Microsoft-Windows-Dism-Api

86 events across 2 channels

Event	Title	Channel
1	DismInitializeStart	Analytic
2	DismInitializeStop	Analytic
3	DismShutdown	Analytic
4	DismShutdown	Analytic
5	DismOpenSessionStart	Analytic
6	DismOpenSession	Analytic
7	DismCloseSession	Analytic
8	DismCloseSession	Analytic
9	DismMountImageStart	Analytic
10	DismMountImageStop	Analytic
11	DismUnmountImageStart	Analytic
12	DismUnmountImageStop	Analytic
13	EnqueueCommandObject	InternalAnalytic
14	EnqueueCommandObject	InternalAnalytic
15	DequeueCommandObject	InternalAnalytic
16	DequeueCommandObject	InternalAnalytic
23	DismSetFirstBootCommandLineStart	Analytic
24	DismSetFirstBootCommandLineStop	Analytic
25	DismRemountImageStart	Analytic
26	DismRemountImageStop	Analytic
27	DismCommitImageStart	Analytic
28	DismCommitImageStop	Analytic
29	DismGetImageInfoStart	Analytic
30	DismGetImageInfoStop	Analytic
31	DismGetMountedImageInfoStart	Analytic
32	DismGetMountedImageInfoStop	Analytic
33	DismCleanupMountpointsStart	Analytic
34	DismCleanupMountpointsStop	Analytic
35	DismAddPackageStart	Analytic
36	DismAddPackageStop	Analytic
37	DismRemovePackageStart	Analytic
38	DismRemovePackageStop	Analytic
39	DismEnableFeatureStart	Analytic
40	DismEnableFeatureStop	Analytic
41	DismDisableFeatureStart	Analytic
42	DismDisableFeatureStop	Analytic
43	DismGetPackagesStart	Analytic
44	DismGetPackagesStop	Analytic
45	DismGetPackageInfoStart	Analytic
46	DismGetPackageInfoStop	Analytic
47	DismGetFeaturesStart	Analytic
48	DismGetFeaturesStop	Analytic
49	DismGetFeatureInfoStart	Analytic
50	DismGetFeatureInfoStop	Analytic
51	DismGetFeatureParentStart	Analytic
52	DismGetFeatureParentStop	Analytic
53	DismApplyUnattendStart	Analytic
54	DismApplyUnattendStop	Analytic
55	DismAddDriverStart	Analytic
56	DismAddDriverStop	Analytic
57	DismRemoveDriverStart	Analytic
58	DismRemoveDriverStop	Analytic
59	DismGetDriversStart	Analytic
60	DismGetDriversStop	Analytic
61	DismGetDriverInfoStart	Analytic
62	DismGetDriverInfoStop	Analytic
63	DismCheckImageHealthStart	Analytic
64	DismCheckImageHealthStop	Analytic
65	DismRestoreImageHealthStart	Analytic
66	DismRestoreImageHealthStop	Analytic
67	DismSetEditionStart	Analytic
68	DismSetEditionStop	Analytic
69	DismSetProductKeyStart	Analytic
70	DismSetProductKeyStop	Analytic
71	DismGetCurrentEditionStart	Analytic
72	DismGetCurrentEditionStop	Analytic
73	DismGetTargetEditionsStart	Analytic
74	DismGetTargetEditionsStop	Analytic
75	DismGetFeaturesExStart	Analytic
76	DismGetFeaturesExStop	Analytic
77	DismAddProvisionedAppxPackageStart	Analytic
78	DismAddProvisionedAppxPackageStop	Analytic
79	DismRemoveProvisionedAppxPackageStart	Analytic
80	DismRemoveProvisionedAppxPackageStop	Analytic
81	DismGetProvisionedAppxPackages	Analytic
82	DismGetProvisionedAppxPackages	Analytic
83	DismExportDriverStart	Analytic
84	DismExportDriverStop	Analytic
85	DismOptimizeImageStart	Analytic
86	DismOptimizeImageStop	Analytic
87	DismRemoveProvisionedAppxPackageStart87	Analytic
88	DismRemoveProvisionedAppxPackageStop88	Analytic
89	DismAddLanguageStart	Analytic
90	DismAddLanguageStop	Analytic
91	DismRemoveLanguageStart	Analytic
92	DismRemoveLanguageStop	Analytic

Event ID 1: DismInitializeStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismInitialize
Opcode: Start

Event ID 2: DismInitializeStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismInitialize
Opcode: Stop

