Microsoft-Windows-Dwm-Compositor

36 events across 1 channel

Event	Title	Channel
1	WaitForWork_Start	Diagnostic
2	WaitForWork_Stop	Diagnostic
3	WaitForVerticalBlank_Start	Diagnostic
4	WaitForVerticalBlank_Stop	Diagnostic
5	UpdateAnimations_Start	Diagnostic
6	UpdateAnimations_Stop	Diagnostic
7	Present_MPO	Diagnostic
8	Present_DFlip	Diagnostic
9	Present_Legacy	Diagnostic
10	Present_OverlayPlane	Diagnostic
11	TargetStats_Ready	Diagnostic
12	UpdateExpressions_Start	Diagnostic
13	UpdateExpressions_Stop	Diagnostic
14	CleanTrees_Start	Diagnostic
15	CleanTrees_Stop	Diagnostic
16	BeginFrame	Diagnostic
17	ConfirmFrame	Diagnostic
18	RenderCVISnapshots	Diagnostic
19	RenderCVIs	Diagnostic
20	TargetRender	Diagnostic
21	FrameRender	Diagnostic
22	WaitForCompositorClock_Start	Diagnostic
23	WaitForCompositorClock_Stop	Diagnostic
24	TargetStats_TargetTime	Diagnostic
25	ClockBoostChanged	Diagnostic
26	SwapChain_DurationChanged	Diagnostic
27	ConnectedStandbyStateChanged	Diagnostic
28	MonitorPowerStateChanged	Diagnostic
29	Pinning_Start	Diagnostic
30	Pinning_Stop	Diagnostic
31	UnPinning_Start	Diagnostic
32	UnPinning_Stop	Diagnostic
33	ResourcePinned	Diagnostic
34	ResourcePendingUnPin	Diagnostic
35	ResourceReadyToUnPin	Diagnostic
36	ResourceUnPinned	Diagnostic

Event ID 1: WaitForWork_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Level: Informational
Task: WaitForWork_Start
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.553+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "WaitForWork_Start"
}

Event ID 2: WaitForWork_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: WaitForWork_Stop
Opcode: Stop

Fields #

Name	Description
`waitReturn` UInt32
`Batches` Boolean
`Tokens` Boolean
`CompositionTimer` Boolean
`AdaptersChanged` Boolean
`OcclusionEvent` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 2,
    "version": 2,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AdaptersChanged": false,
    "Batches": false,
    "CompositionTimer": false,
    "OcclusionEvent": false,
    "Tokens": true,
    "waitReturn": 1
  },
  "message": "WaitForWork_Stop"
}

Event ID 3: WaitForVerticalBlank_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: WaitForVerticalBlank_Start
Opcode: Start

Fields #

Name	Description
`duration` UInt64
`targetId` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "duration": 156250,
    "targetId": "b\u0000\u0000\u0000\u0000\u0000\u0000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001"
  },
  "message": "WaitForVerticalBlank_Start"
}

Event ID 4: WaitForVerticalBlank_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: WaitForVerticalBlank_Stop
Opcode: Stop

Fields #

Name	Description
`waitResult` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "waitResult": 2
  },
  "message": "WaitForVerticalBlank_Stop"
}

Event ID 5: UpdateAnimations_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Level: Informational
Task: UpdateAnimations_Start
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UpdateAnimations_Start"
}

Event ID 6: UpdateAnimations_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: UpdateAnimations_Stop
Opcode: Stop

Fields #

Name	Description
`updatedAnimationCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "updatedAnimationCount": 0
  },
  "message": "UpdateAnimations_Stop"
}

Event ID 7: Present_MPO

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Present_MPO
Opcode: Info

Fields #

Name	Description
`hr` UInt32
`presentedPlaneCount` UInt32
`desktopPlanePresented` Boolean

Event ID 8: Present_DFlip

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Present_DFlip

Fields #

Name	Description
`targetId` UInt16
`hr` UInt32
`surfaceLuid` UInt64
`bindId` UInt64
`realizationIndex` UInt64
`presentCount` UInt32

Event ID 9: Present_Legacy

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Present_Legacy

Fields #

Name	Description
`targetId` Int8
`hr` UInt32
`presentFlags` UInt32

Event ID 10: Present_OverlayPlane

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Present_OverlayPlane

Fields #

Name	Description
`surfaceLuid` UInt64
`bindId` UInt64
`realizationIndex` UInt64
`presentCount` UInt32
`Enabled` UInt32
`PlaneIndex` UInt32
`Flags` UInt32
`srcRect` Boolean
`dstRect` FILETIME
`clipRect` HexInt64
`Rotation` UInt32
`Blend` UInt32
`ColorSpace` UInt32

Event ID 11: TargetStats_Ready

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: TargetStats_Ready
Opcode: Info

Fields #

Name	Description
`occlusion` UInt32
`ready` Boolean
`outstandingPresents` UInt32
`targetError` UInt64
`nextFrameTargetError` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 11,
    "version": 2,
    "level": 4,
    "task": 11,
    "opcode": 0,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "firstAvailableMonitorTime": "000000006CF37B6A1D0100005A62020000000000",
    "lastMonitorTime": "4EB67700000000001291796A1D0100005A620200",
    "nextFrameTargetError": 18446744073709551615,
    "occlusion": 1,
    "outstandingPresents": 0,
    "ready": false,
    "targetError": 0,
    "targetId": "A262000000000000A262000000000000000000000000000001000000",
    "targetMonitorTime": "6CF37B6A1D0100005A620200000000004EB67700"
  },
  "message": "TargetStats_Ready"
}

Event ID 12: UpdateExpressions_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Level: Informational
Task: UpdateExpressions_Start
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 12,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "UpdateExpressions_Start"
}

Event ID 13: UpdateExpressions_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: UpdateExpressions_Stop
Opcode: Stop

Fields #

Name	Description
`expressionCalculatedCount` UInt32
`tracedExpressionsCalculatedCount` UInt32
`activeExpressionCount` UInt32
`suspendedAnimationsCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 13,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "activeExpressionCount": 1603,
    "expressionCalculatedCount": 0,
    "suspendedAnimationsCount": 153,
    "tracedExpressionsCalculatedCount": 0
  },
  "message": "UpdateExpressions_Stop"
}

Event ID 14: CleanTrees_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Level: Informational
Task: CleanTrees_Start
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 14,
    "opcode": 1,
    "keywords": "0x0000000000000021",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "CleanTrees_Start"
}

Event ID 15: CleanTrees_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: CleanTrees_Stop
Opcode: Stop

Fields #

Name	Description
`hr` UInt32
`dirtyTreeCount` UInt32
`treeLockWaitTimeUs` UInt64
`desktopDirtyRectCount` UInt32
`desktopDirtyRects` Int16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 2,
    "keywords": "0x0000000000000021",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "desktopDirtyRectCount": 0,
    "desktopDirtyRects": "",
    "dirtyTreeCount": 0,
    "hr": 0,
    "treeLockWaitTimeUs": 0
  },
  "message": "CleanTrees_Stop"
}

Event ID 16: BeginFrame

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: BeginFrame
Opcode: win:Info

Fields #

Name	Description
`hr` UInt32
`frameId` UInt64
`targetTime` UInt64
`batchSubmissionDeadline` UInt64
`compositorClockDuration` UInt64
`primaryMonitor` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 16,
    "opcode": 0,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "batchSubmissionDeadline": 1225852031250,
    "compositorClockDuration": 156250,
    "frameId": 392747,
    "hr": 0,
    "primaryMonitor": "1291796A1D0100001291796A1D0100005A620200000000005A620200000000001291796A1D0100001291796A1D010000",
    "targetTime": 1225852187500
  },
  "message": "BeginFrame"
}

Event ID 17: ConfirmFrame

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: ConfirmFrame
Opcode: win:Info

Fields #

Name	Description
`hr` UInt32
`frameId` UInt64
`targetCount` UInt32
`targetIdAndStats` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.553+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "frameId": 392747,
    "hr": 0,
    "targetCount": 1,
    "targetIdAndStats": "A262000000000000A26200000000000000000000000000000100000000000000000000000000000000000000000000005A62020000000000B04301004DB677004DB67700000000001291796A1D0100001291796A1D010000B043010036AF77000000000000000000FC4492591D0100000000000000000000"
  },
  "message": "ConfirmFrame"
}

Event ID 18: RenderCVISnapshots

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: RenderCVISnapshots

Fields #

Name	Description
`hr` UInt32
`snapshotsToPerform` UInt32

Event ID 19: RenderCVIs

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: RenderCVIs

Fields #

Name	Description
`desktopLuid` UInt64
`backdropVisualsRendered` UInt32
`cachedVisualsRendered` UInt32

Event ID 20: TargetRender

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: TargetRender

Fields #

Name	Description
`renderStartTime` UInt64
`renderEndTime` UInt64
`endDrawStartTime` UInt64
`endDrawEndTime` UInt64
`targetArea` UInt64
`drawVisualTreeCount` UInt32
`internalLayerCount` UInt32
`internalLayerArea` UInt64
`externalLayerCount` UInt32
`externalLayerArea` UInt64
`cviCount` UInt32
`cviArea` UInt64
`bviCount` UInt32
`bviArea` UInt64
`targetType` UInt32

