===========
KEY:
Log		-> Log directory within Event Viewer
Source	-> Source shown on Event Viewer
ID		-> Event ID shown on Event Viewer
TaskCategory -> Task Category shown on Event Viewer
Desc	-> Description of Event within Event Viewer
Context	-> Added context from me
===========



{
	Log = /Windows Logs/Application

	Source = "ESENT"

	ID = 102  (Application)

	TaskCategory = "Search service"

	Desc {
		"SearchIndexer (748,P,98) Windows: The database engine (10.00.19045.0000) is starting a new instance (0)."
	}

	Context {
		"The Windows Search indexer started a new instance, which happens during boot."
	}
}


{
	Log = /Windows Logs/Application

	Source = "Search"

	ID = 1003

	TaskCategory = "Search service"

	Desc {
		"The Windows Search Service started.
		"
	}

	Context {
		"The Windows Search service started, which happens during boot."
	}
}


{
	Log = /Windows Logs/Application

	Source = "MsiInstaller"

	ID = 1040

	TaskCategory = "None"

	Desc {
		"Beginning a Windows Installer transaction: C:\Users\Administrator\Downloads\spacedesk_driver_Win_10_64_v2115.msi. Client
		Process Id: 6392."
	}

	Context {
		"A screen sharing process is being initiated during startup of Windows, because it is a startup program."
	}
}


{
	Log = /Windows Logs/Application

	Source = "MsiInstaller"

	ID = 1033

	TaskCategory = "None"

	Desc {
		"Windows Installer installed the product. Product Name: spacedesk Windows DRIVER. Product Version: 2.1.15.0. Product Language:
		1033. Manufacturer: datronicsoft Inc.. Installation success or error status: 0."
	}

	Context {
		"A screen sharing process is being initiated during startup of Windows, because it is a startup program."
	}
}


{
	Log = /Windows Logs/Application

	Source = "MsiInstaller"

	ID = 1042

	TaskCategory = "None"

	Desc {
		"Ending a Windows Installer transaction: C:\Users\Administrator\Downloads\spacedesk_driver_Win_10_64_v2115.msi. Client Process Id: 6392."
	}

	Context {
		"A screen sharing process is being killed during shutdown of Windows"
	}
}


{
	Log = /Windows Logs/Application

	Source = "User Profile Service"

	ID = 1531

	TaskCategory = "None"

	Desc {
		"The User Profile Service has started successfully.

		"
	}
}


{
	Log = /Windows Logs/Application

	Source = "WMI"

	ID = 5611

	TaskCategory = "Search service"

	Desc {
		"The Windows Management Instrumentation service has detected an inconsistent system shutdown."
	}

	Context {
		"An inconsistent system shutdown was detected during a boot."
	}
}


{
	Log = /Windows Logs/Application

	Source = "RestartManager"

	ID = 10000

	TaskCategory = "None"

	Desc {
		"Starting session 0 - ‎2024‎-‎03‎-‎31T03:00:03.907724400Z."
	}

	Context {
		"Session 0 starts, which is a process that happens when Windows boots up."
	}
}


{
	Log = /Windows Logs/Application

	Source = "RestartManager"

	ID = 10001

	TaskCategory = "None"

	Desc {
		"Ending session 0 started ‎2024‎-‎03‎-‎31T03:00:03.907724400Z."
	}

	Context {
		"Session 0 ends, which happens when Windows shuts down."
	}
}


{
	Log = /Windows Logs/Application

	Source = "MsiInstaller"

	ID = 11707

	TaskCategory = "None"

	Desc {
		"Product: spacedesk Windows DRIVER -- Installation completed successfully."
	}

	Context {
		"A screen sharing process starts during startup of Windows, because it is a startup program."
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-General"

	ID = 12  (System)

	TaskCategory = "(1)"

	Desc {
		"The operating system started at system time ‎2024‎-‎04‎-‎01T08:05:09.500000000Z."
	}

	Context {
		"Logs Operating System exact startup time"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-General"

	ID = 13

	TaskCategory = "(2)"

	Desc {
		"The operating system is shutting down at system time ‎2024‎-‎04‎-‎01T08:04:52.927435100Z."
	}

	Context {
		"Logs Operating System exact shutdown time"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 18

	TaskCategory = "(57)"

