Microsoft-Windows-Dwm-Udwm

156 events across 1 channel

Event ID	Title	Channel
1		Diagnostic
2		Diagnostic
5		Diagnostic
6		Diagnostic
7		Diagnostic
8		Diagnostic
9		Diagnostic
10		Diagnostic
11		Diagnostic
12		Diagnostic
13		Diagnostic
14		Diagnostic
15		Diagnostic
5000		Diagnostic
5001		Diagnostic
5002		Diagnostic
5003		Diagnostic
5004		Diagnostic
5005		Diagnostic
5006		Diagnostic
5007		Diagnostic
5008		Diagnostic
5009		Diagnostic
5010		Diagnostic
5011		Diagnostic
5012		Diagnostic
5013		Diagnostic
5014		Diagnostic
5015		Diagnostic
5016		Diagnostic
5017		Diagnostic
5018		Diagnostic
5019		Diagnostic
5020		Diagnostic
5021		Diagnostic
5022		Diagnostic
5023		Diagnostic
5024		Diagnostic
5025		Diagnostic
5026		Diagnostic
5027		Diagnostic
5028		Diagnostic
5029		Diagnostic
5030		Diagnostic
5031		Diagnostic
5032		Diagnostic
5035		Diagnostic
5036		Diagnostic
5037		Diagnostic
5038		Diagnostic
5047		Diagnostic
5048		Diagnostic
5049		Diagnostic
5050		Diagnostic
5051		Diagnostic
5052		Diagnostic
5053		Diagnostic
5054		Diagnostic
5055		Diagnostic
5056		Diagnostic
5057		Diagnostic
5058		Diagnostic
5059		Diagnostic
5060		Diagnostic
5061		Diagnostic
5062		Diagnostic
5063		Diagnostic
5064		Diagnostic
5065		Diagnostic
5066		Diagnostic
5067		Diagnostic
5068		Diagnostic
5069		Diagnostic
5070		Diagnostic
5071		Diagnostic
5072		Diagnostic
5073		Diagnostic
5074		Diagnostic
5075		Diagnostic
5076		Diagnostic
5077		Diagnostic
5078		Diagnostic
5079		Diagnostic
5080		Diagnostic
5081		Diagnostic
5082		Diagnostic
5083		Diagnostic
5084		Diagnostic
5085		Diagnostic
5086		Diagnostic
5087		Diagnostic
5088		Diagnostic
5089		Diagnostic
5090		Diagnostic
5091		Diagnostic
5092		Diagnostic
5093		Diagnostic
5094		Diagnostic
5095		Diagnostic
5096		Diagnostic
5097		Diagnostic
5098		Diagnostic
5099		Diagnostic
5100		Diagnostic
5101		Diagnostic
5102		Diagnostic
5103		Diagnostic
5104		Diagnostic
5105		Diagnostic
5106		Diagnostic
5107		Diagnostic
5108		Diagnostic
5109		Diagnostic
5110		Diagnostic
5111		Diagnostic
5112		Diagnostic
5113		Diagnostic
5114		Diagnostic
5115		Diagnostic
5116		Diagnostic
5117		Diagnostic
5118		Diagnostic
5119		Diagnostic
5120		Diagnostic
5121		Diagnostic
5122		Diagnostic
5123		Diagnostic
5124		Diagnostic
5125		Diagnostic
5126		Diagnostic
5127		Diagnostic
5128		Diagnostic
5129		Diagnostic
5130		Diagnostic
5131		Diagnostic
5132		Diagnostic
5133		Diagnostic
5134		Diagnostic
5150		Diagnostic
5151		Diagnostic
5152		Diagnostic
5153		Diagnostic
5154		Diagnostic
5155		Diagnostic
5156		Diagnostic
5157		Diagnostic
9001	wr RemoveSecondaryWindowRepresentation …	Diagnostic
9002	RemoveSecondaryWindowRepresentation …	Diagnostic
9003	RemoveSecondaryWindowRepresentation …	Diagnostic
9004	_StopTrackingWindow CWindowData{CWindowData}.	Diagnostic
9005	Thumbnail hwndDestination{hwndDestination}.	Diagnostic
9006	ownedWindow pwd{pwd}, hwnd{hwnd}.	Diagnostic
9007	UpdateScene	Diagnostic
9008	Disconnect	Diagnostic
9009	Snapshot pSnapshot{pSnapshot}.	Diagnostic
10000		Diagnostic

Event ID 1 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGraphicsStreamChange
Opcode: Start

Fields #

Name	Description
`flags` UInt32	—

Event ID 2 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGraphicsStreamChange
Opcode: Stop

Fields #

Name	Description
`flags` UInt32	—

Event ID 5 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessModeChange

Fields #

Name	Description
`Height` UInt32	—
`Width` UInt32	—
`Depth` UInt32	—

Event ID 6 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishTransport
Opcode: Start

Event ID 7 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishTransport
Opcode: Stop

Event ID 8 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishStructuralRedirection
Opcode: Start

Event ID 9 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishStructuralRedirection
Opcode: Stop

Event ID 10 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishDesktopComposition
Opcode: Start

Event ID 11 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishDesktopComposition
Opcode: Stop

Event ID 12 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishKernelRedirection
Opcode: Start

Event ID 13 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmEstablishKernelRedirection
Opcode: Stop

Event ID 14 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmRefreshDesktopComposition
Opcode: Info

Event ID 15 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmResetGraphicsStream
Opcode: Info

Event ID 5000 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmStartup

Fields #

Name	Description
`Schedules` UInt32	—

Event ID 5001 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmShutdownMessage

Event ID 5002 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimation
Opcode: Start

Fields #

Name	Description
`AnimationType` UInt32	—
`Hwnd` Pointer	—

Event ID 5003 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimation
Opcode: Stop

Fields #

Name	Description
`AnimationType` UInt32	—
`Hwnd` Pointer	—

Event ID 5004 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimation

Event ID 5005 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmManageIconicThumbnail

Fields #

Name	Description
`Action` UInt32	—
`Hwnd` Pointer	—

Event ID 5006 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSelectIconicRepresentation

Fields #

Name	Description
`Action` UInt32	—
`Hwnd` Pointer	—

Event ID 5007 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSetIconicThumbnail
Opcode: Start

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5008 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSetIconicThumbnail
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5009 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSnapshotIconicThumbnail
Opcode: Start

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5010 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSnapshotIconicThumbnail
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5011 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLivePreviewAnimation
Opcode: Start

Event ID 5012 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLivePreviewAnimation
Opcode: Stop

Event ID 5013 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAllAnimationFinished

Event ID 5014 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSetIconicLivePreviewBitmap
Opcode: Start

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5015 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessSetIconicLivePreviewBitmap
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5016 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessInvalidateIconicBitmaps
Opcode: Start

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5017 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmProcessInvalidateIconicBitmaps
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5018 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGlassSheetAnimation
Opcode: Start

Event ID 5019 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGlassSheetAnimation

Event ID 5020 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGlassSheetAnimation
Opcode: Stop

Fields #

Name	Description
`Left` Int32	—
`Top` Int32	—
`Right` Int32	—
`Bottom` Int32	—

Event ID 5021 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmRippleAnimation

Event ID 5022 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmRippleAnimation

Event ID 5023 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGlassSheetFadeOut

Event ID 5024 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGlassSheetFadeOut

Event ID 5025 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLoadTheme
Opcode: Start

Event ID 5026 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLoadTheme
Opcode: Stop

Event ID 5027 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmDirectTouchDownAnimation
Opcode: Start

Fields #

Name	Description
`PointerID` UInt32	—

Event ID 5028 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmDirectTouchDownAnimation

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5028
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5028

Event ID 5029 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmDirectTouchDownAnimation
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5029
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5029

Event ID 5030 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchUpReceived

Fields #

Name	Description
`PointerID` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5030
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5030

Event ID 5031 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmContactStationaryVisual
Opcode: Start

Fields #

Name	Description
`Enum` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5031
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5031

Event ID 5032 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmContactStationaryVisual
Opcode: Stop

Fields #

Name	Description
`Enum` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5032
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5032

Event ID 5035 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationInitialization
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5035
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5035

Event ID 5036 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationInitialization
Opcode: Stop

Event ID 5037 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationRecalc
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5037
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5037

Event ID 5038 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationRecalc
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5038
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5038

Event ID 5047 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPressTapVisual
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5047
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5047

Event ID 5048 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPressTapVisual
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5048
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5048

Event ID 5049 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTetherVisual
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5049
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5049

Event ID 5050 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTetherVisual
Opcode: Stop

