Microsoft-Windows-Diagnosis-AdvancedTaskManager

134 events across 2 channels

Event ID	Title	Channel
5016		Operational
5017		Operational
5018		Operational
5100		Operational
5101		Operational
5102		Operational
5103		Operational
5200		Analytic
5201		Analytic
5202		Analytic
5203		Analytic
5204		Analytic
5205		Analytic
5301		Operational
5302		Operational
5303		Operational
5304		Operational
5351		Operational
5352		Operational
5353		Operational
5354		Operational
5355		Operational
5356		Operational
5357		Operational
5358		Operational
5359		Operational
5360		Operational
5361		Operational
5362		Operational
5363		Operational
5364		Operational
5365		Operational
5366		Operational
5367		Operational
5368		Operational
5369		Operational
5370		Operational
5371		Operational
5372		Operational
5373		Operational
5374		Operational
5375		Operational
5376		Operational
5379		Operational
5380		Operational
5381		Operational
5382		Operational
5383		Operational
5384		Operational
5385		Operational
5386		Operational
5387		Operational
5388		Operational
5389		Operational
5390		Operational
5391		Operational
5392		Operational
5393		Operational
5394		Operational
5395		Operational
5396		Operational
5397		Operational
5398		Operational
5399		Operational
5400		Operational
5401		Operational
5402		Operational
5403		Operational
5404		Operational
5405		Operational
5501		Operational
5502		Operational
5503		Operational
5504		Operational
5505		Operational
5506		Operational
5651		Operational
5652		Operational
5653		Operational
5654		Operational
5655		Operational
5656		Operational
5657		Operational
5658		Operational
5659		Operational
5660		Operational
6001		Operational
6002		Operational
6003		Operational
6004		Operational
6005		Operational
6006		Operational
6007		Operational
6008		Operational
6009		Operational
6010		Operational
6011		Operational
6012		Operational
6013		Operational
6014		Operational
6015		Operational
6016		Operational
6017		Operational
6018		Operational
6019		Operational
6020		Operational
6021		Operational
6022		Operational
6023		Operational
6024		Operational
6025		Operational
6026		Operational
6027		Operational
6028		Operational
7000		Operational
7001		Operational
7002		Operational
7003		Operational
7004		Operational
7005		Operational
7100		Operational
7101		Operational
7102		Operational
7103		Operational
7104		Operational
7105		Operational
7106		Operational
7107		Operational
7108		Operational
7109		Operational
7110		Operational
7111		Operational
7112		Operational
7113		Operational

Event ID 5016 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FileName`	—
`Line`	—
`Address`	—
`Size`	—

Event ID 5017 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FileName`	—
`Line`	—
`Address`	—

Event ID 5018 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FileName`	—
`Line`	—
`Address`	—
`Size`	—
`OrigAddress`	—

Event ID 5100 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`TableId`	—
`ItemPos`	—
`ItemState`	—
`ItemContent`	—

Event ID 5101 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`TableId`	—
`ItemPos`	—
`ItemState`	—
`ItemContent`	—

Event ID 5102 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`TableId`	—
`ItemPos`	—
`ItemState`	—
`ItemContent`	—

Event ID 5103 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FileName`	—
`Function`	—
`Line`	—
`ErrorText`	—

Event ID 5200 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Event ID 5201 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Event ID 5202 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Fields

Name	Description
`TabId`	—

Event ID 5203 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Fields

Name	Description
`TabId`	—

Event ID 5204 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Fields

Name	Description
`ProcessOrPackageName`	—
`Version`	—
`TimeDateStamp`	—
`ProcessId`	—

Event ID 5205 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic

Fields

Name	Description
`ProcessOrPackageName`	—
`Version`	—
`TimeDateStamp`	—
`ProcessId`	—

Event ID 5301 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5302 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5303 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5304 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5351 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5352 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5353 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5354 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5355 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5356 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5357 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5358 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5359 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5360 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5361 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5362 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5363 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PageId`	—

Event ID 5364 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PageId`	—

Event ID 5365 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5366 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ResourceName`	—
`ProcessorCoreCount`	—
`LogicalProcessorCount`	—
`NumaNodeCount`	—
`MaxCPUSpeed`	—
`CurrentCPUSpeed`	—
`Virtualization`	—

