<?xml version="1.0" encoding="UTF-8"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v3" manifestVersion="1.0" copyright="Copyright (c) Microsoft Corporation. All Rights Reserved.">
  <assemblyIdentity name="Microsoft-Windows-Wininit-Events" version="6.1.7600.16385" processorArchitecture="x86" language="neutral" buildType="release" publicKeyToken="31bf3856ad364e35" versionScope="nonSxS" />
  <localization>
    <resources culture="en-US">
      <stringTable>
        <string id="event_WININIT_APPINIT_DLLS_ENABLED" value="Custom dynamic link libraries are being loaded for every application. The system administrator should review the list of libraries to ensure they are related to trusted applications." />
        <string id="event_WININIT_AUTOCHK_DATA" value="%1" />
        <string id="event_WININIT_EXIT" value="Windows start-up process has unexpectedly terminated." />
        <string id="event_WININIT_REMOTE_SHUTDOWN_INIT_FAILED" value="Windows start-up process has failed to start the remote shutdown server." />
        <string id="event_WININIT_SETUP_LSA_STALL" value="Windows start-up process has failed to synchronize with the local security subsystem during setup." />
        <string id="event_WININIT_SHUTDOWN_WINDOWS_FAILURE" value="Windows start-up process has failed to terminate system processes." />
        <string id="event_WININIT_SYSTEM_PROCESS_FAILED" value="A critical system process, %1, failed with status code %2.  The machine must now be restarted." />
        <string id="eventProviderName" value="Microsoft-Windows-Wininit" />
      </stringTable>
    </resources>
  </localization>
  <instrumentation>
    <events xmlns="http://schemas.microsoft.com/win/2004/08/events">
      <provider guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" message="$(string.eventProviderName)" messageFileName="%SystemRoot%\system32\wininit.exe" name="Microsoft-Windows-Wininit" resourceFileName="%SystemRoot%\system32\wininit.exe" symbol="MS_Wininit_Provider">
        <channels>
          <channel chid="defch" name="Microsoft-Windows-Wininit/Diagnostic" type="Analytic" />
          <importChannel chid="chidSystem" name="System" />
        </channels>
        <keywords>
          <keyword mask="0x10000" name="PerfInstrumentation" />
          <keyword mask="0x20000" name="PerfDiagnostics" />
        </keywords>
        <templates>
          <template tid="Status">
            <data inType="win:UInt32" name="Win32Status" />
          </template>
          <template tid="LogoffRequest">
            <data inType="win:UInt32" name="SessionId" />
            <data inType="win:UInt32" name="Flags" />
          </template>
          <template tid="ShutdownRequest">
            <data inType="win:UInt32" name="SessionId" />
            <data inType="win:UInt32" name="IsRemote" />
            <data inType="win:UInt32" name="GracePeriod" />
            <data inType="win:UInt32" name="Flags" />
            <data inType="win:UInt32" name="Reason" />
            <data inType="win:UnicodeString" name="Message" />
          </template>
          <template tid="ShutdownWindowsFlags">
            <data inType="win:UInt32" name="Flags" />
          </template>
          <template tid="tidStringList">
            <data inType="win:UInt32" name="StringCount" />
            <data count="StringCount" inType="win:UnicodeString" name="String" />
          </template>
        </templates>
        <tasks>
          <task name="WaitForWinstationShutdown" value="1" />
          <task name="PreShutdownNotification" value="3" />
          <task name="WaitForSystemProcesses" value="5" />
          <task name="ShutdownSystemRestore" value="7" />
          <task name="ShutdownWindows" value="9" />
          <task name="NtShutdownSystem" value="51" />
          <task name="SentLogoffRequest" value="53" />
          <task name="ReceivedShutdownRequest" value="55" />
          <task name="ShutdownDiagnostics" value="6001" />
        </tasks>
        <events>
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIEvt_WaitForWinstationShutdown_Start" task="WaitForWinstationShutdown" value="1" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Stop" symbol="WIEvt_WaitForWinstationShutdown_Stop" task="WaitForWinstationShutdown" value="2" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIEvt_PreShutdownNotification_Start" task="PreShutdownNotification" value="3" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Stop" symbol="WIEvt_PreShutdownNotification_Stop" task="PreShutdownNotification" value="4" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIEvt_WaitForSystemProcesses_Start" task="WaitForSystemProcesses" value="5" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Stop" symbol="WIEvt_WaitForSystemProcesses_Stop" task="WaitForSystemProcesses" value="6" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIEvt_ShutdownSystemRestore_Start" task="ShutdownSystemRestore" value="7" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Stop" symbol="WIEvt_ShutdownSystemRestore_Stop" task="ShutdownSystemRestore" value="8" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIEvt_ShutdownWindows_Start" task="ShutdownWindows" template="ShutdownWindowsFlags" value="9" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Stop" symbol="WIEvt_ShutdownWindows_Stop" task="ShutdownWindows" template="Status" value="10" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Info" symbol="WIEvt_NtShutdownSystem_Info" task="NtShutdownSystem" value="51" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Info" symbol="WIEvt_SentLogoffRequest_Info" task="SentLogoffRequest" template="LogoffRequest" value="53" />
          <event channel="defch" keywords="PerfInstrumentation" level="win:Informational" opcode="win:Info" symbol="WIEvt_ReceivedShutdownRequest_Info" task="ReceivedShutdownRequest" template="ShutdownRequest" value="55" />
          <event channel="defch" keywords="PerfDiagnostics PerfInstrumentation" level="win:Informational" opcode="win:Start" symbol="WIDiagEvt_ShutdownDiagnostics_Start" task="ShutdownDiagnostics" template="ShutdownWindowsFlags" value="6001" />
          <event channel="chidSystem" level="win:Warning" message="$(string.event_WININIT_APPINIT_DLLS_ENABLED)" symbol="WIEvt_AppInit_DLLs_Enabled" template="tidStringList" value="11" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_AUTOCHK_DATA)" symbol="EVENT_WININIT_AUTOCHK_DATA" value="0x400003E9" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_SYSTEM_PROCESS_FAILED)" symbol="EVENT_WININIT_SYSTEM_PROCESS_FAILED" value="0xC00003F7" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_EXIT)" symbol="EVENT_WININIT_EXIT" value="0xC0000BBA" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_REMOTE_SHUTDOWN_INIT_FAILED)" symbol="EVENT_WININIT_REMOTE_SHUTDOWN_INIT_FAILED" value="0x80000BBB" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_SETUP_LSA_STALL)" symbol="EVENT_WININIT_SETUP_LSA_STALL" value="0x80000BBC" />
          <event keywords="win:EventlogClassic" message="$(string.event_WININIT_SHUTDOWN_WINDOWS_FAILURE)" symbol="EVENT_WININIT_SHUTDOWN_WINDOWS_FAILURE" value="0xC0000BBD" />
        </events>
      </provider>
    </events>
  </instrumentation>
</assembly>