Microsoft-Windows-Diagnosis-AdvancedTaskManager

134 events across 2 channels

Event	Title	Channel
5016	task_0	Operational
5017	task_05017	Operational
5018	task_05018	Operational
5100	ListUpdate	Operational
5101	ListUpdateInsert	Operational
5102	ListUpdateDelete	Operational
5103	task_05103	Operational
5200	PerfTrack_TM8_LaunchStart	Analytic
5201	PerfTrack_TM8_LaunchStop	Analytic
5202	PerfTrack_TM8_TabSwitchStart	Analytic
5203	PerfTrack_TM8_TabSwitchStop	Analytic
5204	PerfTrack_TM8_KillProcessStart	Analytic
5205	PerfTrack_TM8_KillProcessStop	Analytic
5301	TM8_Window_LaunchStart	Operational
5302	TM8_Window_LaunchStop	Operational
5303	Monitor_SetupStart	Operational
5304	Monitor_SetupStop	Operational
5351	Dashboard_SetupStart	Operational
5352	Dashboard_SetupStop	Operational
5353	Dashboard_Sidebar_InitStart	Operational
5354	Dashboard_Sidebar_InitStop	Operational
5355	Dashboard_Sidebar_CPU_InitStart	Operational
5356	Dashboard_Sidebar_CPU_InitStop	Operational
5357	Dashboard_Sidebar_Memory_InitStart	Operational
5358	Dashboard_Sidebar_Memory_InitStop	Operational
5359	Dashboard_Sidebar_Disk_InitStart	Operational
5360	Dashboard_Sidebar_Disk_InitStop	Operational
5361	Dashboard_Sidebar_Network_InitStart	Operational
5362	Dashboard_Sidebar_Network_InitStop	Operational
5363	Dashboard_LoadPageTemplateStart	Operational
5364	Dashboard_LoadPageTemplateStop	Operational
5365	Dashboard_CPUView_InitStart	Operational
5366	Dashboard_CPUView_InitStop	Operational
5367	Dashboard_MemoryView_InitStart	Operational
5368	Dashboard_MemoryView_InitStop	Operational
5369	Dashboard_DiskView_InitStart	Operational
5370	Dashboard_DiskView_InitStop	Operational
5371	Dashboard_NetworkView_InitStart	Operational
5372	Dashboard_NetworkView_InitStop	Operational
5373	Dashboard_RenderStart	Operational
5374	Dashboard_RenderStop	Operational
5375	Dashboard_SwitchResourceStart	Operational
5376	Dashboard_SwitchResourceStop	Operational
5379	Dashboard_Disk_EnumerateDisksStart	Operational
5380	Dashboard_Disk_EnumerateDisksStop	Operational
5381	Dashboard_Network_Adapter_EnumerateAdaptersStart	Operational
5382	Dashboard_Network_Adapter_EnumerateAdaptersStop	Operational
5383	Dashboard_Network_Adapter_RefreshAdaptersStart	Operational
5384	Dashboard_Network_Adapter_RefreshAdaptersStop	Operational
5385	Dashboard_Network_Adapter_WifiSetPropertiesStart	Operational
5386	Dashboard_Network_Adapter_WifiSetPropertiesStop	Operational
5387	Dashboard_Network_Adapter_WWanSetPropertiesStart	Operational
5388	Dashboard_Network_Adapter_WWanSetPropertiesStop	Operational
5389	Dashboard_ChangeSummaryViewStart	Operational
5390	Dashboard_ChangeSummaryViewStop	Operational
5391	Dashboard_TurnChartsOnOffStart	Operational
5392	Dashboard_TurnChartsOnOffStop	Operational
5393	Dashboard_AddDiskStart	Operational
5394	Dashboard_AddDiskStop	Operational
5395	Dashboard_RemoveDiskStart	Operational
5396	Dashboard_RemoveDiskStop	Operational
5397	Dashboard_AddAdapterStart	Operational
5398	Dashboard_AddAdapterStop	Operational
5399	Dashboard_RemoveAdapterStart	Operational
5400	Dashboard_RemoveAdapterStop	Operational
5401	Dashboard_DiskPerfIOCTLStart	Operational