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5050

Event ID 5051 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPenPressHoldVisual
Opcode: Start

Fields #

Name	Description
`flags` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5051
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5051

Event ID 5052 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPenPressHoldVisual
Opcode: Stop

Fields #

Name	Description
`flags` UInt32	—

Event ID 5053 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmFlickVisual
Opcode: Start

Fields #

Name	Description
`Enum` UInt32	—

Event ID 5054 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmFlickVisual
Opcode: Stop

Fields #

Name	Description
`Enum` UInt32	—

Event ID 5055 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchDragVisual
Opcode: Start

Fields #

Name	Description
`PointerID` UInt32	—

Event ID 5056 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchDragVisual

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5056
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5056

Event ID 5057 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchDragVisual
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5057
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5057

Event ID 5058 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTitleTextAligned

Fields #

Name	Description
`alignment` Int32	—

Event ID 5059 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationEngine
Opcode: Start

Fields #

Name	Description
`AnimationID` UInt32	—
`StoryboardID` Int32	—
`TickCount` UInt32	—

Event ID 5060 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationEngine
Opcode: Stop

Fields #

Name	Description
`AnimationID` UInt32	—
`StoryboardID` Int32	—
`TickCount` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5060
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5060

Event ID 5061 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLoginTransition
Opcode: Start

Event ID 5062 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmLoginTransition
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5062
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5062

Event ID 5063 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionVisualController
Opcode: Start

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5063
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5063

Event ID 5064 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionVisualController

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5064
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5064

Event ID 5065 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionVisualController
Opcode: Stop

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5065
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5065

Event ID 5066 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationCapture

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5066
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5066

Event ID 5067 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationDelay
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5067
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5067

Event ID 5068 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationDelay
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5068
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5068

Event ID 5069 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationAnimation
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5069
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5069

Event ID 5070 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationAnimation
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5070
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5070

Event ID 5071 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationEngine

Fields #

Name	Description
`AnimationID` UInt32	—
`x0` Float	—
`y0` Float	—
`x1` Float	—
`y1` Float	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5071

Event ID 5072 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPenBarrel
Opcode: Start

Fields #

Name	Description
`PointerID` UInt32	—

Event ID 5073 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmPenBarrel
Opcode: Stop

Fields #

Name	Description
`PointerID` UInt32	—

Event ID 5074 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmIndirectTouchVisual
Opcode: Start

Fields #

Name	Description
`PointerID` UInt32	—
`Enum` UInt32	—

Event ID 5075 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmIndirectTouchVisual
Opcode: Stop

Fields #

Name	Description
`PointerID` UInt32	—
`Enum` UInt32	—

Event ID 5076 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmStoryboard

Fields #

Name	Description
`State` UInt32	—
`AnimationID` Int32	—

Event ID 5077 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGradientLoad
Opcode: Start

Event ID 5078 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGradientLoad
Opcode: Stop

Event ID 5079 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGradientColorize
Opcode: Start

Event ID 5080 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmGradientColorize
Opcode: Stop

Event ID 5081 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAccentLoad
Opcode: Start

Fields #

Name	Description
`ResourceId` UInt32	—

Event ID 5082 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAccentLoad
Opcode: Stop

Event ID 5083 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationComponent

Fields #

Name	Description
`hwnd` Pointer	—
`StoryboardId` Int32	—
`Target` Int32	—

Event ID 5084 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationComponent

Fields #

Name	Description
`hwnd` Pointer	—
`StoryboardId` Int32	—
`Target` Int32	—

Event ID 5085 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationComponent

Fields #

Name	Description
`hwnd` Pointer	—
`StoryboardId` Int32	—
`Target` Int32	—

Event ID 5086 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationComponent

Fields #

Name	Description
`hwnd` Pointer	—
`StoryboardId` Int32	—
`Target` Int32	—

Event ID 5087 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchPressHoldVisual
Opcode: Start

Fields #

Name	Description
`Enum` UInt32	—

Event ID 5088 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTouchPressHoldVisual
Opcode: Stop

Fields #

Name	Description
`Enum` UInt32	—

Event ID 5089 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimatedTransitionVisual

Fields #

Name	Description
`StoryboardId` Int32	—
`TargetId` Int32	—
`BeginLeft` Int32	—
`BeginTop` Int32	—
`BeginRight` Int32	—
`BeginBottom` Int32	—
`EndLeft` Int32	—
`EndTop` Int32	—
`EndRight` Int32	—
`EndBottom` Int32	—
`BeginOpacity` Float	—
`EndOpacity` Float	—
`BeginDepth` Float	—
`EndDepth` Float	—
`ResourceHandle` UInt32	—
`StaggerOrder` UInt32	—
`AnimationId` UInt32	—

Event ID 5090 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmIndirectTouchVisual

Fields #

Name	Description
`PointerID` UInt32	—

Event ID 5091 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionRequest
Opcode: Start

Fields #

Name	Description
`StoryboardID` Int32	—

Event ID 5092 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionRequest
Opcode: Stop

Fields #

Name	Description
`StoryboardID` Int32	—

Event ID 5093 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionRequest

Fields #

Name	Description
`hwnd` Pointer	—
`Target` HexInt32	—

Event ID 5094 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionCVISnapshot

Event ID 5095 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmTransitionProcessSnapshotOnVisual

Event ID 5096 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSecondaryWindowBrushSnapshot

Fields #

Name	Description
`Title` UnicodeString	—

Event ID 5097 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSecondaryWindowMakeStatic
Opcode: Info

Event ID 5098 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationPreDelayAnimation
Opcode: Start

Event ID 5099 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationPreDelayAnimation
Opcode: Stop

Event ID 5100 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationPostDelayAnimation
Opcode: Start

Event ID 5101 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationPostDelayAnimation
Opcode: Stop

Event ID 5102 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationHintDelay
Opcode: Start

Event ID 5103 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationHintDelay
Opcode: Stop

Event ID 5104 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmScreenRotationHintFired
Opcode: Info

Event ID 5105 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionCapture
Opcode: Info

Event ID 5106 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionDelay
Opcode: Start

Event ID 5107 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionDelay
Opcode: Stop

Event ID 5108 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionHintDelay
Opcode: Start

Event ID 5109 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionHintDelay
Opcode: Stop

Event ID 5110 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionPreDelayAnimation
Opcode: Start

Event ID 5111 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionPreDelayAnimation
Opcode: Stop

Event ID 5112 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionPostDelayAnimation
Opcode: Start

Event ID 5113 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionPostDelayAnimation
Opcode: Stop

Event ID 5114 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionAnimation
Opcode: Start

Event ID 5115 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionAnimation
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32	—

Event ID 5116 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmHardwareExpressionHintFired
Opcode: Info

Event ID 5117 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—
`Cloaked` UInt32	—
`Tracked` UInt32	—

Event ID 5118 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—
`Target` HexInt32	—

Event ID 5119 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—
`Show` UInt32	—

Event ID 5120 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5120

Event ID 5121 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5121

Event ID 5122 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`StoryboardID` Int32	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5122

Event ID 5123 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwndCloned` Pointer	—
`hwndAfter` Pointer	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5123

Event ID 5124 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5124

Event ID 5125 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation
Opcode: Start

Fields #

Name	Description
`hwnd` Pointer	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5125

Event ID 5126 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation
Opcode: Stop

Fields #

Name	Description
`hwnd` Pointer	—

Event ID 5127 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Start

Fields #

Name	Description
`clockId` GUID	—
`timespan` UInt32	—

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5127

Event ID 5128 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Stop

Fields #

Name	Description
`clockId` GUID	—

Event ID 5129 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Start

Fields #

Name	Description
`clockId` GUID	—
`timespan` UInt32	—
`count` Int64	—

Event ID 5130 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Stop

Fields #

Name	Description
`clockId` GUID	—
`count` Int64	—

Event ID 5131 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Start

Fields #

Name	Description
`clockId` GUID	—
`time` Int64	—

Event ID 5132 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock
Opcode: Stop

Fields #

Name	Description
`clockId` GUID	—

Event ID 5133 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock

Fields #

Name	Description
`clockId` GUID	—
`time` Int64	—

Event ID 5134 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationClock

Fields #

Name	Description
`clockId` GUID	—
`oldValue` Int32	—
`newValue` Int32	—

Event ID 5150 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmThumbnailVisualValidated

Fields #

Name	Description
`Enum` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5150
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5150

