Elastic Windows Event Explorer


Publisher - Microsoft-Windows-UserModePowerService

Event ID 51

Message:

Process %{ProcessPath} (process ID:%{ProcessPid}) reset overlay policy scheme from %{OldSchemeGuid} to %{NewSchemeGuid}

Event Data:

# Name In Type
Out Type
1 ProcessPath win:UnicodeString xs:string
2 ProcessPid win:UInt32 xs:unsignedInt
3 OldSchemeGuid win:GUID xs:GUID
4 NewSchemeGuid win:GUID xs:GUID

Observed Windows Versions:

Version: 0

Fingerprint: GVB4BMERVJX3S