5402	Dashboard_DiskPerfIOCTLStop	Operational
5403	Dashboard_ChartScaleChangedUpdate	Operational
5404	Dashboard_DiskLengthIOCTLStart	Operational
5405	Dashboard_DiskLengthIOCTLStop	Operational
5501	UI_RenderStart	Operational
5502	UI_RenderStop	Operational
5503	UI_DataSortStart	Operational
5504	UI_DataSortStop	Operational
5505	UI_ClickExpandoStart	Operational
5506	UI_ClickExpandoStop	Operational
5651	DataMonitor_AppInfo_UpdateStart	Operational
5652	DataMonitor_AppInfo_UpdateStop	Operational
5653	DataMonitor_WindowInfo_UpdateStart	Operational
5654	DataMonitor_WindowInfo_UpdateStop	Operational
5655	DataMonitor_AppServiceInfo_UpdateStart	Operational
5656	DataMonitor_AppServiceInfo_UpdateStop	Operational
5657	DataMonitor_TrayIconInfo_UpdateStart	Operational
5658	DataMonitor_TrayIconInfo_UpdateStop	Operational
5659	DataMonitor_UserInfo_UpdateStart	Operational
5660	DataMonitor_UserInfo_UpdateStop	Operational
6001	Actions_InvokeMenuStart	Operational
6002	Actions_InvokeMenuStop	Operational
6003	Actions_RightClickPopupStart	Operational
6004	Actions_RightClickPopupStop	Operational
6005	Actions_EndTask_ProcessStart	Operational
6006	Actions_EndTask_ProcessStop	Operational
6007	Actions_EndTask_WindowStart	Operational
6008	Actions_EndTask_WindowStop	Operational
6009	Actions_EndTask_ServiceStart	Operational
6010	Actions_EndTask_ServiceStop	Operational
6011	Actions_SortbyStart	Operational
6012	Actions_SortbyStop	Operational
6013	Actions_SortDUITreeStart	Operational
6014	Actions_SortDUITreeStop	Operational
6015	Actions_ColSwapStart	Operational
6016	Actions_ColSwapStop	Operational
6017	Actions_ColResizeStart	Operational
6018	Actions_ColResizeStop	Operational
6019	Actions_ChangeViewStart	Operational
6020	Actions_ChangeViewStop	Operational
6021	Monitor_ChangeViewStart	Operational
6022	Monitor_ChangeViewStop	Operational
6023	Actions_ConfirmCommandStart	Operational
6024	Actions_ConfirmCommandStop	Operational
6025	Actions_SwitchUser	Operational
6026	Actions_SendMessage	Operational
6027	Actions_LogoffUser	Operational
6028	Actions_DisconnectUser	Operational
7000	Startup_ImpactFile_ParseStart	Operational
7001	Startup_ImpactFile_ParseStop	Operational
7002	Startup_EnumerationStart	Operational
7003	Startup_EnumerationStop	Operational
7004	Startup_LoadItemsStart	Operational
7005	Startup_LoadItemsStop	Operational
7100	AppHistory_EnumerateInstalledAppsStart	Operational
7101	AppHistory_EnumerateInstalledAppsStop	Operational
7102	AppHistory_RegisterAndProcessStatsStart	Operational
7103	AppHistory_RegisterAndProcessStatsStop	Operational
7104	AppHistory_GetInterfaceCostStart	Operational
7105	AppHistory_GetInterfaceCostStop	Operational
7106	AppHistory_ParsePackageIconStart	Operational
7107	AppHistory_ParsePackageIconStop	Operational
7108	AppHistory_AddImmersiveApplicationStart	Operational
7109	AppHistory_AddImmersiveApplicationStop	Operational
7110	AppHistory_AddDesktopApplicationStart	Operational
7111	AppHistory_AddDesktopApplicationStop	Operational
7112	AppHistory_ProcessSrumRecordSetStart	Operational
7113	AppHistory_ProcessSrumRecordSetStop	Operational