	Desc {
		"There are 0x1 boot options on this system."
	}

	Context {
		"Lists boot options during boot"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 20

	TaskCategory = "(31)"

	Desc {
		"The last shutdown's success status was true. The last boot's success status was true."
	}

	Context {
		"Shutdown success status"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 20

	TaskCategory = "(6)"

	Desc {
		"The leap second configuration has been updated.
		Reason: Leap second data initialized from registry during boot
		Leap seconds enabled: true
		New leap second count: 0
		Old leap second count: 0"
	}

	Context {
		"Updating leap second configuration during boot."
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 25

	TaskCategory = "(32)"

	Desc {
		"The boot menu policy was 0x1."
	}

	Context {
		"Logs boot menu policy during boot"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 27

	TaskCategory = "(33)"

	Desc {
		"The boot type was 0x0."
	}

	Context {
		"Logs boot type during boot"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 30

	TaskCategory = "(21)"

	Desc {
		"The firmware reported boot metrics."
	}

	Context {
		"Firmware reporting boot metrics during boot"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 32

	TaskCategory = "(58)"

	Desc {
		"The bootmgr spent 0 ms waiting for user input."
	}

	Context {
		"Boot manager waits for user's input for specified milliseconds"
	}
}


{
	Log = /Windows Logs/System

	Source = "Ntfs (Microsoft-Windows-Ntfs)"

	ID = 98

	TaskCategory = "None"

	Desc {
		"Volume C: (\Device\HarddiskVolume6) is healthy.  No action is needed."
	}

	Context {
		"Chkdsk at boot"
	}
}



{
	Log = /Windows Logs/System

	Source = "Kernel-Power"

	ID = 109

	TaskCategory = "(103)"

	Desc {
		"The kernel power manager has initiated a shutdown transition.

		Shutdown Reason: Kernel API"
	}

	Context {
		"Kernel power manager is initiating a shutdown"
	}
}


{
	Log = /Windows Logs/System

	Source = "Kernel-Boot"

	ID = 153

	TaskCategory = "(62)"

	Desc {
		"Virtualization-based security (policies: 0) is disabled."
	}

	Context {
		"Something that happens during boot"
	}
}



{
	Log = /Windows Logs/System

	Source = "User32"

	ID = 1074

	TaskCategory = "None"

	Desc {
		"The process C:\Windows\System32\RuntimeBroker.exe (DESKTOP-C8KOR5V) has initiated the restart of computer DESKTOP-C8KOR5V on
		behalf of user DESKTOP-C8KOR5V\Administrator for the following reason: Other (Unplanned)
		 Reason Code: 0x0
		 Shutdown Type: restart
		 Comment: "
	}

	Context {
		"Verbose log of shutdown inititation"
	}
}


{
	Log = /Windows Logs/System

	Source = "EventLog"

	ID = 6005

	TaskCategory = "None"

	Desc {
		"The Event log service was started."
	}

	Context {
		"Time where Event viewer service started at startup"
	}
}


{
	Log = /Windows Logs/System

	Source = "EventLog"

	ID = 6006

	TaskCategory = "None"

	Desc {
		"The Event log service was stopped."
	}

	Context {
		"Time where Event viewer service stopped at startup"
	}
}


{
	Log = /Windows Logs/System

	Source = "EventLog"

	ID = 6008

	TaskCategory = "None"

	Desc {
		"The previous system shutdown at 3:48:31 AM on ‎4/‎1/‎2024 was unexpected."
	}

	Context {
		"Tells you an unnexpected shutdown happened at last shutdown time"
	}
}


{
	Log = /Windows Logs/System

	Source = "EventLog"

	ID = 6013

	TaskCategory = "None"

	Desc {
		"The system uptime is 28 seconds."
	}

	Context {
		"Recording system uptime after booting"
	}
}


{
	Log = /Windows Logs/System

	Source = "DriverFrameworks-UserMode"

	ID = 10118

	TaskCategory = "Startup of the UMDF reflector"

	Desc {
		"UMDF reflector is unable to connect to service control manager (SCM). This is expected during boot, when SCM has not started
		yet. Will retry when it starts."
	}

	Context {
		"UMDF reflector tries to connect during boot, but fails, and then recognizes it's during a boot."
	}
}