- **msp** A bitmask that lists the active programs. ### Common Data Extensions.mscv @@ -2123,7 +2098,7 @@ The following fields are available: - **uts** A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. - **xid** A list of base10-encoded XBOX User IDs. -## Common Data Fields +## Common data fields ### Ms.Device.DeviceInventoryChange @@ -2131,11 +2106,10 @@ Describes the installation state for all hardware and software components availa The following fields are available: -- **action** The change that was invoked on a device inventory object. -- **inventoryId** Device ID used for Compatibility testing -- **objectInstanceId** Object identity which is unique within the device scope. -- **objectType** Indicates the object type that the event applies to. -- **syncId** A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object. +- **action** The change that was invoked on a device inventory object. +- **inventoryId** Device ID used for Compatibility testing +- **objectInstanceId** Object identity which is unique within the device scope. +- **objectType** Indicates the object type that the event applies to. ## Component-based servicing events @@ -3167,6 +3141,7 @@ The following fields are available: - **Categories** A comma separated list of functional categories in which the container belongs. - **DiscoveryMethod** The discovery method for the device container. - **FriendlyName** The name of the device container. +- **Icon** Deprecated in RS3. The path or index to the icon file. - **InventoryVersion** The version of the inventory file generating the events. - **IsActive** Is the device connected, or has it been seen in the last 14 days? - **IsConnected** For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link. @@ -3851,6 +3826,14 @@ The following fields are available: - **IndicatorValue** The indicator value. +### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove + +This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. + +This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange). + + + ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync This event indicates that this particular data object represented by the objectInstanceId is no longer present. This event is used to understand the OS indicators installed on the system. The data collected with this event helps ensure the device is current and Windows is up to date and performing properly. @@ -4378,32 +4361,6 @@ The following fields are available: - **totalRuns** Total number of running/evaluation from last time. -## Windows Admin Center events - -### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus - -A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. - -The following fields are available: - -- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. -- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. -- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. -- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. -- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. -- **friendlyOsName** A user-friendly name describing the OS version. -- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. -- **gatewayVersion** The version string for this currently running Gateway application. -- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. -- **installationType** Identifies if the gateway was installed as a VM extension. -- **installedDate** The date on which this gateway was installed. -- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. -- **otherProperties** This is an empty string, but may be used for another purpose in the future. -- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. -- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID.. -- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. - - ## Privacy consent logging events ### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted @@ -5238,6 +5195,18 @@ The following fields are available: - **UnifiedInstUnifiedInstallerDeviceIsHomeSkuHresultllerDeviceIsHomeSku** The result code from checking whether a device is Home SKU. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsCachedNotificationRetrieved + +This event is sent when a notification is received. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter that indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsBlobNotificationNotEmpty** A boolean that is true if the blob notification has valid content. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsDeviceInformationUploaded This event is received when the UpdateHealthTools service uploads device information. The data collected with this event is used to help keep Windows secure and up to date. @@ -5308,6 +5277,24 @@ The following fields are available: - **UpdateHealthToolsPushCurrentStep** The current step for the push notification +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlobDocumentDetails + +The event indicates the details about the blob used for update health tools. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by the user. +- **PackageVersion** The package version of the label. +- **UpdateHealthToolsDevicePolicyFileName** The default name of the policy blob file. +- **UpdateHealthToolsDssDeviceApiSegment** The URI segment for reading the DSS device pointer. +- **UpdateHealthToolsDssDeviceId** The AAD ID of the device used to create the device ID hash. +- **UpdateHealthToolsDssDevicePolicyApiSegment** The segment of the device policy API pointer. +- **UpdateHealthToolsDssTenantId** The tenant id of the device used to create the tenant id hash. +- **UpdateHealthToolsHashedDeviceId** The SHA256 hash of the device id. +- **UpdateHealthToolsHashedTenantId** The SHA256 hash of the device tenant id. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceBlockedByNoAADJoin This event indicates that the device is not AAD joined so service stops. The data collected with this event is used to help keep Windows secure and up to date. @@ -5319,6 +5306,17 @@ The following fields are available: - **PackageVersion** Current package version of UpdateHealthTools. +### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceIsDSSJoin + +This event is sent when a device has been detected as DSS device. The data collected with this event is used to help keep Windows secure and up to date. + +The following fields are available: + +- **CV** A correlation vector. +- **GlobalEventCounter** This is a client side counter which indicates ordering of events sent by this user. +- **PackageVersion** The package version of the label. + + ### Microsoft.Windows.UpdateHealthTools.UpdateHealthToolsServiceStarted This event is sent when the service first starts. It is a heartbeat indicating that the service is available on the device. The data collected with this event is used to help keep Windows secure and up to date. @@ -5955,6 +5953,32 @@ The following fields are available: - **WuId** This is the Windows Update Client ID. With Windows Update, this is the same as the clientId. +## Windows Admin Center events + +### Microsoft.ServerManagementExperience.Gateway.Service.GatewayStatus + +A periodic event that describes Windows Admin Center gateway app's version and other inventory and