Event ID 5016: task_0

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer

Event ID 5017: task_05017

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer

Event ID 5018: task_05018

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Line` UInt32
`Address` Pointer
`Size` Pointer
`OrigAddress` Pointer

Event ID 5100: ListUpdate

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Update

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5101: ListUpdateInsert

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Insert

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5102: ListUpdateDelete

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: ListUpdate
Opcode: Delete

Fields #

Name	Description
`TableId` UInt32
`ItemPos` UInt32
`ItemState` UInt32
`ItemContent` UnicodeString

Event ID 5103: task_05103

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Opcode: Info

Fields #

Name	Description
`FileName` AnsiString
`Function` AnsiString
`Line` UInt32
`ErrorText` UnicodeString

Event ID 5200: PerfTrack_TM8_LaunchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Start

Event ID 5201: PerfTrack_TM8_LaunchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_Launch
Opcode: Stop

Event ID 5202: PerfTrack_TM8_TabSwitchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5203: PerfTrack_TM8_TabSwitchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_TabSwitch
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5204: PerfTrack_TM8_KillProcessStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Start

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5205: PerfTrack_TM8_KillProcessStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Analytic
Task: PerfTrack_TM8_KillProcess
Opcode: Stop

Fields #

Name	Description
`ProcessOrPackageName` UnicodeString
`Version` UnicodeString
`TimeDateStamp` UInt32
`ProcessId` UInt32

Event ID 5301: TM8_Window_LaunchStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: TM8_Window_Launch
Opcode: Start

Event ID 5302: TM8_Window_LaunchStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: TM8_Window_Launch
Opcode: Stop

Event ID 5303: Monitor_SetupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_Setup
Opcode: Start

Event ID 5304: Monitor_SetupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_Setup
Opcode: Stop

Event ID 5351: Dashboard_SetupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Setup
Opcode: Start

Event ID 5352: Dashboard_SetupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Setup
Opcode: Stop

Event ID 5353: Dashboard_Sidebar_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Start

Event ID 5354: Dashboard_Sidebar_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Init
Opcode: Stop

Event ID 5355: Dashboard_Sidebar_CPU_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Start

Event ID 5356: Dashboard_Sidebar_CPU_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_CPU_Init
Opcode: Stop

Event ID 5357: Dashboard_Sidebar_Memory_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Start

Event ID 5358: Dashboard_Sidebar_Memory_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Memory_Init
Opcode: Stop

Event ID 5359: Dashboard_Sidebar_Disk_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Start

Event ID 5360: Dashboard_Sidebar_Disk_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Disk_Init
Opcode: Stop

Event ID 5361: Dashboard_Sidebar_Network_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Start

Event ID 5362: Dashboard_Sidebar_Network_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Sidebar_Network_Init
Opcode: Stop

Event ID 5363: Dashboard_LoadPageTemplateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5364: Dashboard_LoadPageTemplateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_LoadPageTemplate
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5365: Dashboard_CPUView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Start

Event ID 5366: Dashboard_CPUView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_CPUView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`ProcessorCoreCount` UInt32
`LogicalProcessorCount` UInt32
`NumaNodeCount` UInt32
`MaxCPUSpeed` UnicodeString
`CurrentCPUSpeed` UnicodeString
`Virtualization` UnicodeString

Event ID 5367: Dashboard_MemoryView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Start

Event ID 5368: Dashboard_MemoryView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_MemoryView_Init
Opcode: Stop

Fields #

Name	Description
`ResourceName` UnicodeString
`MemorySpeed` UnicodeString
`SlotsUsed` UnicodeString
`AvailableMemory` UnicodeString
`CachedMemory` UnicodeString
`CommittedMemory` UnicodeString

Event ID 5369: Dashboard_DiskView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Start

Event ID 5370: Dashboard_DiskView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskView_Init
Opcode: Stop

Event ID 5371: Dashboard_NetworkView_InitStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Start

Event ID 5372: Dashboard_NetworkView_InitStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_NetworkView_Init
Opcode: Stop

Event ID 5373: Dashboard_RenderStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Render
Opcode: Start

Fields #

Name	Description
`PageId` UInt32

Event ID 5374: Dashboard_RenderStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Render
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5375: Dashboard_SwitchResourceStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Start

Event ID 5376: Dashboard_SwitchResourceStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_SwitchResource
Opcode: Stop

Fields #

Name	Description
`OldPageId` UInt32
`NewPageId` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5376
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5376

Event ID 5379: Dashboard_Disk_EnumerateDisksStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Start

Event ID 5380: Dashboard_Disk_EnumerateDisksStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Disk_EnumerateDisks
Opcode: Stop

Fields #

Name	Description
`DiskCount` UInt32

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5380

Event ID 5381: Dashboard_Network_Adapter_EnumerateAdaptersStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Start

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5381

Event ID 5382: Dashboard_Network_Adapter_EnumerateAdaptersStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_EnumerateAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5383: Dashboard_Network_Adapter_RefreshAdaptersStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Start

Event ID 5384: Dashboard_Network_Adapter_RefreshAdaptersStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_RefreshAdapters
Opcode: Stop

Fields #

Name	Description
`AdapterCount` UInt32

Event ID 5385: Dashboard_Network_Adapter_WifiSetPropertiesStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Start

Event ID 5386: Dashboard_Network_Adapter_WifiSetPropertiesStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WifiSetProperties
Opcode: Stop

Fields #

Name	Description
`SSID` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5387: Dashboard_Network_Adapter_WWanSetPropertiesStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Start

Event ID 5388: Dashboard_Network_Adapter_WWanSetPropertiesStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_Network_Adapter_WWanSetProperties
Opcode: Stop