Event ID 5367 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5368 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ResourceName`	—
`MemorySpeed`	—
`SlotsUsed`	—
`AvailableMemory`	—
`CachedMemory`	—
`CommittedMemory`	—

Event ID 5369 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5370 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5371 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5372 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5373 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PageId`	—

Event ID 5374 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PageId`	—

Event ID 5375 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5376 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`OldPageId`	—
`NewPageId`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5376
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5376

Event ID 5379 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5380 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`DiskCount`	—

References

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5380

Event ID 5381 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

References

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5381

Event ID 5382 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`AdapterCount`	—

Event ID 5383 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5384 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`AdapterCount`	—

Event ID 5385 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5386 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`SSID`	—
`PhysicalNetworkType`	—
`SignalQuality`	—

Event ID 5387 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5388 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ServiceProvider`	—
`PhysicalNetworkType`	—
`SignalQuality`	—

Event ID 5389 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`Snap`	—
`CurrentView`	—

Event ID 5390 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5391 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ChartsOn`	—
`CurrentView`	—

Event ID 5392 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5393 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`OldCount`	—
`NewCount`	—

Event ID 5394 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5395 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`OldCount`	—
`NewCount`	—

Event ID 5396 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5397 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`OldCount`	—
`NewCount`	—

Event ID 5398 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5399 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`OldCount`	—
`NewCount`	—

Event ID 5400 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5401 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`DiskNumber`	—

Event ID 5402 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`Hresult`	—
`QueryByteReturned`	—

Event ID 5403 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ChartId`	—
`FromScaleIndex`	—
`FromScaleString`	—
`ToScaleIndex`	—
`ToScaleString`	—

Event ID 5404 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`DiskNumber`	—

Event ID 5405 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`Hresult`	—
`QueryByteReturned`	—
`LengthInByte`	—

Event ID 5501 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`TabId`	—

Event ID 5502 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`TabId`	—

Event ID 5503 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5504 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PageId`	—

Event ID 5505 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5506 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5651 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5652 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`NewItems`	—
`UpdatedItems`	—

Event ID 5653 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5654 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`NewItems`	—
`UpdatedItems`	—

Event ID 5655 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5656 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`NewItems`	—
`UpdatedItems`	—

Event ID 5657 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5658 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`NewItems`	—
`UpdatedItems`	—

Event ID 5659 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 5660 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`NewItems`	—
`UpdatedItems`	—

Event ID 6001 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6002 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ItemType`	—
`MenuId`	—

Event ID 6003 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6004 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ItemType`	—

Event ID 6005 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ProcessId`	—

Event ID 6006 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ProcessId`	—

Event ID 6007 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`WindowHandle`	—

Event ID 6008 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`WindowHandle`	—

Event ID 6009 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ServiceName`	—

Event ID 6010 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ServiceName`	—

Event ID 6011 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6012 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6013 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6014 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6015 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6016 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6017 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6018 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6019 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FromTab`	—
`ToTab`	—

Event ID 6020 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6021 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`FromTab`	—
`ToTab`	—

Event ID 6022 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6023 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`CommandId`	—

Event ID 6024 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6025 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6026 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6027 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 6028 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7000 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7001 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`CountOfItemsInStartupXML`	—

Event ID 7002 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7003 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7004 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7005 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7100 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7101 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7102 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`SrumProvider`	—

Event ID 7103 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`SrumProvider`	—

Event ID 7104 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`InterfaceLUID`	—
`ProfileIndex`	—

Event ID 7105 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`InterfaceLUID`	—
`ProfileIndex`	—

Event ID 7106 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PackageInstallPath`	—

Event ID 7107 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PackageInstallPath`	—

Event ID 7108 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7109 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`PackageName`	—
`LongDisplayName`	—

Event ID 7110 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Event ID 7111 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`ExePath`	—

Event ID 7112 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational

Fields

Name	Description
`SrumProvider`	—
`SrumRecordSetCount`	—

Event ID 7113 —

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational