Windows 1. 0, version 1. Windows 1. 0Applies to. Windows 1. 0, version 1. Windows 10, version 1703 basic level Windows diagnostic events and fields. The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including basic device information, quality related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information. The Basic level also helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems. Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. One of the big confusions surrounding Windows 10 concerns its licensing and activation. This FAQ will shed some light, explain what has changed with Windows 10. Shop for the latest software and technology products from Microsoft Store. Experience the best of Microsoft with easy online shopping. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles Note. Updated July 2. 01. Weve added new fields to several Appraiser events to prepare for upgrades to the next release of Windows and weve added a brand new event, Census. Speech, to collect basic details about speech settings and configuration. Common data extensions. Common Data Extensions. Microsoft Activation Codes For Windows 10' title='Microsoft Activation Codes For Windows 10' />App. The following fields are available exp. Id Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event. Id The user. ID as known by the application. The environment from which the event was logged. Id An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session. Common Data Extensions. CSThe following fields are available sig A common schema signature that identifies new and modified event schemas. Common Data Extensions. CUETThe following fields are available st. Id Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID. Id Represents the ETW Activity. Id. Logged via Trace. Logging or directly via ETW. Id Represents the ETW Related Activity. Id. Logged via Trace. Logging or directly via ETW. Represents the ETW Op Code. Represents a bitmask of the ETW Keywords associated with the event. Represents the bitmap that captures various Windows specific flags. Id The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, Io. T Composer. tickets A list of strings that represent entries in the HTTP header of the web request that includes this event. Upload buffer sequence number in the format lt buffer identifier lt sequence number mon Combined monitor and event sequence numbers in the format lt monitor sequence lt event sequence Common Data Extensions. Device. The following fields are available ver Represents the major and minor version of the extension. Id Represents a locally defined unique ID for the device, not the human readable device name. Most likely equal to the value stored at HKLMSoftwareMicrosoftSQMClientMachine. Iddevice. Class Represents the classification of the device, the device family. For example, Desktop, Server, or Mobile. Common Data Extensions. Install Pdf Creator Sccm 2017 on this page. Envelope. The following fields are available ver Represents the major and minor version of the extension. Represents the uniquely qualified name for the event. Represents the event date time in Coordinated Universal Time UTC when the event was generated on the client. This should be in ISO 8. Sample Represents the effective sample rate for this event at the time it was generated by a client. Represents the epoch and seq. Num fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de duplication of events on the ingress server. Num Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue. The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de duplication of events on the ingress server. Key Represents an ID for applications or other logical groupings of events. Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest order byte is the event persistence. The next byte is the event latency. Represents the operating system name. Ver Represents the OS version, and its format is OS dependent. Id Represents a unique identifier of the client application currently loaded in the process producing the event and is used to group events together and understand usage pattern, errors by application. Ver Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app. V Represents the Correlation Vector A single field for tracking partial order of related telemetry events across component boundaries. Common Data Extensions. OSThe following fields are available ver Represents the major and minor version of the extension. Id Represents the experiment ID. The standard for associating a flight, such as an OS flight pre release build, or an experiment, such as a web site UX experiment, with an event is to record the flight experiment IDs in Part A of the common schema. Represents the locale of the operating system. Id An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot. Common Data Extensions. User. The following fields are available ver Represents the major and minor version of the extension. Id Represents a unique user identity that is created locally and added by the client. This is not the users account ID. Common Data Extensions. XBLThe following fields are available nbf Not before timeexp. Id Expiration timesbx XBOX sandbox identifierdty XBOX device typedid XBOX device IDxid A list of base. XBOX User IDs. uts A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts. Common Data Extensions. Consent UI Event. This User Account Control UAC telemetry point collects information on elevations that originate from low integrity levels. This occurs when a process running at low integrity level IL requires higher administrator privileges, and therefore requests for elevation via UAC consent. By better understanding the processes requesting these elevations, Microsoft can in turn improve the detection and handling of potentially malicious behavior in this path. The following fields are available event. Type Represents the type of elevation If it succeeded, was cancelled, or was auto approved. Token Represents the flag used to distinguish between administrators and standard users. Name Represents the name of the file requesting elevation from low IL. Reason Represents the distinction between various elevation requests sources appcompat, installer, COM, MSI and so on. Name Represents the name of the file requesting elevation from low IL. State Represents the state of the signature, if it signed, unsigned, OS signed and so on. Name Represents the name of the publisher of the file requesting elevation from low IL. Line Represents the full command line arguments being used to elevate. Hash. Length Represents the length of the hash of the file requesting elevation from low IL. Hash Represents the hash of the file requesting elevation from low IL. Hash. Alg. Id Represents the algorithm ID of the hash of the file requesting elevation from low IL. Flags Represents the details about the elevation prompt for CEIP data. Stamp Represents the time stamp on the file requesting elevation. Version. MS Represents the major version of the file requesting elevation. Version. LS Represents the minor version of the file requesting elevation.