mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-29 13:47:23 +00:00
Merge pull request #7227 from MicrosoftDocs/danbrown-privacy-rs3
[Privacy] Merge changes to "1709" and "1803" articles into working branch for loc handoff
This commit is contained in:
Dan Brown
GitHub
commit
fbb99aaa58
@ -8,8 +8,6 @@ ms.author: danbrown
|
||||
manager: dougeby
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date:
|
||||
ms.reviewer:
|
||||
ms.technology: privacy
|
||||
---
|
||||
|
||||
@ -29,7 +27,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
||||
- [Required diagnostic events and fields for Windows 11, version 22H2](required-diagnostic-events-fields-windows-11-22H2.md)
|
||||
- [Required diagnostic events and fields for Windows 11, version 21H2](required-windows-11-diagnostic-events-and-fields.md)
|
||||
- [Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
@ -40,7 +39,6 @@ You can learn more about Windows functional and diagnostic data through these ar
|
||||
|
||||
|
||||
|
||||
|
||||
## Appraiser events
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
|
||||
@ -51,19 +49,19 @@ The following fields are available:
|
||||
|
||||
- **DatasourceApplicationFile_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS4** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_19H1Setup** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS4** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS4** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionApplicationFile_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDevicePnp_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDriverPackage_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMediaCenter_RS4** The count of the number of this particular object type present on this device.
|
||||
- **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS4** The total number of objects of this type present on this device.
|
||||
- **InventoryApplicationFile** The total number of objects of this type present on this device.
|
||||
@ -82,7 +80,7 @@ The following fields are available:
|
||||
- **SystemWim** The total number of objects of this type present on this device.
|
||||
- **SystemWindowsActivationStatus** The total number of objects of this type present on this device.
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS4** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS4** The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
|
||||
@ -1377,7 +1375,7 @@ The following fields are available:
|
||||
- **IsEDPEnabled** Represents if Enterprise data protected on the device.
|
||||
- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
|
||||
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise Configuration Manager environment.
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
|
||||
|
||||
@ -1954,6 +1952,18 @@ This event is fired by UTC at state transitions to signal what data we are allow
|
||||
|
||||
This event is fired by UTC at startup to signal what data we are allowed to collect. The data collected with this event is used to help keep Windows up to date, secure, and performing properly.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CanAddMsaToMsTelemetry** True if UTC is allowed to add MSA user identity onto telemetry from the OS provider groups.
|
||||
- **CanCollectAnyTelemetry** True if UTC is allowed to collect non-OS telemetry. Non-OS telemetry is responsible for providing its own opt-in mechanism.
|
||||
- **CanCollectCoreTelemetry** True if UTC is allowed to collect data which is tagged with both MICROSOFT_KEYWORD_CRITICAL_DATA and MICROSOFT_EVENTTAG_CORE_DATA.
|
||||
- **CanCollectHeartbeats** True if we can collect heartbeat telemetry, false otherwise.
|
||||
- **CanCollectOsTelemetry** True if UTC is allowed to collect telemetry from the OS provider groups (often called Microsoft Telemetry).
|
||||
- **CanPerformDiagnosticEscalations** True if UTC is allowed to perform all scenario escalations.
|
||||
- **CanPerformTraceEscalations** True if UTC is allowed to perform scenario escalations with tracing actions.
|
||||
- **CanReportScenarios** True if we can report scenario completions, false otherwise.
|
||||
- **PreviousPermissions** Bitmask representing the previously configured permissions since the telemetry client was last started.
|
||||
- **TransitionFromEverythingOff** True if this transition is moving from not allowing core telemetry to allowing core telemetry.
|
||||
|
||||
|
||||
### TelClientSynthetic.ConnectivityHeartBeat_0
|
||||
@ -1962,7 +1972,7 @@ This event sends data about the connectivity status of the Connected User Experi
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **CensusExitCode** Returns last execution codes from census client run.
|
||||
- **CensusExitCode** Last exit code of Census task
|
||||
- **CensusStartTime** Returns timestamp corresponding to last successful census run.
|
||||
- **CensusTaskEnabled** Returns Boolean value for the census task (Enable/Disable) on client machine.
|
||||
- **LastConnectivityLossTime** The FILETIME at which the last free network loss occurred.
|
||||
@ -2212,7 +2222,7 @@ This event sends basic metadata about the starting point of uninstalling a featu
|
||||
|
||||
### Microsoft.Windows.HangReporting.AppHangEvent
|
||||
|
||||
This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on client devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
|
||||
This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -2743,59 +2753,6 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AddinCLSID** The class identifier key for the Microsoft Office add-in.
|
||||
- **AddInCLSID** The class identifier key for the Microsoft Office add-in.
|
||||
- **AddInId** The identifier for the Microsoft Office add-in.
|
||||
- **AddinType** The type of the Microsoft Office add-in.
|
||||
- **BinFileTimestamp** The timestamp of the Office add-in.
|
||||
- **BinFileVersion** The version of the Microsoft Office add-in.
|
||||
- **Description** Description of the Microsoft Office add-in.
|
||||
- **FileId** The file identifier of the Microsoft Office add-in.
|
||||
- **FileSize** The file size of the Microsoft Office add-in.
|
||||
- **FriendlyName** The friendly name for the Microsoft Office add-in.
|
||||
- **FullPath** The full path to the Microsoft Office add-in.
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **LoadBehavior** Integer that describes the load behavior.
|
||||
- **LoadTime** Load time for the Office add-in.
|
||||
- **OfficeApplication** The Microsoft Office application associated with the add-in.
|
||||
- **OfficeArchitecture** The architecture of the add-in.
|
||||
- **OfficeVersion** The Microsoft Office version for this add-in.
|
||||
- **OutlookCrashingAddin** Indicates whether crashes have been found for this add-in.
|
||||
- **ProductCompany** The name of the company associated with the Office add-in.
|
||||
- **ProductName** The product name associated with the Microsoft Office add-in.
|
||||
- **ProductVersion** The version associated with the Office add-in.
|
||||
- **ProgramId** The unique program identifier of the Microsoft Office add-in.
|
||||
- **Provider** Name of the provider for this add-in.
|
||||
- **Usage** Data regarding usage of the add-in.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
|
||||
|
||||
This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
|
||||
|
||||
This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -3025,6 +2982,22 @@ The following fields are available:
|
||||
|
||||
- **winInetError** The HResult of the operation.
|
||||
|
||||
|
||||
## Other events
|
||||
|
||||
### Microsoft.ServerManagementExperience.Gateway.Service.ManagedNodeProperties
|
||||
|
||||
This is a periodic rundown event that contains more detailed information about the nodes added to this Windows Admin Center gateway for management.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **nodeId** The nodeTypeId concatenated with the hostname or IP address that gateway uses to connect to this node.
|
||||
- **nodeOperatingSystem** A user friendly description of the node's OS version.
|
||||
- **nodeOSVersion** A major or minor build version string for the node's OS.
|
||||
- **nodeTypeId** A string that distinguishes between a connection target, whether it is a client, server, cluster or a hyper-converged cluster.
|
||||
- **otherProperties** Contains a JSON object with variable content and may contain: "nodes": a list of host names or IP addresses of the servers belonging to a cluster, "aliases": the alias if it is set for this connection, "lastUpdatedTime": the number of milliseconds since Unix epoch when this connection was last updated, "ncUri", "caption", "version", "productType", "networkName", "operatingSystem", "computerManufacturer", "computerModel", "isS2dEnabled". This JSON object is formatted as an quotes-escaped string.
|
||||
|
||||
|
||||
## Privacy logging notification events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
|
||||
@ -3727,7 +3700,7 @@ Activity for deletion of a user account for devices set up for Shared PC mode as
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **accountType** The type of account that was deleted. Example: AD, Azure Active Directory (AAD), or Local
|
||||
- **accountType** The type of account that was deleted. Example: AD, Azure Active Directory (Azure AD), or Local
|
||||
- **deleteState** Whether the attempted deletion of the user account was successful.
|
||||
- **userSid** The security identifier of the account.
|
||||
- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity).
|
||||
@ -4353,7 +4326,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgent_FellBackToCanonical
|
||||
|
||||
This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information when Express could not be used, and the update had to fall back to “canonical” during the new UUP (Unified Update Platform) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4451,7 +4424,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentCommit
|
||||
|
||||
This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4467,7 +4440,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentDownloadRequest
|
||||
|
||||
This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4499,7 +4472,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentExpand
|
||||
|
||||
This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4519,7 +4492,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentFellBackToCanonical
|
||||
|
||||
This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4535,7 +4508,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentInitialize
|
||||
|
||||
This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4631,7 +4604,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentModeStart
|
||||
|
||||
This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4647,7 +4620,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentOneSettings
|
||||
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4665,7 +4638,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentPostRebootResult
|
||||
|
||||
This event collects information regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -4682,7 +4655,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentSetupBoxLaunch
|
||||
|
||||
The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5056,7 +5029,7 @@ This event sends a summary of all the setup mitigations available for this updat
|
||||
|
||||
### Setup360Telemetry.Setup360OneSettings
|
||||
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -6568,7 +6541,3 @@ This event indicates whether the system detected an activation error in the app.
|
||||
### Microsoft.Xbox.XamTelemetry.AppActivity
|
||||
|
||||
This event is triggered whenever the current app state is changed by: launch, switch, terminate, snap, etc.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -8,8 +8,6 @@ ms.author: danbrown
|
||||
manager: dougeby
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date:
|
||||
ms.reviewer:
|
||||
ms.technology: privacy
|
||||
---
|
||||
|
||||
@ -29,7 +27,8 @@ Use this article to learn about diagnostic events, grouped by event area, and th
|
||||
|
||||
You can learn more about Windows functional and diagnostic data through these articles:
|
||||
|
||||
- [Required Windows 11 diagnostic events and fields](required-windows-11-diagnostic-events-and-fields.md)
|
||||
- [Required diagnostic events and fields for Windows 11, version 22H2](required-diagnostic-events-fields-windows-11-22H2.md)
|
||||
- [Required diagnostic events and fields for Windows 11, version 21H2](required-windows-11-diagnostic-events-and-fields.md)
|
||||
- [Windows 10, version 21H2, Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required Windows diagnostic events and fields](required-windows-diagnostic-data-events-and-fields-2004.md)
|
||||
- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
|
||||
- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
|
||||
@ -39,7 +38,6 @@ You can learn more about Windows functional and diagnostic data through these ar
|
||||
- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
|
||||
|
||||
|
||||
|
||||
## Appraiser events
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
|
||||
@ -50,50 +48,50 @@ The following fields are available:
|
||||
|
||||
- **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceApplicationFile_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceApplicationFile_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceDevicePnp_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceDriverPackage_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoBlock_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device.
|
||||
- **DataSourceMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_RS1** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS5** The total number of objects of this type present on this device.
|
||||
- **DatasourceSystemBios_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DatasourceSystemBios_RS5Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionApplicationFile_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDevicePnp_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionDevicePnp_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionDriverPackage_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionDriverPackage_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoBlock_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPassive_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMatchingInfoPostUpgrade_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionMediaCenter_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionMediaCenter_RS5** The count of the number of this particular object type present on this device.
|
||||
- **DecisionSystemBios_RS1** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS3** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS5** The total number of objects of this type present on this device.
|
||||
- **DecisionSystemBios_RS5** The total DecisionSystemBios objects targeting the next release of Windows on this device.
|
||||
- **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device.
|
||||
- **DecisionTest_RS1** The total number of objects of this type present on this device.
|
||||
- **InventoryApplicationFile** The total number of objects of this type present on this device.
|
||||
@ -115,7 +113,7 @@ The following fields are available:
|
||||
- **SystemWlan** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS1** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS3** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS5** The total number of objects of this type present on this device.
|
||||
- **Wmdrm_RS5** The count of the number of this particular object type present on this device.
|
||||
|
||||
|
||||
### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
|
||||
@ -1434,7 +1432,7 @@ The following fields are available:
|
||||
- **IsEDPEnabled** Represents if Enterprise data protected on the device.
|
||||
- **IsMDMEnrolled** Whether the device has been MDM Enrolled or not.
|
||||
- **MPNId** Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise Configuration Manager environment.
|
||||
- **SCCMClientId** This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an enterprise Configuration Manager environment.
|
||||
- **ServerFeatures** Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
|
||||
- **SystemCenterID** The Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier
|
||||
|
||||
@ -2323,9 +2321,6 @@ The following fields are available:
|
||||
- **EtwDroppedBufferCount** Number of buffers dropped in the UTC ETW session.
|
||||
- **EtwDroppedCount** Number of events dropped at ETW layer of telemetry client.
|
||||
- **EventsPersistedCount** Number of events that reached the PersistEvent stage.
|
||||
- **EventStoreLifetimeResetCounter** Number of times event DB was reset for the lifetime of UTC.
|
||||
- **EventStoreResetCounter** Number of times event DB was reset.
|
||||
- **EventStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
|
||||
- **EventSubStoreResetCounter** Number of times event DB was reset.
|
||||
- **EventSubStoreResetSizeSum** Total size of event DB across all resets reports in this instance.
|
||||
- **EventsUploaded** Number of events uploaded.
|
||||
@ -3164,7 +3159,7 @@ This event sends basic metadata about the starting point of uninstalling a featu
|
||||
|
||||
### Microsoft.Windows.HangReporting.AppHangEvent
|
||||
|
||||
This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on client devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
|
||||
This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -3707,61 +3702,6 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
|
||||
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
|
||||
|
||||
This event provides data on the installed Office add-ins. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **AddinCLSID** The class identifier key for the Microsoft Office add-in.
|
||||
- **AddInCLSID** The class identifier key for the Microsoft Office add-in.
|
||||
- **AddInId** The identifier for the Microsoft Office add-in.
|
||||
- **AddinType** The type of the Microsoft Office add-in.
|
||||
- **BinFileTimestamp** The timestamp of the Office add-in.
|
||||
- **BinFileVersion** The version of the Microsoft Office add-in.
|
||||
- **Description** Description of the Microsoft Office add-in.
|
||||
- **FileId** The file identifier of the Microsoft Office add-in.
|
||||
- **FileSize** The file size of the Microsoft Office add-in.
|
||||
- **FriendlyName** The friendly name for the Microsoft Office add-in.
|
||||
- **FullPath** The full path to the Microsoft Office add-in.
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
- **LoadBehavior** Integer that describes the load behavior.
|
||||
- **LoadTime** Load time for the office addin
|
||||
- **OfficeApplication** The Microsoft Office application associated with the add-in.
|
||||
- **OfficeArchitecture** The architecture of the add-in.
|
||||
- **OfficeVersion** The Microsoft Office version for this add-in.
|
||||
- **OutlookCrashingAddin** Indicates whether crashes have been found for this add-in.
|
||||
- **ProductCompany** The name of the company associated with the Office add-in.
|
||||
- **ProductName** The product name associated with the Microsoft Office add-in.
|
||||
- **ProductVersion** The version associated with the Office add-in.
|
||||
- **ProgramId** The unique program identifier of the Microsoft Office add-in.
|
||||
- **Provider** Name of the provider for this add-in.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove
|
||||
|
||||
This event indicates that the particular data object represented by the objectInstanceId is no longer present. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
|
||||
|
||||
This event indicates that a new sync is being generated for this object type. The data collected with this event is used to keep Windows performing properly.
|
||||
|
||||
This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **InventoryVersion** The version of the inventory binary generating the events.
|
||||
|
||||
|
||||
### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
|
||||
|
||||
This event provides data on Unified Update Platform (UUP) products and what version they are at. The data collected with this event is used to keep Windows performing properly.
|
||||
@ -4363,10 +4303,6 @@ The following fields are available:
|
||||
- **winInetError** The HResult of the operation.
|
||||
|
||||
|
||||
## Other events
|
||||
|
||||
|
||||
|
||||
## Privacy consent logging events
|
||||
|
||||
### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
|
||||
@ -4984,7 +4920,7 @@ Activity for deletion of a user account for devices set up for Shared PC mode as
|
||||
|
||||
The following fields are available:
|
||||
|
||||
- **accountType** The type of account that was deleted. Example: AD, Azure Active Directory (AAD), or Local.
|
||||
- **accountType** The type of account that was deleted. Example: AD, Azure Active Directory (Azure AD), or Local
|
||||
- **deleteState** Whether the attempted deletion of the user account was successful.
|
||||
- **userSid** The security identifier of the account.
|
||||
- **wilActivity** Windows Error Reporting data collected when there is a failure in deleting a user account with the Transient Account Manager. See [wilActivity](#wilactivity).
|
||||
@ -5460,6 +5396,7 @@ The following fields are available:
|
||||
- **UpdateId** The update ID for a specific piece of content.
|
||||
- **ValidityWindowInDays** The validity window that's in effect when verifying the timestamp.
|
||||
|
||||
|
||||
## Surface events
|
||||
|
||||
### Microsoft.Surface.Battery.Prod.BatteryInfoEvent
|
||||
@ -5576,7 +5513,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentCommit
|
||||
|
||||
This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5592,7 +5529,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentDownloadRequest
|
||||
|
||||
This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5624,7 +5561,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentExpand
|
||||
|
||||
This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5644,7 +5581,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentFellBackToCanonical
|
||||
|
||||
This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information when express could not be used and we fall back to canonical during the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5660,7 +5597,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentInitialize
|
||||
|
||||
This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5758,7 +5695,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentModeStart
|
||||
|
||||
This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5774,7 +5711,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentOneSettings
|
||||
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5792,7 +5729,7 @@ The following fields are available:
|
||||
|
||||
### Update360Telemetry.UpdateAgentPostRebootResult
|
||||
|
||||
This event collects information regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -5814,7 +5751,7 @@ This event sends information indicating that a request has been sent to suspend
|
||||
|
||||
### Update360Telemetry.UpdateAgentSetupBoxLaunch
|
||||
|
||||
The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -6258,7 +6195,7 @@ The following fields are available:
|
||||
|
||||
### Setup360Telemetry.Setup360OneSettings
|
||||
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario, which is leveraged by both Mobile and Desktop. The data collected with this event is used to help keep Windows secure and up to date.
|
||||
|
||||
The following fields are available:
|
||||
|
||||
@ -8296,6 +8233,3 @@ The following fields are available:
|
||||
- **LicenseXuid** If the license type is 1 (User), this field contains the XUID (Xbox User ID) of the registered owner of the license.
|
||||
- **ProductGuid** The Xbox product GUID (Globally-Unique ID) of the application.
|
||||
- **UserId** The XUID (Xbox User ID) of the current user.
|
||||
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user