Microsoft-Windows-Diagnosis-PCW
20 events across 3 channels
Event ID 1: Provider ProviderGuid failed to register.
#Event ID 2: Provider ProviderGuid failed to register counter set CounterSetGuid.
#Description
Provider ProviderGuid failed to register counter set CounterSetGuid. Error: "Error".
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 | |
ProviderGuid GUID | |
CounterSetGuid GUID |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Diagnosis-PCW",
"event_id": 2,
"level": 0,
"task": 0,
"opcode": 0,
"time_created": "2026-05-18T04:38:25.8277283+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Microsoft-Windows-Diagnosis-PCW"
},
"event_data": {
"ProviderGuid": "{1568ac8e-ff96-4107-926f-4499baaf5110}",
"Error": "5",
"CounterSetGuid": "{9d7d6cb7-9b25-4bf4-b2c6-c502e401d12d}"
}
}
Event ID 3: Instance (CounterSetGuid, InstanceName, InstanceId) could not be created.
#Description
Instance (CounterSetGuid, InstanceName, InstanceId) could not be created. Error: "Error".
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 | |
CounterSetGuid GUID | |
InstanceName UnicodeString | |
InstanceId UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Diagnosis-PCW",
"guid": "AABF8B86-7936-4FA2-ACB0-63127F879DBF",
"event_source_name": "",
"event_id": 3,
"version": 0,
"level": 0,
"task": 0,
"opcode": 0,
"keywords": 9223372036854777856,
"time_created": "2026-03-13T20:26:07.358863+00:00",
"event_record_id": 2245,
"correlation": {
"ActivityID": "010930CA-58CC-4D55-AD7E-3768B763C942"
},
"execution": {
"process_id": 1840,
"thread_id": 4820
},
"channel": "Microsoft-Windows-Diagnosis-PCW/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Error": 183,
"CounterSetGuid": "90C3888A-474E-4932-9925-ED1DC6731F36",
"InstanceName": "D66F4153-89DD-4D11-8753-19E1BF9370ED configuration file",
"InstanceId": 0
},
"message": ""
}
Event ID 4: About to call provider ProviderGuid callback with arguments (CallbackReason, MachineName, MachineNameSize).
#Event ID 5: Callback returned.
#Description
Callback returned. Return value: "Status".
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
Event ID 6: Provider ProviderGuid received an invalid notification with size Size.
#Event ID 7: Provider ProviderGuid received notification: RequestCode.
#Event ID 8: Provider ProviderGuid notification handler has replied with size Size and error code "Status".
#Description
Provider ProviderGuid notification handler has replied with size Size and error code "Status".
Message #
Fields #
| Name | Description |
|---|---|
ProviderGuid GUID | |
Status UInt32 | NTSTATUS reference |
Size UInt32 |
Event ID 9: Notification returning with status: "Status".
#Description
Notification returning with status: "Status".
Message #
Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
Event ID 13: Query of provider ProviderGuid with id Id had data collected.
#Event ID 16: Counter CounterId of instance (CounterSetGuid, InstanceName, InstanceId) could not be modified.
#Description
Counter CounterId of instance (CounterSetGuid, InstanceName, InstanceId) could not be modified. Error: "Error".
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 | |
CounterSetGuid GUID | |
InstanceName UnicodeString | |
InstanceId UInt32 | |
CounterId UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Diagnosis-PCW",
"guid": "AABF8B86-7936-4FA2-ACB0-63127F879DBF",
"event_source_name": "",
"event_id": 16,
"version": 0,
"level": 0,
"task": 0,
"opcode": 0,
"keywords": 9223372036854777856,
"time_created": "2022-04-07T08:15:12.584665+00:00",
"event_record_id": 352,
"correlation": {},
"execution": {
"process_id": 1300,
"thread_id": 1856
},
"channel": "Microsoft-Windows-Diagnosis-PCW/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"Error": 1168,
"CounterSetGuid": "40E6824E-1B9B-4329-9A6E-E94C8FB03A3F",
"InstanceName": "_Default",
"InstanceId": 0,
"CounterId": 84
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 17: Provider ProviderGuid failed to unregister.
#Event ID 18: Instance (CounterSetGuid, InstanceName, InstanceId) could not be closed.
#Event ID 19: Instance (CounterSetGuid, InstanceName, InstanceId) could not be queried.
#Event ID 20: Unable to load pcw.
#Event ID 21: Kernel-mode provider failed to register counter set CounterSetName.
#Event ID 22: Kernel-mode provider failed to create instance InstanceName of counter set CounterSetName.
#Event ID 23: Kernel-mode provider failed to add instance InstanceName of counter set CounterSetName.
#Event ID 24: PCW driver failed when executing ioctl function FunctionIndex.
#Event ID 25: PCW device missing during registration of counter set CounterSetGuid of provider ProviderGuid.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {AABF8B86-7936-4FA2-ACB0-63127F879DBF}
Defined in pcwum.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584 · sample captured from a live trace · binary version 10.0.26100.1 · captured 2026-06-02
- WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
- Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02
Downloads
- Microsoft-Windows-Diagnosis-PCW registered manifest XML (WS2022-20348.4893) manifest-xml
- Microsoft-Windows-Diagnosis-PCW registered manifest XML (Win11-26200.6584) manifest-xml