configuration parameters. + +The following fields are available: + +- **activeNodesByNodeId** A count of how many active nodes are on this gateway, deduplicated by Node ID. +- **activeNodesByUuid** A count of how many active nodes are on this gateway, deduplicated by UUID. +- **AvailableMemoryMByte** A snapshot of the available physical memory on the OS. +- **azureADAppRegistered** If the gateway is registered with an Azure Active Directory. +- **azureADAuthEnabled** If the gateway has enabled authentication using Azure Active Directory. +- **friendlyOsName** A user-friendly name describing the OS version. +- **gatewayCpuUtilizationPercent** A snapshot of CPU usage on the OS. +- **gatewayVersion** The version string for this currently running Gateway application. +- **gatewayWorkingSetMByte** A snapshot of the working set size of the gateway process. +- **installationType** Identifies if the gateway was installed as a VM extension. +- **installedDate** The date on which this gateway was installed. +- **logicalProcessorCount** A snapshot of the how many logical processors the machine running this gateway has. +- **otherProperties** This is an empty string, but may be used for another purpose in the future. +- **registeredNodesByNodeId** A count of how many nodes are registered with this gateway, deduplicated by Node ID. +- **registeredNodesByUuid** A count of how many nodes are registered with this gateway, deduplicated by UUID. +- **totalCpuUtilizationPercent** A snapshot of the total CPU utilization of the machine running this gateway. + + ## Windows as a Service diagnostic events ### Microsoft.Windows.WaaSMedic.DetectionFailed @@ -6929,29 +6953,6 @@ The following fields are available: - **updateId** ID of the update that is getting installed with this restart. - **wuDeviceid** Unique device ID used by Windows Update. -### wilActivity - -This event provides a Windows Internal Library context used for Product and Service diagnostics. - -The following fields are available: - -- **callContext** The function where the failure occurred. -- **currentContextId** The ID of the current call context where the failure occurred. -- **currentContextMessage** The message of the current call context where the failure occurred. -- **currentContextName** The name of the current call context where the failure occurred. -- **failureCount** The number of failures for this failure ID. -- **failureId** The ID of the failure that occurred. -- **failureType** The type of the failure that occurred. -- **fileName** The file name where the failure occurred. -- **function** The function where the failure occurred. -- **hresult** The HResult of the overall activity. -- **lineNumber** The line number where the failure occurred. -- **message** The message of the failure that occurred. -- **module** The module where the failure occurred. -- **originatingContextId** The ID of the originating call context that resulted in the failure. -- **originatingContextMessage** The message of the originating call context that resulted in the failure. -- **originatingContextName** The name of the originating call context that resulted in the failure. -- **threadId** The ID of the thread on which the activity is executing. ### Microsoft.Windows.Update.Orchestrator.ActivityError @@ -7358,6 +7359,29 @@ The following fields are available: - **UpdateId** Unique ID for each Update. - **WuId** Unique ID for the Windows Update client. +### wilActivity + +This event provides a Windows Internal Library context used for Product and Service diagnostics. The data collected with this event is used to help keep Windows up to date. + +The following fields are available: + +- **callContext** The function where the failure occurred. +- **currentContextId** The ID of the current call context where the failure occurred. +- **currentContextMessage** The message of the current call context where the failure occurred. +- **currentContextName** The name of the current call context where the failure occurred. +- **failureCount** The number of failures for this failure ID. +- **failureId** The ID of the failure that occurred. +- **failureType** The type of the failure that occurred. +- **fileName** The file name where the failure occurred. +- **function** The function where the failure occurred. +- **hresult** The HResult of the overall activity. +- **lineNumber** The line number where the failure occurred. +- **message** The message of the failure that occurred. +- **module** The module where the failure occurred. +- **originatingContextId** The ID of the originating call context that resulted in the failure. +- **originatingContextMessage** The message of the originating call context that resulted in the failure. +- **originatingContextName** The name of the originating call context that resulted in the failure. +- **threadId** The ID of the thread on which the activity is executing. ## Windows Update Reserve Manager events @@ -7532,8 +7556,6 @@ The following fields are available: This event signals the completion of the setup process. It happens only once during the first logon. - - ## XDE events ### Microsoft.Emulator.Xde.RunTime.SystemReady @@ -7584,3 +7606,6 @@ The following fields are available: - **virtualMachineName** VM name. - **waitForClientConnection** True if we should wait for client connection. - **wp81NetworkStackDisabled** WP 8.1 networking stack disabled. + + + diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 6d801ea292..321a57eb41 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -15,9 +15,9 @@ href: Microsoft-DiagnosticDataViewer.md - name: Required Windows diagnostic data events and fields items: - - name: Windows 10, version 2004 required Windows diagnostic data events and fields + - name: Windows 10, version 2010 and Windows 10, version 2004 required Windows diagnostic data events and fields href: required-windows-diagnostic-data-events-and-fields-2004.md - - name: Windows 10, version 1903 and Windows 10, version 1909 required level Windows diagnostic events and fields + - name: Windows 10, version 1909 and Windows 10, version 1903 required level Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1903.md - name: Windows 10, version 1809 required Windows diagnostic events and fields href: basic-level-windows-diagnostic-events-and-fields-1809.md diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md index 153c7ca114..3546128bc3 100644 --- a/windows/privacy/windows-diagnostic-data.md +++ b/windows/privacy/windows-diagnostic-data.md @@ -12,20 +12,21 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/04/2019 ms.reviewer: --- # Windows 10, version 1709 and newer optional diagnostic data Applies to: +- Windows 10, version 2010 +- Windows 10, version 2004 - Windows 10, version 1909 - Windows 10, version 1903 - Windows 10, version 1809 - Windows 10, version 1803 - Windows 10, version 1709 -Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2004 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). +Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 2010 required diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields). In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard.