detection.wiki

Microsoft-Windows-ActionQueue

4 events across 1 channel

Event IDTitleChannel
1001Processing Action Queue "QueueFile".Analytic
1002Finished processing Action Queue with status ErrorCode.Analytic
2001Executing "ExecutableName" with arguments "Arguments" for component "Identity" …Analytic
2002Command completed with status ErrorCode.Analytic

Event ID 1001 — Processing Action Queue "QueueFile".

Provider
Microsoft-Windows-ActionQueue
Channel
Analytic
Task
ProcessActionQueue
Opcode
Start

Description

Processing Action Queue "QueueFile".

Message #

Processing Action Queue "%1".

Fields #

NameDescription
QueueFile UnicodeString—

Event ID 1002 — Finished processing Action Queue with status ErrorCode.

Provider
Microsoft-Windows-ActionQueue
Channel
Analytic
Task
ProcessActionQueue
Opcode
Stop

Description

Finished processing Action Queue with status ErrorCode.

Message #

Finished processing Action Queue with status %1.

Fields #

NameDescription
ErrorCode UInt32—

Event ID 2001 — Executing "ExecutableName" with arguments "Arguments" for component "Identity" in unattend pass "Pass".

Provider
Microsoft-Windows-ActionQueue
Channel
Analytic
Task
ExecuteCommand
Opcode
Start

Description

Executing "ExecutableName" with arguments "Arguments" for component "Identity" in unattend pass "Pass".

Message #

Executing "%1" with arguments "%2" for component "%3" in unattend pass "%4".

Fields #

NameDescription
ExecutableName AnsiString—
Arguments AnsiString—
Identity AnsiString—
Pass AnsiString—

Event ID 2002 — Command completed with status ErrorCode.

Provider
Microsoft-Windows-ActionQueue
Channel
Analytic
Task
ExecuteCommand
Opcode
Stop

Description

Command completed with status ErrorCode.

Message #

Command completed with status %1.

Fields #

NameDescription
ErrorCode UInt32—