Fields #

Name	Description
`ServiceProvider` UnicodeString
`PhysicalNetworkType` UnicodeString
`SignalQuality` UInt32

Event ID 5389: Dashboard_ChangeSummaryViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Start

Fields #

Name	Description
`Snap` UInt32
`CurrentView` UInt32

Event ID 5390: Dashboard_ChangeSummaryViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChangeSummaryView
Opcode: Stop

Event ID 5391: Dashboard_TurnChartsOnOffStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Start

Fields #

Name	Description
`ChartsOn` UInt32
`CurrentView` UInt32

Event ID 5392: Dashboard_TurnChartsOnOffStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_TurnChartsOnOff
Opcode: Stop

Event ID 5393: Dashboard_AddDiskStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5394: Dashboard_AddDiskStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddDisk
Opcode: Stop

Event ID 5395: Dashboard_RemoveDiskStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5396: Dashboard_RemoveDiskStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveDisk
Opcode: Stop

Event ID 5397: Dashboard_AddAdapterStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5398: Dashboard_AddAdapterStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_AddAdapter
Opcode: Stop

Event ID 5399: Dashboard_RemoveAdapterStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Start

Fields #

Name	Description
`OldCount` UInt32
`NewCount` UInt32

Event ID 5400: Dashboard_RemoveAdapterStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_RemoveAdapter
Opcode: Stop

Event ID 5401: Dashboard_DiskPerfIOCTLStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5402: Dashboard_DiskPerfIOCTLStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskPerfIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32

Event ID 5403: Dashboard_ChartScaleChangedUpdate

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_ChartScaleChanged
Opcode: Update

Fields #

Name	Description
`ChartId` UnicodeString
`FromScaleIndex` UInt32
`FromScaleString` UnicodeString
`ToScaleIndex` UInt32
`ToScaleString` UnicodeString

Event ID 5404: Dashboard_DiskLengthIOCTLStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Start

Fields #

Name	Description
`DiskNumber` UInt32

Event ID 5405: Dashboard_DiskLengthIOCTLStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Dashboard_DiskLengthIOCTL
Opcode: Stop

Fields #

Name	Description
`Hresult` UInt32
`QueryByteReturned` UInt32
`LengthInByte` UInt64

Event ID 5501: UI_RenderStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_Render
Opcode: Start

Fields #

Name	Description
`TabId` UInt32

Event ID 5502: UI_RenderStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_Render
Opcode: Stop

Fields #

Name	Description
`TabId` UInt32

Event ID 5503: UI_DataSortStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_DataSort
Opcode: Start

Event ID 5504: UI_DataSortStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_DataSort
Opcode: Stop

Fields #

Name	Description
`PageId` UInt32

Event ID 5505: UI_ClickExpandoStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_ClickExpando
Opcode: Start

Event ID 5506: UI_ClickExpandoStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: UI_ClickExpando
Opcode: Stop

Event ID 5651: DataMonitor_AppInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Start

Event ID 5652: DataMonitor_AppInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5653: DataMonitor_WindowInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Start

Event ID 5654: DataMonitor_WindowInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_WindowInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5655: DataMonitor_AppServiceInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Start

Event ID 5656: DataMonitor_AppServiceInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_AppServiceInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5657: DataMonitor_TrayIconInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Start

Event ID 5658: DataMonitor_TrayIconInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_TrayIconInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 5659: DataMonitor_UserInfo_UpdateStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Start

Event ID 5660: DataMonitor_UserInfo_UpdateStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: DataMonitor_UserInfo_Update
Opcode: Stop

Fields #

Name	Description
`NewItems` UInt32
`UpdatedItems` UInt32

Event ID 6001: Actions_InvokeMenuStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_InvokeMenu
Opcode: Start

Event ID 6002: Actions_InvokeMenuStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_InvokeMenu
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64
`MenuId` UInt32

Event ID 6003: Actions_RightClickPopupStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_RightClickPopup
Opcode: Start

Event ID 6004: Actions_RightClickPopupStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_RightClickPopup
Opcode: Stop

Fields #

Name	Description
`ItemType` UInt64

Event ID 6005: Actions_EndTask_ProcessStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Process
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6006: Actions_EndTask_ProcessStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Process
Opcode: Stop

Fields #

Name	Description
`ProcessId` UInt32

Event ID 6007: Actions_EndTask_WindowStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Window
Opcode: Start

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6008: Actions_EndTask_WindowStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Window
Opcode: Stop