Event ID 21: FrameRender

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: FrameRender

Fields #

Name	Description
`totalRenderTimeUs` UInt64
`totalEndDrawTimeUs` UInt64
`totalTargetArea` UInt64
`totalDrawVisualTreeCount` UInt32
`totalInternalLayerCount` UInt32
`totalInternalLayerArea` UInt64
`totalExternalLayerCount` UInt32
`totalExternalLayerArea` UInt64
`totalCviCount` UInt32
`totalCviArea` UInt64
`totalBviCount` UInt32
`totalBviArea` UInt64

Event ID 22: WaitForCompositorClock_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Level: Informational
Task: WaitForCompositorClock_Start
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 22,
    "opcode": 1,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "WaitForCompositorClock_Start"
}

Event ID 23: WaitForCompositorClock_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: WaitForCompositorClock_Stop
Opcode: Stop

Fields #

Name	Description
`waitResult` Int32
`duration` UInt64
`parallelMode` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 23,
    "version": 0,
    "level": 4,
    "task": 23,
    "opcode": 2,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.551+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "duration": 156250,
    "parallelMode": false,
    "waitResult": 2
  },
  "message": "WaitForCompositorClock_Stop"
}

Event ID 24: TargetStats_TargetTime

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: TargetStats_TargetTime
Opcode: win:Info

Fields #

Name	Description
`targetId` Int16
`targetError` UInt64
`targetMonitorTime` UInt64
`firstAvailableMonitorTime` Boolean
`lastMonitorTime` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Dwm-Compositor",
    "guid": "{044A9015-D96C-5DD1-0199-72D258325298}",
    "event_source_name": "",
    "event_id": 24,
    "version": 0,
    "level": 4,
    "task": 24,
    "opcode": 0,
    "keywords": "0x0000000040000001",
    "time_created": "2026-06-02T05:49:35.552+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 1168,
      "thread_id": 1236
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "firstAvailableMonitorTime": false,
    "lastMonitorTime": "4EB67700000000001291796A1D0100005A620200",
    "targetError": 0,
    "targetId": "A262000000000000A262000000000000000000000000000001000000",
    "targetMonitorTime": "6CF37B6A1D0100005A620200000000004EB67700"
  },
  "message": "TargetStats_TargetTime"
}

Event ID 25: ClockBoostChanged

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ClockBoostChanged

Fields #

Name	Description
`clockBoost` Boolean

Event ID 26: SwapChain_DurationChanged

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: SwapChain_DurationChanged

Fields #

Name	Description
`displayAdapterLuid` UInt64
`vidPnSourceId` UInt32
`vidPnTargetId` UInt32
`duration` UInt64
`vBlankMultiplier` UInt32
`iFlipApprovedDuration` UInt64

Event ID 27: ConnectedStandbyStateChanged

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ConnectedStandbyStateChanged

Fields #

Name	Description
`ConnectedStandbyState` UInt32

Event ID 28: MonitorPowerStateChanged

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: MonitorPowerStateChanged

Fields #

Name	Description
`MonitorPowerState` UInt32

Event ID 29: Pinning_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Pinning_Start
Opcode: Start

Fields #

Name	Description
`resourceCount` UInt32

Event ID 30: Pinning_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: Pinning_Stop
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 31: UnPinning_Start

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: UnPinning_Start
Opcode: Start

Fields #

Name	Description
`resourceCount` UInt32

Event ID 32: UnPinning_Stop

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: UnPinning_Stop
Opcode: Stop

Fields #

Name	Description
`hr` UInt32

Event ID 33: ResourcePinned

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ResourcePinned

Fields #

Name	Description
`surfaceLuid` UInt64
`realizationIndex` UInt32
`uniqueId` UInt64
`alreadyPinned` Boolean

Event ID 34: ResourcePendingUnPin

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ResourcePendingUnPin

Fields #

Name	Description
`displayAdapterLuid` UInt64
`vidPnSourceId` UInt32
`presentCount` UInt32
`surfaceLuid` UInt64
`realizationIndex` UInt32
`uniqueId` UInt64

Event ID 35: ResourceReadyToUnPin

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ResourceReadyToUnPin

Fields #

Name	Description
`ready` Boolean
`displayAdapterLuid` UInt64
`vidPnSourceId` UInt32
`completedPresentCount` UInt32
`surfaceLuid` UInt64
`realizationIndex` UInt32
`uniqueId` UInt64

Event ID 36: ResourceUnPinned

Provider: Microsoft-Windows-Dwm-Compositor
Channel: Diagnostic
Task: ResourceUnPinned

Fields #

Name	Description
`surfaceLuid` UInt64
`realizationIndex` UInt32
`uniqueId` UInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {044A9015-D96C-5DD1-0199-72D258325298}

Defined in dwmcore.dll, which carries the event manifest.

Observed on:

Win11-26200.6584 · sample captured from a live trace · binary version 10.0.26100.5074 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.5074 · captured 2026-06-02

Downloads

Microsoft-Windows-Dwm-Compositor registered manifest XML (Win11-26200.6584) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)