Event ID 5151 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`StoryboardId` Int32	—
`TargetId` Int32	—
`VisualHandle` UInt32	—
`EffectGroupHandle` UInt32	—
`Transform3DGroupHandle` UInt32	—
`TranslateTransform3DHandle` UInt32	—
`ScaleTransform3DHandle` UInt32	—
`RotateTransform3DHandle` UInt32	—
`Channel` Pointer	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5151
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5151

Event ID 5152 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmAnimationResource

Fields #

Name	Description
`AnimationHandle` UInt32	—
`ResourceHandle` UInt32	—
`PropertyID` UInt32	—
`Channel` Pointer	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5152

Event ID 5153 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmWindowDPIChange

Fields #

Name	Description
`hwnd` Pointer	—
`DPI` Int32	—
`LogicalOriginX` Int32	—
`LogicalOriginY` Int32	—
`PhysicalOriginX` Int32	—
`PhysicalOriginY` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5153
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5153

Event ID 5154 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—
`left` Int32	—
`top` Int32	—
`right` Int32	—
`bottom` Int32	—
`HRESULT` UInt32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5154
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5154

Event ID 5155 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`hwnd` Pointer	—
`StoryboardId` Int32	—
`Target` Int32	—
`CreationMethod` Int32	—
`Left` Int32	—
`Top` Int32	—
`Right` Int32	—
`Bottom` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5155
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5155

Event ID 5156 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmSystemAnimation

Fields #

Name	Description
`UseDelayStoryboard` Boolean	—
`AbandonCrossfade` Boolean	—
`FoundValidTarget` Boolean	—
`IsResize` Boolean	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5156
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5156

Event ID 5157 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: UdwmMaximizeSnapTransition

Fields #

Name	Description
`Hwnd` Pointer	—
`Left` Int32	—
`Top` Int32	—
`Right` Int32	—
`Bottom` Int32	—

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5157

Event ID 9001 — wr RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

wr RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd}.

Message #

wr RemoveSecondaryWindowRepresentation %1{secondarywindowpointer}, %2{hwnd}

Fields #

Name	Description
`secondarywindowpointer` Pointer	—
`hwnd` Pointer	—

Event ID 9002 — RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd} representationType{representationType}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd} representationType{representationType}.

Message #

RemoveSecondaryWindowRepresentation %1{secondarywindowpointer}, %2{hwnd} %3{representationType}

Fields #

Name	Description
`secondarywindowpointer` Pointer	—
`hwnd` Pointer	—
`representationType` Int32	—

Event ID 9003 — RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

RemoveSecondaryWindowRepresentation secondarywindowpointer{secondarywindowpointer}, hwnd{hwnd}.

Message #

RemoveSecondaryWindowRepresentation %1{secondarywindowpointer}, %2{hwnd}

Fields #

Name	Description
`secondarywindowpointer` Pointer	—
`hwnd` Pointer	—

Event ID 9004 — _StopTrackingWindow CWindowData{CWindowData}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

_StopTrackingWindow CWindowData{CWindowData}.

Message #

_StopTrackingWindow %1{CWindowData}

Fields #

Name	Description
`CWindowData` Pointer	—

Event ID 9005 — Thumbnail hwndDestination{hwndDestination}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

Thumbnail hwndDestination{hwndDestination}.

Message #

Thumbnail %1{hwndDestination}

Fields #

Name	Description
`hwndDestination` Pointer	—

Event ID 9006 — ownedWindow pwd{pwd}, hwnd{hwnd}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

ownedWindow pwd{pwd}, hwnd{hwnd}.

Message #

ownedWindow %1{pwd}, %2{hwnd}

Fields #

Name	Description
`pwd` Pointer	—
`hwnd` Pointer	—

Event ID 9007 — UpdateScene

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

UpdateScene.

Message #

UpdateScene

Event ID 9008 — Disconnect

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

Disconnect.

Message #

Disconnect

Event ID 9009 — Snapshot pSnapshot{pSnapshot}.

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Opcode: Info

Description

Snapshot pSnapshot{pSnapshot}.

Message #

Snapshot %1{pSnapshot}

Fields #

Name	Description
`pSnapshot` Pointer	—

Event ID 10000 —

Provider: Microsoft-Windows-Dwm-Udwm
Channel: Diagnostic
Task: PerfTrack_UdwmLivePreviewAnimation_FirstFrameFinished

Fields #

Name	Description
`PerfTrackId` UInt32	—