diff --git a/internal/gcs-sidecar/bridge.go b/internal/gcs-sidecar/bridge.go index 87472cc4a2..1923ee3ded 100644 --- a/internal/gcs-sidecar/bridge.go +++ b/internal/gcs-sidecar/bridge.go @@ -172,6 +172,7 @@ func (b *Bridge) AssignHandlers() { b.HandleFunc(prot.RPCDeleteContainerState, b.deleteContainerState) b.HandleFunc(prot.RPCUpdateContainer, b.updateContainer) b.HandleFunc(prot.RPCLifecycleNotification, b.lifecycleNotification) + b.HandleFunc(prot.RPCModifyServiceSettings, b.modifyServiceSettings) } // readMessage reads the message from io.Reader diff --git a/internal/gcs-sidecar/handlers.go b/internal/gcs-sidecar/handlers.go index 2eee764569..1b1e30d542 100644 --- a/internal/gcs-sidecar/handlers.go +++ b/internal/gcs-sidecar/handlers.go @@ -23,6 +23,7 @@ import ( oci "github.com/Microsoft/hcsshim/internal/oci" "github.com/Microsoft/hcsshim/internal/protocol/guestrequest" "github.com/Microsoft/hcsshim/internal/protocol/guestresource" + "github.com/Microsoft/hcsshim/internal/vm/vmutils/etw" "github.com/Microsoft/hcsshim/internal/windevice" "github.com/Microsoft/hcsshim/pkg/annotations" "github.com/Microsoft/hcsshim/pkg/cimfs" @@ -491,6 +492,70 @@ func (b *Bridge) lifecycleNotification(req *request) (err error) { return nil } +func (b *Bridge) modifyServiceSettings(req *request) (err error) { + _, span := oc.StartSpan(req.ctx, "sidecar::modifyServiceSettings") + defer span.End() + defer func() { oc.SetSpanStatus(span, err) }() + + // Todo: Add policy enforcement for modifying service settings + modifyRequest, err := unmarshalModifyServiceSettings(req) + if err != nil { + return fmt.Errorf("failed to unmarshal modifyServiceSettings request: %w", err) + } + + switch modifyRequest.PropertyType { + case string(prot.LogForwardService): + if modifyRequest.Settings != nil { + log.G(req.ctx).Tracef("modifyServiceSettings for LogForwardService with RPCModifyServiceSettings, enforcing policy for log sources") + settings := modifyRequest.Settings.(*guestrequest.LogForwardServiceRPCRequest) + + switch settings.RPCType { + case guestrequest.RPCModifyServiceSettings, guestrequest.RPCStartLogForwarding, guestrequest.RPCStopLogForwarding: + log.G(req.ctx).Tracef("%v request received for LogForwardService, proceeding with policy enforcement for log sources", settings.RPCType) + // Enforce the policy for log sources in the request and update the settings with allowed log sources. + // For cwcow, the sidecar-GCS will verify the allowed log sources against policy and append the necessary GUIDs to the ones allowed. Rest are dropped. + // The Enforcer will have to unmarshal the log sources, enforce the policy and then marshal it back to a Base64 encoded JSON string which is what inbox GCS expects. + // It can query etw.GetDefaultLogSources to get the default log sources if the policy allows, and allow providers matching the default list during policy enforcement. + // This is because the log sources can be a combination of default and user specified log sources for which GUIDs need to be appended based on the policy enforcement. + if settings.Settings != "" { + // + // allowedLogSources, err := b.hostState.securityOptions.PolicyEnforcer.EnforceLogForwardServiceSettingsPolicy(req.ctx, settings.LogSources) + + // For now, we are skipping the policy enforcement and allowing all log sources as the policy enforcer implementation is in progress. We will add the enforcement back once it's implemented. + allowedLogSources := settings.Settings // This is Base64 encoded JSON string of log sources + log.G(req.ctx).Tracef("Allowed log sources after policy enforcement: %v", allowedLogSources) + + // Update the allowed log sources in the settings. This will be forwarded to inbox GCS which expects the log sources in a JSON string format with GUIDs for providers included. + allowedLogSources, err := etw.UpdateLogSources(allowedLogSources, false, true) + if err != nil { + return fmt.Errorf("failed to update log sources: %w", err) + } + settings.Settings = allowedLogSources + } + default: + log.G(req.ctx).Warningf("modifyServiceSettings for LogForwardService with RPCType: %v, skipping policy enforcement", settings.RPCType) + } + modifyRequest.Settings = settings + buf, err := json.Marshal(modifyRequest) + if err != nil { + return fmt.Errorf("failed to marshal modifyServiceSettings request: %w", err) + } + var newRequest request + newRequest.ctx = req.ctx + newRequest.header = req.header + newRequest.header.Size = uint32(len(buf)) + prot.HdrSize + newRequest.message = buf + req = &newRequest + } else { + log.G(req.ctx).Warningf("modifyServiceSettings for LogForwardService with empty settings, skipping policy enforcement") + } + default: + log.G(req.ctx).Warningf("modifyServiceSettings with PropertyType: %v, skipping policy enforcement", modifyRequest.PropertyType) + } + b.forwardRequestToGcs(req) + return nil +} + func volumeGUIDFromLayerPath(path string) (string, bool) { if p, ok := strings.CutPrefix(path, `\\?\Volume{`); ok { if q, ok := strings.CutSuffix(p, `}\Files`); ok { diff --git a/internal/gcs-sidecar/uvm.go b/internal/gcs-sidecar/uvm.go index b3a7792fd4..af560d132b 100644 --- a/internal/gcs-sidecar/uvm.go +++ b/internal/gcs-sidecar/uvm.go @@ -17,6 +17,37 @@ import ( "github.com/Microsoft/hcsshim/internal/protocol/guestresource" ) +func unmarshalModifyServiceSettings(req *request) (_ *prot.ServiceModificationRequest, err error) { + ctx, span := oc.StartSpan(req.ctx, "sidecar::unmarshalModifyServiceSettings") + defer span.End() + defer func() { oc.SetSpanStatus(span, err) }() + + var serviceModifyRequest prot.ServiceModificationRequest + var requestRawSettings json.RawMessage + serviceModifyRequest.Settings = &requestRawSettings + if err := commonutils.UnmarshalJSONWithHresult(req.message, &serviceModifyRequest); err != nil { + return nil, fmt.Errorf("failed to unmarshal rpcModifySettings: %w", err) + } + + if serviceModifyRequest.PropertyType != "" { + switch serviceModifyRequest.PropertyType { + case string(prot.LogForwardService): + log.G(ctx).Info("Unmarshalling log forward service modify settings") + settings := &guestrequest.LogForwardServiceRPCRequest{} + if err := commonutils.UnmarshalJSONWithHresult(requestRawSettings, settings); err != nil { + return nil, fmt.Errorf("invalid LogForwardService modify settings request: %w", err) + } + serviceModifyRequest.Settings = settings + default: + // Invalid request + log.G(ctx).Errorf("Invalid ServiceModificationRequest: %v", serviceModifyRequest.PropertyType) + return nil, fmt.Errorf("invalid ServiceModificationRequest") + } + } + + return &serviceModifyRequest, nil +} + func unmarshalContainerModifySettings(req *request) (_ *prot.ContainerModifySettings, err error) { ctx, span := oc.StartSpan(req.ctx, "sidecar::unmarshalContainerModifySettings") defer span.End() diff --git a/internal/oci/uvm.go b/internal/oci/uvm.go index 6a330dd344..5bfa68f7f0 100644 --- a/internal/oci/uvm.go +++ b/internal/oci/uvm.go @@ -419,12 +419,14 @@ func SpecToUVMCreateOpts(ctx context.Context, s *specs.Spec, id, owner string) ( if err := handleWCOWSecurityPolicy(ctx, s.Annotations, wopts); err != nil { return nil, err } - // If security policy is enable, wopts.ForwardLogs default value should be false + // If security policy is enable, wopts.LogForwardingEnabled default value should be false (CWCOW should not allow log forwarding by default) if wopts.SecurityPolicyEnabled { - wopts.ForwardLogs = false + wopts.LogForwardingEnabled = false } wopts.LogSources = ParseAnnotationsString(s.Annotations, annotations.LogSources, wopts.LogSources) - wopts.ForwardLogs = ParseAnnotationsBool(ctx, s.Annotations, annotations.ForwardLogs, wopts.ForwardLogs) + wopts.LogForwardingEnabled = ParseAnnotationsBool(ctx, s.Annotations, annotations.LogForwardingEnabled, wopts.LogForwardingEnabled) + wopts.DefaultLogSourcesEnabled = ParseAnnotationsBool(ctx, s.Annotations, annotations.DefaultLogSourcesEnabled, wopts.DefaultLogSourcesEnabled) + return wopts, nil } return nil, errors.New("cannot create UVM opts spec is not LCOW or WCOW") diff --git a/internal/uvm/create_wcow.go b/internal/uvm/create_wcow.go index 72308cf82b..452d2686c1 100644 --- a/internal/uvm/create_wcow.go +++ b/internal/uvm/create_wcow.go @@ -70,9 +70,10 @@ type OptionsWCOW struct { // AdditionalRegistryKeys are Registry keys and their values to additionally add to the uVM. AdditionalRegistryKeys []hcsschema.RegistryValue - OutputHandlerCreator vmutils.OutputHandlerCreator // Creates an [OutputHandler] that controls how output received over HVSocket from the UVM is handled. Defaults to parsing output as ETW Log events - LogSources string // ETW providers to be set for the logging service - ForwardLogs bool // Whether to forward logs to the host or not + OutputHandlerCreator vmutils.OutputHandlerCreator // Creates an [OutputHandler] that controls how output received over HVSocket from the UVM is handled. Defaults to parsing output as ETW Log events + LogSources string // ETW providers to be set for the logging service + LogForwardingEnabled bool // Whether to enable forwarding of logs to the host or not + DefaultLogSourcesEnabled bool // Whether to enable using default log sources } func defaultConfidentialWCOWOSBootFilesPath() string { @@ -111,9 +112,10 @@ func NewDefaultOptionsWCOW(id, owner string) *OptionsWCOW { SecurityPolicyEnabled: false, }, }, - OutputHandlerCreator: vmutils.ParseGCSLogrus, - ForwardLogs: true, // Default to true for WCOW, and set to false for CWCOW in internal/oci/uvm.go SpecToUVMCreateOpts - LogSources: "", + OutputHandlerCreator: vmutils.ParseGCSLogrus, + LogForwardingEnabled: true, // Default to true for WCOW, and set to false for CWCOW in internal/oci/uvm.go SpecToUVMCreateOpts + DefaultLogSourcesEnabled: true, + LogSources: "", } } @@ -291,7 +293,7 @@ func prepareCommonConfigDoc(ctx context.Context, uvm *UtilityVM, opts *OptionsWC } maps.Copy(doc.VirtualMachine.Devices.HvSocket.HvSocketConfig.ServiceTable, opts.AdditionalHyperVConfig) - if opts.ForwardLogs { + if opts.LogForwardingEnabled { key := prot.WindowsLoggingHvsockServiceID.String() doc.VirtualMachine.Devices.HvSocket.HvSocketConfig.ServiceTable[key] = hcsschema.HvSocketServiceConfig{ AllowWildcardBinds: true, @@ -562,22 +564,23 @@ func CreateWCOW(ctx context.Context, opts *OptionsWCOW) (_ *UtilityVM, err error log.G(ctx).WithField("options", log.Format(ctx, opts)).Debug("uvm::CreateWCOW options") uvm := &UtilityVM{ - id: opts.ID, - owner: opts.Owner, - operatingSystem: "windows", - scsiControllerCount: opts.SCSIControllerCount, - vsmbDirShares: make(map[string]*VSMBShare), - vsmbFileShares: make(map[string]*VSMBShare), - vpciDevices: make(map[VPCIDeviceID]*VPCIDevice), - noInheritHostTimezone: opts.NoInheritHostTimezone, - physicallyBacked: !opts.AllowOvercommit, - devicesPhysicallyBacked: opts.FullyPhysicallyBacked, - vsmbNoDirectMap: opts.NoDirectMap, - noWritableFileShares: opts.NoWritableFileShares, - createOpts: opts, - blockCIMMounts: make(map[string]*UVMMountedBlockCIMs), - logSources: opts.LogSources, - forwardLogs: opts.ForwardLogs, + id: opts.ID, + owner: opts.Owner, + operatingSystem: "windows", + scsiControllerCount: opts.SCSIControllerCount, + vsmbDirShares: make(map[string]*VSMBShare), + vsmbFileShares: make(map[string]*VSMBShare), + vpciDevices: make(map[VPCIDeviceID]*VPCIDevice), + noInheritHostTimezone: opts.NoInheritHostTimezone, + physicallyBacked: !opts.AllowOvercommit, + devicesPhysicallyBacked: opts.FullyPhysicallyBacked, + vsmbNoDirectMap: opts.NoDirectMap, + noWritableFileShares: opts.NoWritableFileShares, + createOpts: opts, + blockCIMMounts: make(map[string]*UVMMountedBlockCIMs), + logSources: opts.LogSources, + logForwardingEnabled: opts.LogForwardingEnabled, + defaultLogSourcesEnabled: opts.DefaultLogSourcesEnabled, } defer func() { @@ -617,7 +620,7 @@ func CreateWCOW(ctx context.Context, opts *OptionsWCOW) (_ *UtilityVM, err error return nil, fmt.Errorf("error while creating the compute system: %w", err) } - if opts.ForwardLogs { + if opts.LogForwardingEnabled { // Create a socket that the executed program can send to. This is usually // used by Log Forward Service to send log data. uvm.outputHandler = opts.OutputHandlerCreator(opts.ID) diff --git a/internal/uvm/log_wcow.go b/internal/uvm/log_wcow.go index 5a74bf34c9..e5b588eb6f 100644 --- a/internal/uvm/log_wcow.go +++ b/internal/uvm/log_wcow.go @@ -4,11 +4,13 @@ package uvm import ( "context" + "fmt" "github.com/Microsoft/hcsshim/internal/gcs" "github.com/Microsoft/hcsshim/internal/gcs/prot" "github.com/Microsoft/hcsshim/internal/log" "github.com/Microsoft/hcsshim/internal/protocol/guestrequest" + "github.com/Microsoft/hcsshim/internal/vm/vmutils/etw" ) func (uvm *UtilityVM) StartLogForwarding(ctx context.Context) error { @@ -62,13 +64,23 @@ func (uvm *UtilityVM) SetLogSources(ctx context.Context) error { wcaps := gcs.GetWCOWCapabilities(uvm.gc.Capabilities()) if wcaps != nil && wcaps.IsLogForwardingSupported() { // Make a call to the GCS to set the ETW providers + + // Determines the log sources to be set based on the configuration. If default log sources are enabled, + // we only include them along with user specified log sources. + // For confidential WCOw, we skip the adding guids to the log sources as the sidecar-GCS will verify the + // allowed log sources against policy and append the necessary GUIDs to the ones allowed. Rest are dropped. + // For non-confidential WCOW, we include the GUIDs in the log sources as the hcsshim communicates directly with the inboxGCS. + settings, err := etw.UpdateLogSources(uvm.logSources, uvm.defaultLogSourcesEnabled, !uvm.HasConfidentialPolicy()) + if err != nil { + return fmt.Errorf("failed to parse log sources: %w", err) + } req := guestrequest.LogForwardServiceRPCRequest{ RPCType: guestrequest.RPCModifyServiceSettings, - Settings: uvm.logSources, + Settings: settings, } - err := uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) + err = uvm.gc.ModifyServiceSettings(ctx, prot.LogForwardService, req) if err != nil { - return err + return fmt.Errorf("failed to modify service settings: %w", err) } } return nil diff --git a/internal/uvm/start.go b/internal/uvm/start.go index c6ba805304..5534962a39 100644 --- a/internal/uvm/start.go +++ b/internal/uvm/start.go @@ -285,7 +285,7 @@ func (uvm *UtilityVM) Start(ctx context.Context) (err error) { } } - if uvm.OS() == "windows" && uvm.forwardLogs { + if uvm.OS() == "windows" && uvm.logForwardingEnabled { // If the UVM is Windows and log forwarding is enabled, set the log sources // and start the log forwarding service. if err := uvm.SetLogSources(ctx); err != nil { diff --git a/internal/uvm/types.go b/internal/uvm/types.go index 84d08c0f2b..0fad6f2f5a 100644 --- a/internal/uvm/types.go +++ b/internal/uvm/types.go @@ -144,8 +144,9 @@ type UtilityVM struct { blockCIMMounts map[string]*UVMMountedBlockCIMs blockCIMMountLock sync.Mutex - forwardLogs bool // Indicates whether to forward logs from the UVM to the host - logSources string // ETW providers to enable for log forwarding + logForwardingEnabled bool // Indicates whether to forward logs from the UVM to the host + defaultLogSourcesEnabled bool // Specifies whether addition of default list of ETW providers should be disabled + logSources string // ETW providers to enable for log forwarding } func (uvm *UtilityVM) ScratchEncryptionEnabled() bool { diff --git a/internal/vm/vmutils/etw/default-sources.go b/internal/vm/vmutils/etw/default-sources.go new file mode 100644 index 0000000000..ee8f79466f --- /dev/null +++ b/internal/vm/vmutils/etw/default-sources.go @@ -0,0 +1,66 @@ +package etw + +// defaultLogSourcesInfo defines the list of trusted ETW providers +var defaultLogSourcesInfo = LogSourcesInfo{ + LogConfig: LogConfig{ + Sources: []Source{ + { + Type: "ETW", + Providers: []EtwProvider{ + { + ProviderName: "microsoft.windows.hyperv.compute", + Level: "Information", + }, + { + ProviderName: "microsoft-windows-guest-network-service", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.filesystem.cimfs", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.filesystem.unionfs", + Level: "Information", + }, + { + ProviderName: "microsoft-windows-bitlocker-driver", + Level: "Information", + }, + { + ProviderName: "microsoft-windows-bitlocker-api", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.security.keyguard", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.security.keyguard.attestation.verify", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.containers.setup", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.containers.storage", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.containers.library", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.containers.dynamicimage", + Level: "Information", + }, + { + ProviderName: "microsoft.windows.logforwardservice.provider", + Level: "Information", + }, + }, + }, + }, + }, +} diff --git a/internal/vm/vmutils/etw/default-sources_test.go b/internal/vm/vmutils/etw/default-sources_test.go new file mode 100644 index 0000000000..86d8108a19 --- /dev/null +++ b/internal/vm/vmutils/etw/default-sources_test.go @@ -0,0 +1,75 @@ +package etw + +import ( + "strings" + "testing" +) + +func TestDefaultSources_ETWProvidersExistInETWMap(t *testing.T) { + if len(etwNameToGUIDMap) == 0 { + t.Fatal("etwNameToGUIDMap is empty") + } + + for si, src := range defaultLogSourcesInfo.LogConfig.Sources { + // Only ETW sources should be validated against etwNameToGUIDMap. + if !strings.EqualFold(src.Type, "ETW") { + continue + } + + for pi, p := range src.Providers { + if p.ProviderName == "" { + t.Fatalf("empty ProviderName at source index %d provider index %d", si, pi) + } + + key := strings.ToLower(p.ProviderName) + if _, ok := etwNameToGUIDMap[key]; !ok { + t.Fatalf( + "provider not found in etwNameToGUIDMap: source index=%d provider index=%d provider=%q lookup key=%q", + si, pi, p.ProviderName, key, + ) + } + } + } +} +func TestDefaultSources_NoDuplicateProviders(t *testing.T) { + providerSet := make(map[string]struct{}) + + for si, src := range defaultLogSourcesInfo.LogConfig.Sources { + if !strings.EqualFold(src.Type, "ETW") { + continue + } + for pi, p := range src.Providers { + key := strings.ToLower(p.ProviderName) + if _, exists := providerSet[key]; exists { + t.Fatalf("duplicate provider found: source index=%d provider index=%d provider=%q", si, pi, p.ProviderName) + } + providerSet[key] = struct{}{} + } + } +} + +func TestDefaultSources_NoProviderGUIDProvided(t *testing.T) { + for si, src := range defaultLogSourcesInfo.LogConfig.Sources { + if !strings.EqualFold(src.Type, "ETW") { + continue + } + for pi, p := range src.Providers { + if p.ProviderGUID != "" { + t.Fatalf("ProviderGUID should not be provided: source index=%d provider index=%d provider=%q guid=%q", si, pi, p.ProviderName, p.ProviderGUID) + } + } + } +} + +func TestDefaultSources_AtLeastOneETWSource(t *testing.T) { + found := false + for _, src := range defaultLogSourcesInfo.LogConfig.Sources { + if strings.EqualFold(src.Type, "ETW") { + found = true + break + } + } + if !found { + t.Fatal("no ETW source found in defaultLogSourcesInfo") + } +} diff --git a/internal/vm/vmutils/etw/etw_map.go b/internal/vm/vmutils/etw/etw_map.go new file mode 100644 index 0000000000..13513e81d6 --- /dev/null +++ b/internal/vm/vmutils/etw/etw_map.go @@ -0,0 +1,1199 @@ +package etw + +// LOWERCASE ONLY keys for easier lookups and case-insensitive matching. +var etwNameToGUIDMap = map[string]string{ + "microsoft.windows.containers.setup": "22267b1c-b979-5c81-9e24-0db386a62dd1", + "microsoft.windows.containers.storage": "2551390d-5927-5c84-6f0a-027a7e78d38d", + "microsoft.windows.containers.library": "67eb0417-9297-42ae-a1d9-98bfeb359059", + "microsoft.windows.containers.dynamicimage": "8ce2286c-3705-4a2a-8e36-134eae9ca147", + "microsoft.windows.filesystem.cimfs": "772ff917-30cf-50bd-d471-55a093ea8cf8", + "microsoft.windows.filesystem.unionfs": "68d6ffd0-365a-579d-6d26-76b2a0af1ddc", + "microsoft-windows-guest-network-service": "0bacf1d2-fb51-549a-6119-04daa7180dc8", + "microsoft.windows.hyperv.compute": "80ce50de-d264-4581-950d-abadeee0d340", + "microsoft.windows.logforwardservice.provider": "396a26ff-fb73-5465-0d17-dd4930896239", + "microsoft.windows.security.keyguard": "37e53459-522d-5f7d-9a19-ecfd819075c2", + "microsoft.windows.security.keyguard.attestation.verify": "268833e4-8305-5640-ecee-0f30f10668be", + ".net common language runtime": "e13c0d23-ccbc-4e12-931b-d9cc2eee27e4", + "acpi driver trace provider": "dab01d4d-2d48-477d-b1c3-daad0ce6f06b", + "active directory domain services: sam": "8e598056-8993-11d2-819e-0000f875a064", + "active directory: kerberos client": "bba3add2-c229-4cdb-ae2b-57eb6966b0c4", + "active directory: netlogon": "f33959b4-dbec-11d2-895b-00c04f79ab69", + "adodb.1": "04c8a86f-3369-12f8-4769-24e484a9e725", + "adomd.1": "7ea56435-3f2f-3f63-a829-f0b35b5cad41", + "appagentruntime": "d38b3095-6abd-419f-a8d5-3d01b8b6a4e7", + "application error": "a0e9b465-b939-57d7-b27d-95d8e925ff57", + "application hang": "c631c3dc-c676-59e4-2db3-5c0af00f9675", + "application popup": "47bfa2b7-bd54-4fac-b70b-29021084ca8f", + "application-addon-event-provider": "a83fa99f-c356-4ded-9fd6-5a5eb8546d68", + "asp.net events": "aff081fe-0247-4275-9c4e-021f3dc1da35", + "ata port driver tracing provider": "d08bd885-501e-489a-bac6-b7d24bfe6bbf", + "authfw netshell plugin": "935f4ae6-845d-41c6-97fa-380dad429b72", + "bcp.1": "24722b88-df97-4ff6-e395-db533ac42a1e", + "bfe trace provider": "106b464a-8043-46b1-8cb8-e92a0cd7a560", + "bits service trace": "4a8aaa94-cfc4-46a7-8e4e-17bc45608f0a", + "bootstrapper": "498a78f0-d57b-488d-9666-b0e7f5473cd9", + "certificate services client credentialroaming trace": "ef4109dc-68fc-45af-b329-ca2825437209", + "certificate services client trace": "f01b7774-7ed7-401e-8088-b576793d7841", + "circular kernel session provider": "54dea73a-ed1f-42a4-af71-3e63d056f174", + "classpnp driver tracing provider": "fa8de7c4-acde-4443-9994-c4e2359a9edb", + "critical section trace provider": "3ac66736-cc59-4cff-8115-8df50e39816b", + "dbnetlib.1": "bd568f20-fccd-b948-054e-db3421115d61", + "deduplication tracing provider": "5ebb59d1-4739-4e45-872d-b8703956d84b", + "disk class driver tracing provider": "945186bf-3dd6-4f3f-9c8e-9edd3fc9d558", + "downlevel ipsec api": "94335eb3-79ea-44d5-8ea9-306f49b3a041", + "downlevel ipsec netshell plugin": "e4ff10d8-8a88-4fc6-82c8-8c23e9462fe5", + "downlevel ipsec policy store": "94335eb3-79ea-44d5-8ea9-306f49b3a070", + "downlevel ipsec service": "94335eb3-79ea-44d5-8ea9-306f49b3a040", + "ea ime api": "e2a24a32-00dc-4025-9689-c108c01991c5", + "error instrument": "cd7cf0d0-02cc-4872-9b65-0dba0a90efe8", + "fd core trace": "480217a9-f824-4bd4-bbe8-f371caaf9a0d", + "fd publication trace": "649e3596-2620-4d58-a01f-17aefe8185db", + "fd ssdp trace": "db1d0418-105a-4c77-9a25-8f96a19716a4", + "fd wnet trace": "8b20d3e4-581f-4a27-8109-df01643a7a93", + "fd wsdapi trace": "7e2dbfc7-41e8-4987-bca7-76cadfad765f", + "fdphost service trace": "f1c521ca-da82-4d79-9ee4-d7a375723b68", + "file kernel trace; operation set 1": "d75d8303-6c21-4bde-9c98-ecc6320f9291", + "file kernel trace; operation set 2": "058dd951-7604-414d-a5d6-a56d35367a46", + "file kernel trace; optional data": "7da1385c-f8f5-414d-b9d0-02fca090f1ec", + "file kernel trace; volume to log": "127d46af-4ad3-489f-9165-f00ba64d5467", + "fwpkclnt trace provider": "ad33fa19-f2d2-46d1-8f4c-e3c3087e45ad", + "fwpuclnt trace provider": "5a1600d2-68e5-4de7-bcf4-1c2d215fe0fe", + "heap trace