Fields #

Name	Description
`WindowHandle` UInt32

Event ID 6009: Actions_EndTask_ServiceStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Service
Opcode: Start

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6010: Actions_EndTask_ServiceStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_EndTask_Service
Opcode: Stop

Fields #

Name	Description
`ServiceName` UnicodeString

Event ID 6011: Actions_SortbyStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_Sortby
Opcode: Start

Event ID 6012: Actions_SortbyStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_Sortby
Opcode: Stop

Event ID 6013: Actions_SortDUITreeStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SortDUITree
Opcode: Start

Event ID 6014: Actions_SortDUITreeStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SortDUITree
Opcode: Stop

Event ID 6015: Actions_ColSwapStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColSwap
Opcode: Start

Event ID 6016: Actions_ColSwapStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColSwap
Opcode: Stop

Event ID 6017: Actions_ColResizeStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColResize
Opcode: Start

Event ID 6018: Actions_ColResizeStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ColResize
Opcode: Stop

Event ID 6019: Actions_ChangeViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6020: Actions_ChangeViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ChangeView
Opcode: Stop

Event ID 6021: Monitor_ChangeViewStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_ChangeView
Opcode: Start

Fields #

Name	Description
`FromTab` UInt32
`ToTab` UInt32

Event ID 6022: Monitor_ChangeViewStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Monitor_ChangeView
Opcode: Stop

Event ID 6023: Actions_ConfirmCommandStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Start

Fields #

Name	Description
`CommandId` UInt32

Event ID 6024: Actions_ConfirmCommandStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_ConfirmCommand
Opcode: Stop

Event ID 6025: Actions_SwitchUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SwitchUser

Event ID 6026: Actions_SendMessage

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_SendMessage

Event ID 6027: Actions_LogoffUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_LogoffUser

Event ID 6028: Actions_DisconnectUser

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Actions_DisconnectUser

Event ID 7000: Startup_ImpactFile_ParseStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Start

Event ID 7001: Startup_ImpactFile_ParseStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_ImpactFile_Parse
Opcode: Stop

Fields #

Name	Description
`CountOfItemsInStartupXML` UInt32

Event ID 7002: Startup_EnumerationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_Enumeration
Opcode: Start

Event ID 7003: Startup_EnumerationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_Enumeration
Opcode: Stop

Event ID 7004: Startup_LoadItemsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_LoadItems
Opcode: Start

Event ID 7005: Startup_LoadItemsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: Startup_LoadItems
Opcode: Stop

Event ID 7100: AppHistory_EnumerateInstalledAppsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Start

Event ID 7101: AppHistory_EnumerateInstalledAppsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_EnumerateInstalledApps
Opcode: Stop

Event ID 7102: AppHistory_RegisterAndProcessStatsStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7103: AppHistory_RegisterAndProcessStatsStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_RegisterAndProcessStats
Opcode: Stop

Fields #

Name	Description
`SrumProvider` UInt32

Event ID 7104: AppHistory_GetInterfaceCostStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Start

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7105: AppHistory_GetInterfaceCostStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_GetInterfaceCost
Opcode: Stop

Fields #

Name	Description
`InterfaceLUID` UInt64
`ProfileIndex` UInt32

Event ID 7106: AppHistory_ParsePackageIconStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Start

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7107: AppHistory_ParsePackageIconStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ParsePackageIcon
Opcode: Stop

Fields #

Name	Description
`PackageInstallPath` UnicodeString

Event ID 7108: AppHistory_AddImmersiveApplicationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Start

Event ID 7109: AppHistory_AddImmersiveApplicationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddImmersiveApplication
Opcode: Stop

Fields #

Name	Description
`PackageName` UnicodeString
`LongDisplayName` UnicodeString

Event ID 7110: AppHistory_AddDesktopApplicationStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Start

Event ID 7111: AppHistory_AddDesktopApplicationStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_AddDesktopApplication
Opcode: Stop

Fields #

Name	Description
`ExePath` UnicodeString

Event ID 7112: AppHistory_ProcessSrumRecordSetStart

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Start

Fields #

Name	Description
`SrumProvider` UInt32
`SrumRecordSetCount` UInt64

Event ID 7113: AppHistory_ProcessSrumRecordSetStop

Provider: Microsoft-Windows-Diagnosis-AdvancedTaskManager
Channel: Operational
Task: AppHistory_ProcessSrumRecordSet
Opcode: Stop

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 178dadaf-7ac4-4593-ab3e-a45fda6d0d55

Defined in Taskmgr.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)