Windows management event channels
Scheduled and remote management, servicing, backup, virtualization and print channels, bound as one feed: Task Scheduler, WMI, WinRM, Windows Update, BITS, VSS, Hyper-V, MDM and provisioning, Server Manager, printing, licensing. Light curation: severity capped at Warning, nothing dropped, no reasons yet.
Feed id: win.eventlog.management.
Channels
This feed binds 42 Windows Event Log channels as one reporting axis. A channel that a given Windows edition, role or OEM does not provide is absent on that endpoint; the rest still collect.
The ticket class is the subject area an event on the channel is evidence for, and it is what fleet-wide questions group by. A channel that records across every subject area at once ships unlabeled rather than mislabeled.
| Channel | Ticket class |
|---|---|
DFS Replication | directory_services |
Microsoft-Client-Licensing-Platform/Admin | licensing |
Microsoft-Windows-Bits-Client/Operational | patching |
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin | device_management |
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Autopilot | device_management |
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Enrollment | device_management |
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational | device_management |
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Sync | device_management |
Microsoft-Windows-FileShareShadowCopyProvider/Operational | backup |
Microsoft-Windows-HostGuardianService-Client/Operational | virtualization |
Microsoft-Windows-Hyper-V-Compute-Admin | virtualization |
Microsoft-Windows-Hyper-V-Compute-Operational | virtualization |
Microsoft-Windows-Hyper-V-Hypervisor-Admin | virtualization |
Microsoft-Windows-Hyper-V-Hypervisor-Operational | virtualization |
Microsoft-Windows-Hyper-V-StorageVSP-Admin | virtualization |
Microsoft-Windows-Hyper-V-VMMS-Admin | virtualization |
Microsoft-Windows-Hyper-V-VMMS-Networking | virtualization |
Microsoft-Windows-Hyper-V-VMMS-Operational | virtualization |
Microsoft-Windows-Hyper-V-Worker-Admin | virtualization |
Microsoft-Windows-Hyper-V-Worker-Operational | virtualization |
Microsoft-Windows-International/Operational | |
Microsoft-Windows-LanguagePackSetup/Operational | patching |
Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Admin | device_management |
Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot | device_management |
Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Diagnostics | device_management |
Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService | device_management |
Microsoft-Windows-MUI/Operational | patching |
Microsoft-Windows-PrintBRM/Admin | printing |
Microsoft-Windows-PrintService/Admin | printing |
Microsoft-Windows-PrintService/Operational | printing |
Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin | device_management |
Microsoft-Windows-Provisioning-Diagnostics-Provider/AutoPilot | device_management |
Microsoft-Windows-Provisioning-Diagnostics-Provider/ManagementService | device_management |
Microsoft-Windows-Security-SPP-UX-Notifications/ActionCenter | licensing |
Microsoft-Windows-ServerManager-DeploymentProvider/Operational | patching |
Microsoft-Windows-ServerManager-MgmtProvider/Operational | |
Microsoft-Windows-TaskScheduler/Operational | scheduled_tasks |
Microsoft-Windows-VHDMP-Operational | virtualization |
Microsoft-Windows-VolumeSnapshot-Driver/Operational | backup |
Microsoft-Windows-WindowsUpdateClient/Operational | patching |
Microsoft-Windows-WinRM/Operational | rmm |
Microsoft-Windows-WMI-Activity/Operational | rmm |
Severity
This feed is bound for collection but is not yet curated per event. Every event keeps the severity its own provider stated, capped at Warning.
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.