Event ID 3: DismShutdown

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Level: Informational
Task: DismShutdown
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:04.241+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DismShutdown"
}

Event ID 4: DismShutdown

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Level: Informational
Task: DismShutdown
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:04.246+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DismShutdown"
}

Event ID 5: DismOpenSessionStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismOpenSession
Opcode: Start

Fields #

Name	Description
`String` UnicodeString

Event ID 6: DismOpenSession

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DismOpenSession
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:02.796+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2,
    "String": "DISM_{53BFAE52-B167-4E2F-A258-0A37B57FF845}"
  },
  "message": "DismOpenSession"
}

Event ID 7: DismCloseSession

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DismCloseSession
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:02.846+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DismCloseSession"
}

Event ID 8: DismCloseSession

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DismCloseSession
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:04.240+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DismCloseSession"
}

Event ID 9: DismMountImageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismMountImage
Opcode: Start

Fields #

Name	Description
`String` UnicodeString

Event ID 10: DismMountImageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismMountImage
Opcode: Stop

Fields #

Name	Description
`String` UnicodeString

Event ID 11: DismUnmountImageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismUnmountImage
Opcode: Start

Fields #

Name	Description
`String` UnicodeString

Event ID 12: DismUnmountImageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismUnmountImage
Opcode: Stop

Fields #

Name	Description
`String` UnicodeString

Event ID 13: EnqueueCommandObject

Provider: Microsoft-Windows-Dism-Api
Channel: InternalAnalytic
Also via: realtime ETW trace
Level: Informational
Task: EnqueueCommandObject
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 1,
    "keywords": "0x400000000000001A",
    "time_created": "2026-06-02T05:16:02.797+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "EnqueueCommandObject"
}

Event ID 14: EnqueueCommandObject

Provider: Microsoft-Windows-Dism-Api
Channel: InternalAnalytic
Also via: realtime ETW trace
Level: Informational
Task: EnqueueCommandObject
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": "0x400000000000001A",
    "time_created": "2026-06-02T05:16:02.797+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "EnqueueCommandObject"
}

Event ID 15: DequeueCommandObject

Provider: Microsoft-Windows-Dism-Api
Channel: InternalAnalytic
Also via: realtime ETW trace
Level: Informational
Task: DequeueCommandObject
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 1,
    "keywords": "0x400000000000001A",
    "time_created": "2026-06-02T05:16:02.797+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 19220,
      "thread_id": 4380
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DequeueCommandObject"
}

Event ID 16: DequeueCommandObject

Provider: Microsoft-Windows-Dism-Api
Channel: InternalAnalytic
Also via: realtime ETW trace
Level: Informational
Task: DequeueCommandObject
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 2,
    "keywords": "0x400000000000001A",
    "time_created": "2026-06-02T05:16:02.797+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 19220,
      "thread_id": 4380
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DequeueCommandObject"
}

Event ID 23: DismSetFirstBootCommandLineStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetFirstBootCommandLine
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 24: DismSetFirstBootCommandLineStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetFirstBootCommandLine
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 25: DismRemountImageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemountImage
Opcode: Start

Fields #

Name	Description
`String` UnicodeString

Event ID 26: DismRemountImageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemountImage
Opcode: Stop

Fields #

Name	Description
`String` UnicodeString

Event ID 27: DismCommitImageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCommitImage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 28: DismCommitImageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCommitImage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 29: DismGetImageInfoStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetImageInfo
Opcode: Start

Fields #

Name	Description
`String` UnicodeString

Event ID 30: DismGetImageInfoStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetImageInfo
Opcode: Stop

Fields #

Name	Description
`String` UnicodeString

Event ID 31: DismGetMountedImageInfoStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetMountedImageInfo
Opcode: Start

Event ID 32: DismGetMountedImageInfoStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetMountedImageInfo
Opcode: Stop

Event ID 33: DismCleanupMountpointsStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCleanupMountpoints
Opcode: Start

Event ID 34: DismCleanupMountpointsStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCleanupMountpoints
Opcode: Stop

Event ID 35: DismAddPackageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddPackage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 36: DismAddPackageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddPackage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 37: DismRemovePackageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemovePackage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 38: DismRemovePackageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemovePackage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 39: DismEnableFeatureStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismEnableFeature
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 40: DismEnableFeatureStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismEnableFeature
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 41: DismDisableFeatureStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismDisableFeature
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 42: DismDisableFeatureStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismDisableFeature
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 43: DismGetPackagesStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetPackages
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 44: DismGetPackagesStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetPackages
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 45: DismGetPackageInfoStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetPackageInfo
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 46: DismGetPackageInfoStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetPackageInfo
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 47: DismGetFeaturesStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatures
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 48: DismGetFeaturesStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatures
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 49: DismGetFeatureInfoStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatureInfo
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 50: DismGetFeatureInfoStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatureInfo
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 51: DismGetFeatureParentStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatureParent
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 52: DismGetFeatureParentStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeatureParent
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 53: DismApplyUnattendStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismApplyUnattend
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 54: DismApplyUnattendStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismApplyUnattend
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 55: DismAddDriverStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddDriver
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 56: DismAddDriverStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddDriver
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 57: DismRemoveDriverStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveDriver
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 58: DismRemoveDriverStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveDriver
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 59: DismGetDriversStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetDrivers
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 60: DismGetDriversStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetDrivers
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 61: DismGetDriverInfoStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetDriverInfo
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 62: DismGetDriverInfoStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetDriverInfo
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 63: DismCheckImageHealthStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCheckImageHealth
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 64: DismCheckImageHealthStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismCheckImageHealth
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 65: DismRestoreImageHealthStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRestoreImageHealth
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 66: DismRestoreImageHealthStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRestoreImageHealth
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 67: DismSetEditionStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetEdition
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 68: DismSetEditionStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetEdition
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 69: DismSetProductKeyStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetProductKey
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 70: DismSetProductKeyStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismSetProductKey
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 71: DismGetCurrentEditionStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetCurrentEdition
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 72: DismGetCurrentEditionStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetCurrentEdition
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 73: DismGetTargetEditionsStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetTargetEditions
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 74: DismGetTargetEditionsStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetTargetEditions
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 75: DismGetFeaturesExStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeaturesEx
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 76: DismGetFeaturesExStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismGetFeaturesEx
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 77: DismAddProvisionedAppxPackageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddProvisionedAppxPackage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 78: DismAddProvisionedAppxPackageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddProvisionedAppxPackage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 79: DismRemoveProvisionedAppxPackageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveProvisionedAppxPackage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 80: DismRemoveProvisionedAppxPackageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveProvisionedAppxPackage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 81: DismGetProvisionedAppxPackages

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DismGetProvisionedAppxPackages
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 81,
    "version": 0,
    "level": 4,
    "task": 41,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:02.802+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DismGetProvisionedAppxPackages"
}

Event ID 82: DismGetProvisionedAppxPackages

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Also via: realtime ETW trace
Level: Informational
Task: DismGetProvisionedAppxPackages
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dism-Api",
    "guid": "{75B0DA21-8B50-42EB-9448-EC48B1729B57}",
    "event_source_name": "",
    "event_id": 82,
    "version": 0,
    "level": 4,
    "task": 41,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:16:02.842+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-000B-A536-818753F0DC01}"
    },
    "execution": {
      "process_id": 19220,
      "thread_id": 18680
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SessionId": 2
  },
  "message": "DismGetProvisionedAppxPackages"
}

Event ID 83: DismExportDriverStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismExportDriver
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 84: DismExportDriverStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismExportDriver
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 85: DismOptimizeImageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismOptimizeImage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32

Event ID 86: DismOptimizeImageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismOptimizeImage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32

Event ID 87: DismRemoveProvisionedAppxPackageStart87

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveProvisionedAppxPackage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 88: DismRemoveProvisionedAppxPackageStop88

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveProvisionedAppxPackage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 89: DismAddLanguageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddLanguage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 90: DismAddLanguageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismAddLanguage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 91: DismRemoveLanguageStart

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveLanguage
Opcode: Start

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Event ID 92: DismRemoveLanguageStop

Provider: Microsoft-Windows-Dism-Api
Channel: Analytic
Task: DismRemoveLanguage
Opcode: Stop

Fields #

Name	Description
`SessionId` UInt32
`String` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {75B0DA21-8B50-42EB-9448-EC48B1729B57}

Defined in DismApi.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · sample captured from a live trace · binary version 10.0.20348.1 · captured 2026-06-02
WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.4946 · captured 2026-06-02

Downloads

Microsoft-Windows-Dism-Api registered manifest XML (WS2022-20348.4893) manifest-xml
Microsoft-Windows-Dism-Api registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)