Microsoft-Windows-ClusterAwareUpdating-Management

46 events across 2 channels

Event	Title	Channel
1001	Cluster updating has exceeded the warning timeout of timeoutValue.	Admin
1001	Event ID 1001	Operational
1002	Cluster updating has exceeded the StopAfter timeout of timeoutValue.	Admin
1002	Event ID 1002	Operational
1003	Starting CAU run runIdentifier on cluster clusterName.	Admin
1003	Event ID 1003	Operational
1004	CAU run runIdentifier on cluster clusterName completed successfully.	Admin
1004	Event ID 1004	Operational
1005	CAU run runIdentifier on cluster clusterName was canceled.	Admin
1005	Event ID 1005	Operational
1006	CAU run runIdentifier on cluster clusterName failed partially.	Admin
1006	Event ID 1006	Operational
1007	CAU run runIdentifier on cluster clusterName failed.	Admin
1007	Event ID 1007	Operational
1008	Node clusterNodeName entered node maintenance mode.	Admin
1008	Event ID 1008	Operational
1009	Node clusterNodeName exited node maintenance mode.	Admin
1009	Event ID 1009	Operational
1010	Rebooting node clusterNodeName.	Admin
1010	Event ID 1010	Operational
1011	Node clusterNodeName has rebooted successfully.	Admin
1011	Event ID 1011	Operational
1012	Failed to reboot node clusterNodeName.	Admin
1012	Event ID 1012	Operational
1013	CAU run failed on node clusterNodeName.	Admin
1013	Event ID 1013	Operational
1014	Recovering the cluster clusterName from previous CAU run.	Admin
1014	Event ID 1014	Operational
1015	Failed to acquire lock on node clusterNodeName.	Admin
1015	Event ID 1015	Operational
1016	Failed to put node clusterNodeName in node maintenance mode.	Admin
1016	Event ID 1016	Operational
1017	Failed to resume node clusterNodeName from node maintenance mode.	Admin
1017	Event ID 1017	Operational
1018	Canceling CAU run as rebooting node clusterNodeName will compromise cluster …	Admin
1018	Event ID 1018	Operational
1019	Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.	Admin
1019	Event ID 1019	Operational
1020	Canceling CAU run as all nodes are required to be online.	Admin
1020	Event ID 1020	Operational
1021	User canceled CAU run runIdentifier on cluster clusterName.	Admin
1021	Event ID 1021	Operational
1022	Failed to save CAU report.	Admin
1022	Event ID 1022	Operational
1023	Failed to get CAU report.	Admin
1023	Event ID 1023	Operational

Event ID 1001: Cluster updating has exceeded the warning timeout of timeoutValue.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the warning timeout of timeoutValue.

Message #

Cluster updating has exceeded the warning timeout of %1.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1001:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the warning timeout of .

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002: Cluster updating has exceeded the StopAfter timeout of timeoutValue.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of timeoutValue. Stopping updating run.

Message #

Cluster updating has exceeded the StopAfter timeout of %1. Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of . Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1003: Starting CAU run runIdentifier on cluster clusterName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Starting CAU run runIdentifier on cluster clusterName.

Message #

Starting CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1003:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Starting CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004: CAU run runIdentifier on cluster clusterName completed successfully.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName completed successfully.

Message #

CAU run %1 on cluster %2 completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005: CAU run runIdentifier on cluster clusterName was canceled.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName was canceled.

Message #

CAU run %1 on cluster %2 was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006: CAU run runIdentifier on cluster clusterName failed partially.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName failed partially.

Message #

CAU run %1 on cluster %2 failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1007: CAU run runIdentifier on cluster clusterName failed.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName failed. Error Message:errorMessage Error Code:errorCode Stack:stackTrace.

Message #

CAU run %1 on cluster %2 failed. Error Message:%3 Error Code:%4 Stack:%5

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1007:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed. Error Message: Error Code: Stack.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1008: Node clusterNodeName entered node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName entered node maintenance mode.

Message #

Node %1 entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1008:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009: Node clusterNodeName exited node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName exited node maintenance mode.

Message #

Node %1 exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010: Rebooting node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Rebooting node clusterNodeName.

Message #

Rebooting node %1.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Rebooting node .

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011: Node clusterNodeName has rebooted successfully.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName has rebooted successfully.

Message #

Node %1 has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1012: Failed to reboot node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to reboot node clusterNodeName. Details: errorMessage.

Message #

Failed to reboot node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1012:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to reboot node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013: CAU run failed on node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run failed on node clusterNodeName. Details: errorMessage.

Message #

CAU run failed on node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run failed on node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1014: Recovering the cluster clusterName from previous CAU run.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Recovering the cluster clusterName from previous CAU run.

Message #

Recovering the cluster %1 from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1014:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Recovering the cluster from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1015: Failed to acquire lock on node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to acquire lock on node clusterNodeName. This could be due to a different instance of orchestrator that owns the lock on this node.

Message #

Failed to acquire lock on node %1. This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1015:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to acquire lock on node . This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1016: Failed to put node clusterNodeName in node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to put node clusterNodeName in node maintenance mode. Details: errorMessage.

Message #

Failed to put node %1 in node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1016:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to put node in node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017: Failed to resume node clusterNodeName from node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to resume node clusterNodeName from node maintenance mode. Details: errorMessage.

Message #

Failed to resume node %1 from node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to resume node from node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1018: Canceling CAU run as rebooting node clusterNodeName will compromise cluster quorum.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as rebooting node clusterNodeName will compromise cluster quorum.

Message #

Canceling CAU run as rebooting node %1 will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1018:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as rebooting node will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1019: Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.

Message #

Canceling CAU run as patching failed on %1 (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1019:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as patching failed on (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020: Canceling CAU run as all nodes are required to be online.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodeCount nodes are currently offline.

Message #

Canceling CAU run as all nodes are required to be online. %1 nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1021: User canceled CAU run runIdentifier on cluster clusterName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

User canceled CAU run runIdentifier on cluster clusterName.

Message #

User canceled CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1021:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

User canceled CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1022: Failed to save CAU report.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: Reports

Description

Failed to save CAU report. Details:errorMessage.

Message #

Failed to save CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1022:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: Reports

Description

Failed to save CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023: Failed to get CAU report.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: Reports

Description

Failed to get CAU report. Details:errorMessage.

Message #

Failed to get CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023:

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: Reports

Description

Failed to get CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9b9e93d6-5569-4179-8c8a-5201cb2b9536

Defined in ClusterAwareUpdatingNative.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-ClusterAwareUpdating-Management registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)