provider": "222962ab-6180-4b88-a825-346b75f2a24a", + "iisconfigurator": "753dc014-8b03-40d0-9ea9-1af6b3084e0a", + "iishost": "7f3d17a3-0a3d-43f1-bbf2-80e3bb04d54d", + "ikeext trace provider": "106b464d-8043-46b1-8cb8-e92a0cd7a560", + "imapi1 shim": "1ff10429-99ae-45bb-8a67-c9e945b9fb6c", + "imapi2 concatenate stream": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9d", + "imapi2 disc master": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e91", + "imapi2 disc recorder": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e93", + "imapi2 disc recorder enumerator": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e92", + "imapi2 dll": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e90", + "imapi2 interleave stream": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9e", + "imapi2 media eraser": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e97", + "imapi2 msf": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9f", + "imapi2 multisession sequential": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7ea0", + "imapi2 pseudo-random stream": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9c", + "imapi2 raw cd writer": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9a", + "imapi2 raw image writer": "07e397ec-c240-4ed7-8a2a-b9ff0fe5d581", + "imapi2 standard data writer": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e98", + "imapi2 track-at-once cd writer": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e99", + "imapi2 utilities": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e94", + "imapi2 write engine": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e96", + "imapi2 zero stream": "0e85a5a5-4d5c-44b7-8bda-5b7ab54f7e9b", + "imapi2fs tracing": "f8036571-42d9-480a-babb-de7833cb059c", + "intel-ialpss-gpio": "d386cc7a-620a-41c1-abf5-55018c6c699a", + "intel-ialpss-i2c": "d4aeac44-ad44-456e-9c90-33f8cdced6af", + "intel-ialpss2-gpio2": "63848cff-3ec7-4ddf-8072-5f95e8c8eb98", + "intel-ialpss2-i2c": "c2f86198-03ca-4771-8d4c-ce6e15cbca56", + "ipmi driver trace": "d5c6a3e9-fa9c-434e-9653-165b4fc869e4", + "ipmi provider trace": "651d672b-e11f-41b7-add3-c2f6a4023672", + "kmdfv1 trace provider": "544d4c9d-942c-46d5-bf50-df5cd9524a50", + "local security authority (lsa)": "cc85922f-db41-11d2-9244-006008269001", + "lsasrv": "199fe037-2b82-40a9-82ac-e1d46c792b99", + "microsoft-antimalware-amfilter": "cfeb0608-330e-4410-b00d-56d8da9986e6", + "microsoft-antimalware-engine": "0a002690-3839-4e3a-b3b6-96d8df868d99", + "microsoft-antimalware-engine-instrumentation": "68621c25-df8d-4a6b-aabc-19a22e296a7c", + "microsoft-antimalware-nis": "102aab0a-9d9c-4887-a860-55de33b96595", + "microsoft-antimalware-protection": "e4b70372-261f-4c54-8fa6-a5a7914d73da", + "microsoft-antimalware-rtp": "8e92deef-5e17-413b-b927-59b2f06a3cfc", + "microsoft-antimalware-scan-interface": "2a576b87-09a7-520e-c21a-4942f0271d67", + "microsoft-antimalware-service": "751ef305-6c6e-4fed-b847-02ef79d26aef", + "microsoft-antimalware-uacscan": "d37e7910-79c8-57c4-da77-52bb646364cd", + "microsoft-appv-client": "e4f68870-5ae8-4e5b-9ce7-ca9ed75b0245", + "microsoft-appv-client-streamingux": "28cb46c7-4003-4e50-8bd9-442086762d12", + "microsoft-appv-servicelog": "9cc69d1c-7917-4acd-8066-6bf8b63e551b", + "microsoft-appv-sharedperformance": "fb4a19ee-eb5a-47a4-bc52-e71aac6d0859", + "microsoft-autopilot-bootstrapperagent": "cb1ff6d6-3248-4484-b96e-0973f64838c4", + "microsoft-client-license-flexible-platform": "6e0df32c-7f11-54f7-e8ee-5ad4032727ce", + "microsoft-client-licensing-platform": "b6cc0d55-9ecc-49a8-b929-2b9022426f2a", + "microsoft-configmgr": "fd6007de-16d4-4d5b-a6d7-19aad3211528", + "microsoft-epm-events": "56b809b5-d9e6-4f21-a807-2a1e3ed4159e", + "microsoft-gaming-services": "bc1bdb57-71a2-581a-147b-e0b49474a2d4", + "microsoft-ie": "9e3b3947-ca5d-4614-91a2-7b624e0e7244", + "microsoft-ie-jsdumpheap": "7f8e35ca-68e8-41b9-86fe-d6adc5b327e7", + "microsoft-ieframe": "5c8bb950-959e-4309-8908-67961a1205d5", + "microsoft-intune-controlconfig-client-telemetry": "9d7adb63-2e58-4503-b3ce-9017d7c88537", + "microsoft-intune-epm-client-telemetry": "8ad61205-8e7e-4be4-8d30-e2480500b39a", + "microsoft-intune-sidecar-client-telemetry": "e20927af-32d7-4d5d-9f73-82f077a1c891", + "microsoft-inventory-events": "5e6ac3d4-6a7e-4fdc-98f8-7017e4f177bf", + "microsoft-jscript": "57277741-3638-4a4b-bdba-0ac6e45da56c", + "microsoft-office-events": "8736922d-e8b2-47eb-8564-23e77e728cf3", + "microsoft-office-word": "daf0b914-9c1c-450a-81b2-fea7244f6ffa", + "microsoft-office-word2": "bb00e856-a12f-4ab7-b2c8-4e80caea5b07", + "microsoft-office-word3": "a1b69d49-2195-4f59-9d33-bdf30c0fe473", + "microsoft-onecore-onlinesetup": "41862974-da3b-4f0b-97d5-bb29fbb9b71e", + "microsoft-perftrack-ieframe": "b2a40f1f-a05a-4dfd-886a-4c4f18c4334c", + "microsoft-perftrack-mshtml": "ffdb9886-80f3-4540-aa8b-b85192217ddf", + "microsoft-quic": "ff15e657-4f26-570e-88ab-0796b258d11c", + "microsoft-servicebus-client": "a307c7a2-a4cd-4d22-8093-94db72934152", + "microsoft-system-diagnostics-diagnosticinvoker": "9068a924-f97e-5506-c3a3-5c020c00e8e0", + "microsoft-user experience virtualization-admin": "61bc445e-7a8d-420e-ab36-9c7143881b98", + "microsoft-user experience virtualization-agent driver": "de29cf61-5ee6-43ff-9aac-959c4e13cc6c", + "microsoft-user experience virtualization-app agent": "1ed6976a-4171-4764-b415-7ea08bc46c51", + "microsoft-user experience virtualization-ipc": "21d79db0-8e03-41cd-9589-f3ef7001a92a", + "microsoft-user experience virtualization-sqm uploader": "57003e21-269b-4bdc-8434-b3bf8d57d2d5", + "microsoft-windows networking vpn plugin platform": "e5fc4a0f-7198-492f-9b0f-88fdcbfded48", + "microsoft-windows-aad": "4de9bc9c-b27a-43c9-8994-0915f1a5e24f", + "microsoft-windows-aadrt": "2dca52ac-167d-4d59-a491-c237bb978d83", + "microsoft-windows-accellib-accelcx": "9c4cf201-dd11-5e35-9de5-2c2146832011", + "microsoft-windows-acl-ui": "ea4cc8b8-a150-47a3-afb9-c8d194b19452", + "microsoft-windows-actionqueue": "0dd4d48e-2bbf-452f-a7ec-ba3dba8407ae", + "microsoft-windows-adsi": "7288c9f8-d63c-4932-a345-89d6b060174d", + "microsoft-windows-ait": "6addabf4-8c54-4eab-bf4f-fbef61b62eb0", + "microsoft-windows-all-user-install-agent": "d2e990da-8504-4702-a5e5-367fc2f823bf", + "microsoft-windows-apphost": "98e0765d-8c42-44a3-a57b-760d7f93225a", + "microsoft-windows-appid": "3cb2a168-fe19-4a4e-bdad-dcf422f13473", + "microsoft-windows-appidservicetrigger": "d02a9c27-79b8-40d6-9b97-cf3f8b7b5d60", + "microsoft-windows-applicabilityengine": "10a208dd-a372-421c-9d99-4fad6db68b62", + "microsoft-windows-application server-applications": "c651f5f6-1c0d-492e-8ae1-b4efd7c9d503", + "microsoft-windows-application-experience": "eef54e71-0661-422d-9a98-82fd4940b820", + "microsoft-windows-applicationexperience-cache": "6d8a3a60-40af-445a-98ca-99359e500146", + "microsoft-windows-applicationexperience-lookupservicetrigger": "18f4a5fd-fd3b-40a5-8fc2-e5d261c5d02e", + "microsoft-windows-applicationexperience-switchback": "17d6e590-f5fe-11dc-95ff-0800200c9a66", + "microsoft-windows-applicationexperienceinfrastructure": "5ec13d8e-4b3f-422e-a7e7-3121a1d90c7a", + "microsoft-windows-applocker": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "microsoft-windows-appmodel-exec": "eb65a492-86c0-406a-bace-9912d595bd69", + "microsoft-windows-appmodel-messagingdatamodel": "1e2462be-b025-48da-8c1f-7b60b8ccae53", + "microsoft-windows-appmodel-runtime": "f1ef270a-0d32-4352-ba52-dbab41e1d859", + "microsoft-windows-appmodel-state": "bff15e13-81bf-45ee-8b16-7cfead00da86", + "microsoft-windows-appreadiness": "f0be35f8-237b-4814-86b5-ade51192e503", + "microsoft-windows-appsruprov": "0cc157b3-cf07-4fc2-91ee-31ac92e05fe1", + "microsoft-windows-appxdeployment": "8127f6d4-59f9-4abf-8952-3e3a02073d5f", + "microsoft-windows-appxdeployment-server": "3f471139-acb7-4a01-b7a7-ff5da4ba2d43", + "microsoft-windows-appxdeployment-server-undockeddeh": "43833e12-078d-4d7d-8aaf-ae8c8520f18c", + "microsoft-windows-appxpackagingom": "ba723d81-0d0c-4f1e-80c8-54740f508ddf", + "microsoft-windows-asn1": "d92ef8ac-99dd-4ab8-b91d-c6eba85f3755", + "microsoft-windows-assignedaccess": "8530db6e-51c0-43d6-9d02-a8c2088526cd", + "microsoft-windows-assignedaccessbroker": "f2311b48-32be-4902-a22a-7240371dbb2c", + "microsoft-windows-asynchronouscausality": "19a4c69a-28eb-4d4b-8d94-5f19055a1b5c", + "microsoft-windows-ataport": "cb587ad1-cc35-4ef1-ad93-36cc82a2d319", + "microsoft-windows-audio": "ae4bd3be-f36f-45b6-8d21-bdd6fb832853", + "microsoft-windows-audit": "75ebc33e-0936-4a55-9d26-5f298f3180bf", + "microsoft-windows-audit-cve": "85a62a0d-7e17-485f-9d4f-749a287193a6", + "microsoft-windows-authenticationprovider": "dddc1d91-51a1-4a8d-95b5-350c4ee3d809", + "microsoft-windows-axinstallservice": "dab3b18c-3c0f-43e8-80b1-e44bc0dad901", + "microsoft-windows-backgroundtransfer-contentprefetcher": "648a0644-7d62-4fd3-8841-440064762f95", + "microsoft-windows-base-filtering-engine-connections": "121d3da8-baf1-4dcb-929f-2d4c9a47f7ab", + "microsoft-windows-base-filtering-engine-resource-flows": "92765247-03a9-4ae3-a575-b42264616e78", + "microsoft-windows-battery": "59819d0a-adaf-46b2-8d7c-990bc39c7c15", + "microsoft-windows-bfetriggerprovider": "54732ee5-61ca-4727-9da1-10be5a4f773d", + "microsoft-windows-biometrics": "a0e3d8ea-c34f-4419-a1db-90435b8b21d0", + "microsoft-windows-bitlocker-api": "5d674230-ca9f-11da-a94d-0800200c9a66", + "microsoft-windows-bitlocker-drivepreparationtool": "632f767e-0ec3-47b9-ba1c-a0e62a74728a", + "microsoft-windows-bitlocker-driver": "651df93b-5053-4d1e-94c5-f6e6d25908d0", + "microsoft-windows-bitlocker-driver-performance": "1de130e1-c026-4cbf-ba0f-ab608e40aeea", + "microsoft-windows-bits-client": "ef1cc15b-46c1-414e-bb95-e76b077bd51e", + "microsoft-windows-bluetooth-bthleprepairing": "4af188ac-e9c4-4c11-b07b-1fabc07dfeb2", + "microsoft-windows-bluetooth-bthmini": "db25b328-a6f6-444f-9d97-a50e20217d16", + "microsoft-windows-bluetooth-mtpenum": "04268430-d489-424d-b914-0cff741d6684", + "microsoft-windows-bluetooth-policy": "0602ecef-6381-4bc0-aeda-eb9bb919b276", + "microsoft-windows-bootux": "67d781bd-cbd2-4bd2-ad1f-6152fb891246", + "microsoft-windows-branchcache": "7eafcf79-06a7-460b-8a55-bd0a0c9248aa", + "microsoft-windows-branchcacheclienteventprovider": "e837619c-a2a8-4689-833f-47b48ebd2442", + "microsoft-windows-branchcacheeventprovider": "dd85457f-4e2d-44a5-a7a7-6253362e34dc", + "microsoft-windows-branchcachemonitoring": "a2f55524-8ebc-45fd-88e4-a1b39f169e08", + "microsoft-windows-branchcachesmb": "4a933674-fb3d-4e8d-b01d-17ee14e91a3e", + "microsoft-windows-brokerinfrastructure": "e6835967-e0d2-41fb-bcec-58387404e25a", + "microsoft-windows-bth-bthport": "8a1f9517-3a8c-4a9e-a018-4f17a200f277", + "microsoft-windows-bth-bthusb": "33693e1d-246a-471b-83be-3e75f47a832d", + "microsoft-windows-build-regdll": "d39b6336-cfcb-483b-8c76-7c3e7d02bcb8", + "microsoft-windows-capi2": "5bbca4a8-b209-48dc-a8c7-b23d3e5216fb", + "microsoft-windows-cdrom": "9b6123dc-9af6-4430-80d7-7d36f054fb9f", + "microsoft-windows-certificateservicesclient": "73370bd6-85e5-430b-b60a-fea1285808a7", + "microsoft-windows-certificateservicesclient-autoenrollment": "f0db7ef8-b6f3-4005-9937-feb77b9e1b43", + "microsoft-windows-certificateservicesclient-certenroll": "54164045-7c50-4905-963f-e5bc1eef0cca", + "microsoft-windows-certificateservicesclient-credentialroaming": "89a2278b-c662-4aff-a06c-46ad3f220bca", + "microsoft-windows-certificateservicesclient-lifecycle-system": "bc0669e1-a10d-4a78-834e-1ca3c806c93b", + "microsoft-windows-certificateservicesclient-lifecycle-user": "bea18b89-126f-4155-9ee4-d36038b02680", + "microsoft-windows-certificationauthorityclient-certcli": "98bf1cd3-583e-4926-95ee-a61bf3f46470", + "microsoft-windows-certpoleng": "af9cc194-e9a8-42bd-b0d1-834e9cfab799", + "microsoft-windows-cleanmgr": "9ae87b12-a014-5288-92df-e3030981ebab", + "microsoft-windows-cleartypetexttuner": "0a88862d-20a3-4c1f-b76f-162c55adbf93", + "microsoft-windows-cloudfiles-filter": "4580bb06-baed-5b62-a4d5-92fa7156e7db", + "microsoft-windows-cloudrestorelauncher": "dc327e90-7748-58ed-f39c-8a8987cfac58", + "microsoft-windows-cloudstore": "741bb90c-a7a3-49d6-bd82-1e6b858403f7", + "microsoft-windows-cmisetup": "75ebc33e-0cc6-49da-8cd9-8903a5222aa0", + "microsoft-windows-codeintegrity": "4ee76bd8-3cf4-44a0-a0ac-3937643e37a3", + "microsoft-windows-com": "d4263c98-310c-4d97-ba39-b55354f08584", + "microsoft-windows-com-perf": "b8d6861b-d20f-4eec-bbae-87e0dd80602b", + "microsoft-windows-com-rundowninstrumentation": "2957313d-fcaa-5d4a-2f69-32ce5f0ac44e", + "microsoft-windows-comdlg32": "7f912b92-21ad-496e-b97a-88622a72bc42", + "microsoft-windows-compat-appraiser": "442c11c5-304b-45a4-ae73-dc2194c4e876", + "microsoft-windows-complus": "0f177893-4a9c-4709-b921-f432d67f43d5", + "microsoft-windows-comruntime": "bf406804-6afa-46e7-8a48-6c357e1d6d61", + "microsoft-windows-configuration-change-monitor": "a148cf02-be6d-5f08-94e3-b68de60d8422", + "microsoft-windows-containers-bindflt": "fc4e8f51-7a04-4bab-8b91-6321416f72ab", + "microsoft-windows-containers-wcifs": "aec5c129-7c10-407d-be97-91a042c61aaa", + "microsoft-windows-coresystem-initmachineconfig": "0b886108-1899-4d3a-9c0d-42d8fc4b9108", + "microsoft-windows-coresystem-netprovision-joinprovideronline": "3629dd4d-d6f1-4302-a623-0768b51501c7", + "microsoft-windows-coresystem-smsrouter": "a9c11050-9e93-4fa4-8fe0-7c4750a345b2", + "microsoft-windows-corewindow": "a3d95055-34cc-4e4a-b99f-ec88f5370495", + "microsoft-windows-corruptedfilerecovery-client": "ba093605-3909-4345-990b-26b746adee0a", + "microsoft-windows-corruptedfilerecovery-server": "d6f68875-cdf5-43a5-a3e3-53ffd683311c", + "microsoft-windows-crashdump": "ecdaacfa-6fe9-477c-b5f0-85b76f8f50aa", + "microsoft-windows-credui": "5a24fcdb-1cf3-477b-b422-ef4909d51223", + "microsoft-windows-crypto-bcrypt": "c7e089ac-ba2a-11e0-9af7-68384824019b", + "microsoft-windows-crypto-cng": "e3e0e2f0-c9c5-11e0-8ab9-9ebc4824019b", + "microsoft-windows-crypto-dpapi": "89fe8f40-cdce-464e-8217-15ef97d4c7c3", + "microsoft-windows-crypto-dssenh": "43dad447-735f-4829-a6ff-9829a87419ff", + "microsoft-windows-crypto-ncrypt": "e8ed09dc-100c-45e2-9fc8-b53399ec1f70", + "microsoft-windows-crypto-rng": "54d5ac20-e14f-4fda-92da-ebf7556ff176", + "microsoft-windows-crypto-rsaenh": "152fdb2b-6e9d-4b60-b317-815d5f174c4a", + "microsoft-windows-d3d10level9": "7e7d3382-023c-43cb-95d2-6f0ca6d70381", + "microsoft-windows-d3d9": "783aca0a-790e-4d7f-8451-aa850511c6b9", + "microsoft-windows-dal-provider": "7e87506f-bace-4bf1-bc09-3a1f37045c71", + "microsoft-windows-data-pdf": "b97561fe-b27a-4c48-aa3e-7d3addc105b1", + "microsoft-windows-dataintegrityscan": "13bc4371-4e21-4e46-a84f-8c0ffb548ced", + "microsoft-windows-datetimecontrolpanel": "741fc222-44ed-4ba7-98e3-f405b2d2c4b4", + "microsoft-windows-dclocator": "cfaa5446-c6c4-4f5c-866f-31c9b55b962d", + "microsoft-windows-ddisplay": "75051c9d-2833-4a29-8923-046db7a432ca", + "microsoft-windows-deduplication": "f9fe3908-44b8-48d9-9a32-5a763ff5ed79", + "microsoft-windows-deduplication-change": "1d5e499d-739c-45a6-a3e1-8cbe0a352beb", + "microsoft-windows-defrag-core": "e3257c8c-c7cb-444f-9da0-5d92a2625289", + "microsoft-windows-deliveryoptimization": "f8ad09ba-419c-5134-1750-270f4d0fb889", + "microsoft-windows-deplorch": "b9da9fe6-ae5f-4f3e-b2fa-8e623c11dc75", + "microsoft-windows-desktopactivitymoderator": "32dd13df-9c0b-4c3b-b854-ee76c050f5f4", + "microsoft-windows-deviceassociationservice": "56c71c31-cfbd-4cdd-8559-505e042bbbe1", + "microsoft-windows-deviceconfidence": "1d5990c1-ec62-49f0-9e37-1f4db12db41e", + "microsoft-windows-deviceguard": "f717d024-f5b4-4f03-9ab9-331b2dc38ffb", + "microsoft-windows-devicemanagement-enterprise-diagnostics-provider": "3da494e4-0fe2-415c-b895-fb5265c5c83b", + "microsoft-windows-devicemanagement-pushrouter": "f1201b5a-e170-42b6-8d20-b57ac57e6416", + "microsoft-windows-devices-accessbroker": "64fb8d23-f0b6-5d2d-b1f6-488303c1761f", + "microsoft-windows-devices-background": "64ef2b1c-4ae1-4e64-8599-1636e441ec88", + "microsoft-windows-devices-query": "df63d0dc-97c2-5e48-c1cc-7b46bfd4df88", + "microsoft-windows-devicesetupmanager": "fcbb06bb-6a2a-46e3-abaa-246cb4e508b2", + "microsoft-windows-devicesync": "09ec9687-d7ad-40ca-9c5e-78a04a5ae993", + "microsoft-windows-deviceupdateagent": "e8f9af91-afbe-5a03-dfec-5d591686326c", + "microsoft-windows-deviceux": "ded165cf-485d-4770-a3e7-9c5f0320e80c", + "microsoft-windows-devmgmt-ueficsp": "739d66d8-76c4-4004-873f-169ae5c6eaca", + "microsoft-windows-dfssvc": "7da4fe0e-fd42-4708-9aa5-89b77a224885", + "microsoft-windows-dhcp-client": "15a7a4f8-0072-4eab-abad-f98a4d666aed", + "microsoft-windows-dhcpv6-client": "6a1f2b00-6a90-4c38-95a5-5cab3b056778", + "microsoft-windows-diagcpl": "1a396961-5f3c-4c71-8310-44c653c0bf8a", + "microsoft-windows-diagnosis-advancedtaskmanager": "178dadaf-7ac4-4593-ab3e-a45fda6d0d55", + "microsoft-windows-diagnosis-dps": "6bba3851-2c7e-4dea-8f54-31e5afd029e3", + "microsoft-windows-diagnosis-msde": "a50b09f8-93eb-4396-84c9-dc921259f952", + "microsoft-windows-diagnosis-pcw": "aabf8b86-7936-4fa2-acb0-63127f879dbf", + "microsoft-windows-diagnosis-pla": "e4d53f84-7de3-11d8-9435-505054503030", + "microsoft-windows-diagnosis-scheduled": "40ab57c2-1c53-4df9-9324-ff7cf898a02c", + "microsoft-windows-diagnosis-scripted": "e1dd7e52-621d-44e3-a1ad-0370c2b25946", + "microsoft-windows-diagnosis-scripteddiagnosticsprovider": "9363ccd9-d429-4452-9adb-2501e704b810", + "microsoft-windows-diagnosis-wdc": "05921578-2261-42c7-a0d3-26ddbce6c50d", + "microsoft-windows-diagnosis-wdi": "e01b1a7c-c5c9-4e67-99a9-5e85acfb2e10", + "microsoft-windows-diagnostics-loggingchannel": "4bd2826e-54a1-4ba9-bf63-92b73ea1ac4a", + "microsoft-windows-diagnostics-networking": "36c23e18-0e66-11d9-bbeb-505054503030", + "microsoft-windows-diagnostics-performance": "cfc18ec0-96b1-4eba-961b-622caee05b0a", + "microsoft-windows-diagnostics-perftrack": "030f2f57-abd0-4427-bcf1-3a3587d7dc7d", + "microsoft-windows-direct3d10": "9b7e4c0f-342c-4106-a19f-4f2704f689f0", + "microsoft-windows-direct3d10_1": "9b7e4c8f-342c-4106-a19f-4f2704f689f0", + "microsoft-windows-direct3d11": "db6f6ddb-ac77-4e88-8253-819df9bbf140", + "microsoft-windows-direct3d12": "5d8087dd-3a9b-4f56-90df-49196cdc4f11", + "microsoft-windows-direct3dshadercache": "2d4ebca6-ea64-453f-a292-ae2ea0ee513b", + "microsoft-windows-directcomposition": "c44219d0-f344-11df-a5e2-b307dfd72085", + "microsoft-windows-directmanipulation": "5786e035-ef2d-4178-84f2-5a6bbedbb947", + "microsoft-windows-directory-services-sam": "0d4fdc09-8c27-494a-bda0-505e4fd8adae", + "microsoft-windows-directory-services-sam-utility": "bd8fea17-5549-4b49-aa03-1981d16396a9", + "microsoft-windows-directshow-core": "968f313b-097f-4e09-9cdd-bc62692d138b", + "microsoft-windows-directshow-kernelsupport": "3cc2d4af-da5e-4ed4-bcbe-3cf995940483", + "microsoft-windows-directsound": "8a93b54b-c75a-49b5-a5be-9060715b1a33", + "microsoft-windows-disk": "6b4db0bc-9a3d-467d-81b9-a84c6f2f3d40", + "microsoft-windows-diskdiagnostic": "e670a5a2-ce74-4ab4-9347-61b815319f4c", + "microsoft-windows-diskdiagnosticdatacollector": "e104fb41-6b04-4f3a-b47d-f0df2f02b954", + "microsoft-windows-diskdiagnosticresolver": "6b1ffe48-5b1e-4793-9f7f-ae926454499d", + "microsoft-windows-dism-api": "75b0da21-8b50-42eb-9448-ec48b1729b57", + "microsoft-windows-dism-cli": "2f959466-24d4-4972-8729-0d5e3539ebc3", + "microsoft-windows-display": "6ece3302-fee1-4ea9-8b88-086d459ed976", + "microsoft-windows-displaycolorcalibration": "3239eb6f-c7fc-4953-aa15-646829a4ca4c", + "microsoft-windows-displayswitch": "192ede41-9175-4c86-ac02-9d003c9d43ab", + "microsoft-windows-distributedcom": "1b562e86-b7aa-4131-badc-b6f3a001407e", + "microsoft-windows-dlna-namespace": "d38fb874-33e4-4dcf-911e-1b53bb106d53", + "microsoft-windows-dns-client": "1c95126e-7eea-49a9-a3fe-a378b03ddb4d", + "microsoft-windows-documents": "c89b991e-3b48-49b2-80d3-ac000dfc9749", + "microsoft-windows-domainjoinmanagertriggerprovider": "5b004607-1087-4f16-b10e-979685a8d131", + "microsoft-windows-dotnetruntime": "e13c0d23-ccbc-4e12-931b-d9cc2eee27e4", + "microsoft-windows-dotnetruntimerundown": "a669021c-c450-4609-a035-5af59af4df18", + "microsoft-windows-driverframeworks-kernelmode-performance": "486a5c7c-11cc-46c5-9de7-43dfe0bb57c1", + "microsoft-windows-driverframeworks-usermode": "2e35aaeb-857f-4beb-a418-2e6c0e54d988", + "microsoft-windows-driverframeworks-usermode-performance": "9fa5dd5d-999e-466a-8ca9-7b3a66f8882f", + "microsoft-windows-driverproxy": "45c0e4cb-5120-5f84-0418-8a18ed702e9a", + "microsoft-windows-dsc": "50df9e12-a8c4-4939-b281-47e1325ba63e", + "microsoft-windows-dui": "8360bd0f-a7dc-4391-91a7-a457c5c381e4", + "microsoft-windows-duser": "8429e243-345b-47c1-8a91-2c94caf0daab", + "microsoft-windows-dvd": "e18d0fca-9515-4232-98e4-89e456d8551b", + "microsoft-windows-dwm-api": "292a52c4-fa27-4461-b526-54a46430bd54", + "microsoft-windows-dwm-compositor": "044a9015-d96c-5dd1-0199-72d258325298", + "microsoft-windows-dwm-core": "9e9bba3c-2e38-40cb-99f4-9e8281425164", + "microsoft-windows-dwm-dwm": "d29d56ea-4867-4221-b02e-cfd998834075", + "microsoft-windows-dwm-redir": "7d99f6a4-1bec-4c09-9703-3aaa8148347f", + "microsoft-windows-dwm-udwm": "a2d1c713-093b-43a7-b445-d09370ec9f47", + "microsoft-windows-dxgi": "ca11c036-0102-4a2d-a6ad-f03cfed5d3c9", + "microsoft-windows-dxgidebug": "f1ff64ef-faf3-5699-8e51-f6ec2fbd97d1", + "microsoft-windows-dxgkrnl": "802ec45a-1e99-4b83-9920-87c98277ba9d", + "microsoft-windows-dxgkrnl-sysmm": "9de90b19-62c4-511d-a1c5-9e990812d18b", + "microsoft-windows-dxp": "728b8c72-0f0f-4071-9bcc-27cb3b6dacbe", + "microsoft-windows-dxptasksyncprovider": "271c5228-c3fe-4e47-831f-48c3652ce5ac", + "microsoft-windows-eaphost": "6eb8db94-fe96-443f-a366-5fe0cee7fb1c", + "microsoft-windows-eapmethods-raschap": "58980f4b-bd39-4a3e-b344-492ed2254a4e", + "microsoft-windows-eapmethods-rastls": "9cc0413e-5717-4af5-82eb-6103d8707b45", + "microsoft-windows-eapmethods-sim": "3d42a67d-9ce8-4284-b755-2550672b0ce0", + "microsoft-windows-eapmethods-ttls": "d710d46c-235d-4798-ac20-9f83e1dcd557", + "microsoft-windows-easeofaccess": "74b4a4b1-2302-4768-ac5b-9773dd456b08", + "microsoft-windows-edp-applearning": "9803daa0-81ba-483a-986c-f0e395b9f8d1", + "microsoft-windows-edp-audit-regular": "50f99b2d-96d2-421f-be4c-222c4140da9f", + "microsoft-windows-edp-audit-tcb": "287d59b6-79ba-4741-a08b-2fedeede6435", + "microsoft-windows-efs": "3663a992-84be-40ea-bba9-90c7ed544222", + "microsoft-windows-els-hyphenation": "51aedb05-890b-4ade-8ba1-0ba14b8e8973", + "microsoft-windows-endpointtriggerprovider": "92aab24d-d9a9-4a60-9f94-201fed3e3e88", + "microsoft-windows-energy-estimation-engine": "ddcc3826-a68a-4e0d-bcfd-9c06c27c6948", + "microsoft-windows-energyefficiencywizard": "1a772f65-be1e-4fc6-96bb-248e03fa60f5", + "microsoft-windows-enhancedphishingprotection-events": "e8abc5fb-bf87-5462-278d-1b5e18775a8f", + "microsoft-windows-enhancedstorage-classdriver": "f6cf91be-e7d7-57d6-2a3d-278ca406d190", + "microsoft-windows-enhancedstorage-ehstortcgdrv": "aa3aa23b-bb6d-425a-b58c-1d7e37f5d02a", + "microsoft-windows-eqos": "54cb22ff-26b4-4393-a8c2-6b0715912c5f", + "microsoft-windows-errorreportingconsole": "017247f2-7e96-11dc-8314-0800200c9a66", + "microsoft-windows-ese": "478ea8a8-00be-4ba6-8e75-8b9dc7db9f78", + "microsoft-windows-eventcollector": "b977cf02-76f6-df84-cc1a-6a4b232322b6", + "microsoft-windows-eventlog": "fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148", + "microsoft-windows-eventlog-wmiprovider": "35ac6ce8-6104-411d-976c-877f183d2d32", + "microsoft-windows-eventsystem": "899daace-4868-4295-afcd-9eb8fb497561", + "microsoft-windows-exfat-sqm": "494e7a3d-8db9-4ec4-b43e-2844af6e38d6", + "microsoft-windows-failoverclustering-client": "a82fda5d-745f-409c-b0fe-18ae0678a0e0", + "microsoft-windows-fat-sqm": "3e59a529-b0b3-4a11-8129-9ffe6bb46eb9", + "microsoft-windows-fault-tolerant-heap": "6b93bf66-a922-4c11-a617-cf60d95c133d", + "microsoft-windows-featureconfiguration": "c2f36562-a1e4-4bc3-a6f6-01a7adb643e8", + "microsoft-windows-feedback-service-triggerprovider": "e46eead8-0c54-4489-9898-8fa79d059e0e", + "microsoft-windows-filehistory-catalog": "b447b4dc-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-configmanager": "b447b4dd-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-core": "b447b4db-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-engine": "b447b4de-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-eventlistener": "b447b4df-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-service": "b447b4e0-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-filehistory-ui": "b447b4e1-7780-11e0-ada3-18a90531a85a", + "microsoft-windows-fileinfominifilter": "a319d300-015c-48be-acdb-47746e154751", + "microsoft-windows-filtermanager": "f3c5e28e-63f6-49c7-a204-e48a1bc4b09d", + "microsoft-windows-firewall": "e595f735-b42a-494b-afcd-b68666945cd3", + "microsoft-windows-firewall-cpl": "546549be-9d63-46aa-9154-4f6eb9526378", + "microsoft-windows-firstux-perfinstrumentation": "fbef8096-2ca3-4082-acde-dcfb47e96b72", + "microsoft-windows-fltmgrtrace_307b3ab035ae31a8462e37b4da258d1a": "307b3ab0-35ae-31a8-462e-37b4da258d1a", + "microsoft-windows-fms": "dea07764-0790-44de-b9c4-49677b17174f", + "microsoft-windows-folder redirection": "7d7b0c39-93f6-4100-bd96-4dda859652c5", + "microsoft-windows-forwarding": "699e309c-e782-4400-98c8-e21d162d7b7b", + "microsoft-windows-functiondiscovery": "9db0fdb5-3b21-440e-a94b-63738a4be5de", + "microsoft-windows-functiondiscoveryhost": "538cbbad-4877-4eb2-b26e-7caee8f0f8cb", + "microsoft-windows-genericroaming": "4eacb4d0-263b-4b93-8cd6-778a278e5642", + "microsoft-windows-gpio-classextension": "55ab77f6-fa04-43ef-af45-688fbf500482", + "microsoft-windows-gpiobuttons": "e13ff11e-e989-4838-a9fa-38a4d13914cf", + "microsoft-windows-graphics-capture-server": "7d0cbd25-390e-524d-8c1e-2a8e846055c0", + "microsoft-windows-graphics-printing": "e7aa32fb-77d0-477f-987d-7e83df1b7ed0", + "microsoft-windows-graphics-printing3d": "be967569-e3c8-425b-ad0e-4f2c790b1848", + "microsoft-windows-graphicscapture-api": "347d2cdf-f126-56d7-12b1-69e27c655d7e", + "microsoft-windows-grouppolicy": "aea1b4fa-97d1-45f2-a64c-4d69fffd92c9", + "microsoft-windows-grouppolicytriggerprovider": "bd2f4252-5e1e-49fc-9a30-f3978ad89ee2", + "microsoft-windows-hal": "63d1e632-95cc-4443-9312-af927761d52a", + "microsoft-windows-healthcenter": "588c5c5a-ffc5-44a2-9a7f-d5e8dbe6efd7", + "microsoft-windows-healthcentercpl": "959f1fac-7ca8-4ed1-89dc-cdfa7e093cb0", + "microsoft-windows-heap-snapshot": "901d2afa-4ff6-46d7-8d0e-53645e1a47f5", + "microsoft-windows-helloforbusiness": "906b8a99-63ce-58d7-86ab-10989bbd5567", + "microsoft-windows-help": "de513a55-c345-438b-9a74-e18cac5c5cc5", + "microsoft-windows-hidcfu": "7628e972-6d6f-4974-b58f-6428622ec09a", + "microsoft-windows-homegroup-controlpanel": "134ea407-755d-4a93-b8a6-f290cd155023", + "microsoft-windows-host-network-management": "93f693dc-9163-4dee-af64-d855218af242", + "microsoft-windows-host-network-service": "0c885e0d-6eb6-476c-a048-2457eed3a5c1", + "microsoft-windows-hostguardianclient-service": "5d487fad-104b-5ca6-ca4e-14c206850501", + "microsoft-windows-hostguardianservice-ca": "9fb3388c-a54c-4e98-bdd1-445a82ed4bf7", + "microsoft-windows-hostguardianservice-client": "7dee1fdc-ffa8-4087-912a-95189d6a2d7f", + "microsoft-windows-hotpatch-monitor": "57eaf242-3772-533c-9fd2-29ed95606d14", + "microsoft-windows-hotspotauth": "de095dbe-8667-4168-94c2-48ca61665aca", + "microsoft-windows-http-sqm-provider": "f5344219-87a4-4399-b14a-e59cd118abb8", + "microsoft-windows-httpevent": "7b6bc78c-898b-4170-bbf8-1a469ea43fc5", + "microsoft-windows-httplog": "c42a2738-2333-40a5-a32f-6acc36449dcc", + "microsoft-windows-httpservice": "dd5ef90a-6398-47a4-ad34-4dcecdef795f", + "microsoft-windows-hyper-v-chipset": "de9ba731-7f33-4f44-98c9-6cac856b9f83", + "microsoft-windows-hyper-v-compute": "17103e3f-3c6e-4677-bb17-3b267eb5be57", + "microsoft-windows-hyper-v-computelib": "af7fd3a7-b248-460c-a9f5-fec39ef8468c", + "microsoft-windows-hyper-v-config": "02f3a5e3-e742-4720-85a5-f64c4184e511", + "microsoft-windows-hyper-v-crashdump": "c7c9e4f7-c41d-5c68-f104-d72a920016c7", + "microsoft-windows-hyper-v-debug": "eded5085-79d0-4e31-9b4e-4299b78cbeeb", + "microsoft-windows-hyper-v-dynmem": "b1d080a6-f3a5-42f6-b6f1-b9fd86c088da", + "microsoft-windows-hyper-v-emulateddevices": "da5a028b-b248-4a75-b60a-024fe6457484", + "microsoft-windows-hyper-v-emulatednic": "09242393-1349-4f4d-9fd7-59cc79f553ce", + "microsoft-windows-hyper-v-emulatedstor": "86e15e01-edf1-4ac7-89cf-b19563fd6894", + "microsoft-windows-hyper-v-guest-drivers-dynamic-memory": "ba2ffb5c-e20a-4fb9-91b4-45f61b4b66a0", + "microsoft-windows-hyper-v-guest-drivers-storage-filter": "0b9fdccc-451c-449c-9bd8-6756fcc6091a", + "microsoft-windows-hyper-v-guest-drivers-vmbus": "f2e2ce31-0e8a-4e46-a03b-2e0fe97e93c2", + "microsoft-windows-hyper-v-hierarchical-nic-switch": "31732ca5-d67c-59fd-dd5c-60a136ee4953", + "microsoft-windows-hyper-v-hypervisor": "52fc89f8-995e-434c-a91e-199986449890", + "microsoft-windows-hyper-v-integration": "2b74a015-3873-4c56-9928-ea80c58b2787", + "microsoft-windows-hyper-v-integration-rdv": "fdff33ec-70aa-46d3-ba65-7210009fa2a7", + "microsoft-windows-hyper-v-kmcl": "fa3f78ff-ba6d-4ede-96b2-9c5bb803e3ba", + "microsoft-windows-hyper-v-kmcl-child": "16d90d71-caca-5cd9-a618-8210d93015f3", + "microsoft-windows-hyper-v-netvsc": "152fbe4b-c7ad-4f68-bada-a4fcc1464f6c", + "microsoft-windows-hyper-v-serial": "8f9df503-1d12-49ec-bb28-f6ec42d361d4", + "microsoft-windows-hyper-v-storagevsp": "10b3d268-9782-49a4-aacc-a93c5482cb6f", + "microsoft-windows-hyper-v-synthfcvdev": "5b621a17-3b58-4d03-94f0-314f4e9c79ae", + "microsoft-windows-hyper-v-synthnic": "c29c4fb7-b60e-4fff-9af9-cf21f9b09a34", + "microsoft-windows-hyper-v-synthstor": "edacd782-2564-4497-ade6-7199377850f2", + "microsoft-windows-hyper-v-tpm": "13eae551-76ca-4ddc-b974-d3a0f8d44a03", + "microsoft-windows-hyper-v-uidevices": "339aad0a-4124-4968-8147-4cbbb1f8b3d5", + "microsoft-windows-hyper-v-vfpext": "9f2660ea-cfe7-428f-9850-aeca612619b0", + "microsoft-windows-hyper-v-vfpext-ifr": "dba692d9-d755-51b8-84ee-fe38fd18f4f0", + "microsoft-windows-hyper-v-vid": "5931d877-4860-4ee7-a95c-610a5f0d1407", + "microsoft-windows-hyper-v-virtual-pmem": "ae3f5bf8-ab9f-56d6-29c8-8c312e2faec2", + "microsoft-windows-hyper-v-vmbusvdev": "177d1599-9764-4e3a-bf9a-c86887aaddce", + "microsoft-windows-hyper-v-vmms": "6066f867-7ca1-4418-85fd-36e3f9c0600c", + "microsoft-windows-hyper-v-vmsp": "1ceb22b1-97ff-4703-beb2-333eb89b522a", + "microsoft-windows-hyper-v-vmswitch": "67dc0d66-3695-47c0-9642-33f76f7bd7ad", + "microsoft-windows-hyper-v-vsmb": "7b0ea079-e3bc-424a-b2f0-e3d8478d204b", + "microsoft-windows-hyper-v-worker": "51ddfa29-d5c8-4803-be4b-2ecb715570fe", + "microsoft-windows-idctrls": "6d7662a9-034e-4b1f-a167-67819c401632", + "microsoft-windows-idletriggerprovider": "9e03f75a-bcbe-428a-8f3c-d46f2a444935", + "microsoft-windows-ie-f12-provider": "d17fff2f-392d-478c-a41d-737a216eb2a4", + "microsoft-windows-ie-smartscreen": "52f82079-1974-4c67-81da-807b892778bb", + "microsoft-windows-ime-broker": "e2c15fd7-8924-4c8c-8cfe-da0be539ce27", + "microsoft-windows-ime-candidateui": "7c4117b1-ed82-4f47-b2ca-29e4e25719c7", + "microsoft-windows-ime-customerfeedbackmanager": "e2242b38-9453-42fd-b446-00746e76eb82", + "microsoft-windows-ime-customerfeedbackmanagerui": "1b734b40-a458-4b81-954f-ad7c9461bed8", + "microsoft-windows-ime-jpapi": "31bcac7f-4ab8-47a1-b73a-a161ee68d585", + "microsoft-windows-ime-jplmp": "dbc388bc-89c2-4fe0-b71f-6e4881fb575c", + "microsoft-windows-ime-jppred": "3ad571f3-bdae-4942-8733-4d1b85870a1e", + "microsoft-windows-ime-jpsetting": "14371053-1813-471a-9510-1cf1d0a055a8", + "microsoft-windows-ime-jptip": "8c8a69ad-cc89-481f-bbad-fd95b5006256", + "microsoft-windows-ime-krapi": "7562948e-2671-4dda-8f8f-bf945ef984a1", + "microsoft-windows-ime-krtip": "e013e74b-97f4-4e1c-a120-596e5629ecfe", + "microsoft-windows-ime-oedcompiler": "fd44a6e7-580f-4a9c-83d9-d820b7d3a033", + "microsoft-windows-ime-tccore": "f67b2345-47fa-4721-a6fb-fe08110eecf7", + "microsoft-windows-ime-tctip": "d5268c02-6f51-436f-983b-74f2efbfaf3a", + "microsoft-windows-ime-tip": "bdd4b92e-19ef-4497-9c4a-e10e7fd2e227", + "microsoft-windows-immersive-shell": "315a8872-923e-4ea2-9889-33cd4754bf64", + "microsoft-windows-immersive-shell-api": "5f0e257f-c224-43e5-9555-2adcb8540a58", + "microsoft-windows-indirectdisplays-classextension-events": "966cd1c0-3f69-42ad-9877-517dce8462b4", + "microsoft-windows-input-hidclass": "6465da78-e7a0-4f39-b084-8f53c7c30dc6", + "microsoft-windows-inputswitch": "bb8e7234-bbf4-48a7-8741-339206ed1dfb", + "microsoft-windows-install-agent": "e0c6f6de-258a-50e0-ac1a-103482d118bc", + "microsoft-windows-international-regionaloptionscontrolpanel": "c6bf6832-f7bd-4151-ac21-753ce4707453", + "microsoft-windows-iphlpsvc": "66a5c15c-4f8e-4044-bf6e-71d896038977", + "microsoft-windows-iphlpsvc-trace": "6600e712-c3b6-44a2-8a48-935c511f28c8", + "microsoft-windows-ipmiprovider": "2a45d52e-bbf3-4843-8e18-b356ed5f6a65", + "microsoft-windows-ipnat": "a67075c2-3e39-4109-b6cd-6d750058a732", + "microsoft-windows-ipsec-srv": "c91ef675-842f-4fcf-a5c9-6ea93f2e4f8b", + "microsoft-windows-ipxlatcfg": "3e5ac668-af52-4c15-b99b-a3e7a6616ebd", + "microsoft-windows-isolatedusermode": "73a33ab2-1966-4999-8add-868c41415269", + "microsoft-windows-kdssvc": "89203471-d554-47d4-bde4-7552ec219999", + "microsoft-windows-kerberos-local-key-distribution-center": "57c834d7-0368-5d1b-8f01-1e2f89f0000d", + "microsoft-windows-kernel-acpi": "c514638f-7723-485b-bcfc-96565d735d4a", + "microsoft-windows-kernel-appcompat": "16a1adc1-9b7f-4cd9-94b3-d8296ab1b130", + "microsoft-windows-kernel-audit-api-calls": "e02a841c-75a3-4fa7-afc8-ae09cf9b7f23", + "microsoft-windows-kernel-boot": "15ca44ff-4d7a-4baa-bba5-0998955e531e", + "microsoft-windows-kernel-bootdiagnostics": "96ac7637-5950-4a30-b8f7-e07e8e5734c1", + "microsoft-windows-kernel-cache": "a2d34bf1-70ab-5b21-c819-5a0dd42748fd", + "microsoft-windows-kernel-cpu-partition": "3a493674-937f-5a23-f598-d56b9bd10d28", + "microsoft-windows-kernel-cpu-starvation": "7f54ca8a-6c72-5cbc-b96f-d0ef905b8bce", + "microsoft-windows-kernel-disk": "c7bde69a-e1e0-4177-b6ef-283ad1525271", + "microsoft-windows-kernel-dump": "17d2a329-4539-5f4d-3435-f510634ce3b9", + "microsoft-windows-kernel-eventtracing": "b675ec37-bdb6-4648-bc92-f3fdc74d3ca2", + "microsoft-windows-kernel-file": "edd08927-9cc4-4e65-b970-c2560fb5c289", + "microsoft-windows-kernel-general": "a68ca8b7-004f-d7b6-a698-07e2de0f1f5d", + "microsoft-windows-kernel-interrupt-steering": "951b41ea-c830-44dc-a671-e2c9958809b8", + "microsoft-windows-kernel-io": "abf1f586-2e50-4ba8-928d-49044e6f0db7", + "microsoft-windows-kernel-iotrace": "a103cabd-8242-4a93-8df5-1cdf3b3f26a6", + "microsoft-windows-kernel-licensing-startservicetrigger": "f5528ada-be5f-4f14-8aef-a95de7281161", + "microsoft-windows-kernel-licensingsqm": "a0af438f-4431-41cb-a675-a265050ee947", + "microsoft-windows-kernel-livedump": "bef2aa8e-81cd-11e2-a7bb-5eac6188709b", + "microsoft-windows-kernel-memory": "d1d93ef7-e1f2-4f45-9943-03d245fe6c00", + "microsoft-windows-kernel-network": "7dd42a49-5329-4832-8dfd-43d979153a88", + "microsoft-windows-kernel-pep": "5412704e-b2e1-4624-8ffd-55777b8f7373", + "microsoft-windows-kernel-pnp": "9c205a39-1250-487d-abd7-e831c6290539", + "microsoft-windows-kernel-pnp-rundown": "b3a0c2c8-83bb-4ddf-9f8d-4b22d3c38ad7", + "microsoft-windows-kernel-power": "331c3b3a-2005-44c2-ac5e-77220c37d6b4", + "microsoft-windows-kernel-powertrigger": "aa1f73e8-15fd-45d2-abfd-e7f64f78eb11", + "microsoft-windows-kernel-prefetch": "5322d61a-9efa-4bc3-a3f9-14be95c144f8", + "microsoft-windows-kernel-prm": "b931ed29-66f4-576e-0579-0b8818a5dc6b", + "microsoft-windows-kernel-process": "22fb2cd6-0e7b-422b-a0c7-2fad1fd0e716", + "microsoft-windows-kernel-processor-power": "0f67e49f-fe51-4e9f-b490-6f2948cc6027", + "microsoft-windows-kernel-registry": "70eb4f03-c1de-4f73-a051-33d13d5413bd", + "microsoft-windows-kernel-shimengine": "0bf2fb94-7b60-4b4d-9766-e82f658df540", + "microsoft-windows-kernel-storemgr": "a6ad76e3-867a-4635-91b3-4904ba6374d7", + "microsoft-windows-kernel-tm": "4cec9c95-a65f-4591-b5c4-30100e51d870", + "microsoft-windows-kernel-tm-trigger": "ce20d1c3-a247-4c41-bcb8-3c7f52c8b805", + "microsoft-windows-kernel-wdi": "2ff3e6b7-cb90-4700-9621-443f389734ed", + "microsoft-windows-kernel-whea": "7b563579-53c8-44e7-8236-0f87b9fe6594", + "microsoft-windows-kernel-wsservice-startservicetrigger": "3635d4b6-77e3-4375-8124-d545b7149337", + "microsoft-windows-kernel-xdv": "f029ac39-38f0-4a40-b7de-404d244004cb", + "microsoft-windows-kernelstreaming": "548c4417-ce45-41ff-99dd-528f01ce0fe1", + "microsoft-windows-keyboardfilter": "84de80eb-86e8-4ff6-85a6-9319abd578a4", + "microsoft-windows-knownfolders": "8939299f-2315-4c5c-9b91-abb86aa0627d", + "microsoft-windows-l2nacp": "85fe7609-ff4a-48e9-9d50-12918e43e1da", + "microsoft-windows-langpa": "cb070027-1534-4cf3-98ea-b9751f508376", + "microsoft-windows-languagepacksetup": "7237fff9-a08a-4804-9c79-4a8704b70b87", + "microsoft-windows-laps": "4fcc72a9-d7ca-5dd2-8d34-6f41a0cdb7e0", + "microsoft-windows-ldap-client": "099614a5-5dd7-4788-8bc9-e29f43db28fc", + "microsoft-windows-limitsmanagement": "73aa0094-facb-4aeb-bd1d-a7b98dd5c799", + "microsoft-windows-linklayerdiscoveryprotocol": "dcbfb8f0-cd19-4f1c-a27d-23ac706ded72", + "microsoft-windows-liveid": "05f02597-fe85-4e67-8542-69567ab8fd4f", + "microsoft-windows-lltd-mapper": "ccc64809-6b5f-4c1b-ab39-336904da9b3b", + "microsoft-windows-lltd-mapperio": "0741c7be-daac-4a5b-b00a-4bd9a2d89d0e", + "microsoft-windows-lltd-responder": "e159fc63-02fe-42f3-a234-028b9b8561cb", + "microsoft-windows-locationserviceprovider": "8e889f0c-7d54-52b3-e4ae-2c8b27a482c2", + "microsoft-windows-lua": "93c05d69-51a3-485e-877f-1806a8731346", + "microsoft-windows-magnification": "c882ff1d-7585-4b33-b135-95c577179137", + "microsoft-windows-management-secureassessment": "a329cf81-57ec-46ed-ab7c-261a52b0754a", + "microsoft-windows-mapcontrols": "acd88d21-e1d4-4483-b974-0c1da66cc529", + "microsoft-windows-mccs-accountaccessor": "4025d192-273d-42ec-bdf8-940ec34eedca", + "microsoft-windows-mccs-accountshost": "04eccf8e-8490-4ad1-8ed5-0ae7750e69e6", + "microsoft-windows-mccs-accountsrt": "dd2743c6-1722-4674-9f6f-c80044c4232e", + "microsoft-windows-mccs-activesynccsp": "602a0873-9bde-48b3-b6b7-277035293458", + "microsoft-windows-mccs-activesyncprovider": "4a155f10-25ad-47e6-aba8-2c4f5eee7846", + "microsoft-windows-mccs-davsyncprovider": "5d86c4e2-8fcd-48d7-a713-9a04609c0189", + "microsoft-windows-mccs-engineshared": "bf460fc6-45c5-4119-add3-e361a6e7d5ac", + "microsoft-windows-mccs-internetmail": "618473bc-8eef-4868-adff-a1b640b06411", + "microsoft-windows-mccs-internetmailcsp": "bec5e7a4-0527-42e8-8174-fabde799ad7f", + "microsoft-windows-mccs-networkhelper": "25b99a4c-2f80-4fcd-982d-69cd1f77badf", + "microsoft-windows-mccs-synccontroller": "7fcb9791-f481-46d1-846e-2eb6f003c4d3", + "microsoft-windows-mccs-syncutil": "dca074ce-547c-4595-ae90-56229b8e3bd9", + "microsoft-windows-media-protection-playready-performance": "d2402fde-7526-5a7b-501a-25dc7c9c282e", + "microsoft-windows-media-streaming": "982824e5-e446-46ae-bc74-836401ffb7b6", + "microsoft-windows-mediaengine": "8f2048e0-f260-4f57-a8d1-932376291682", + "microsoft-windows-mediafoundation-mfcaptureengine": "b8197c10-845f-40ca-82ab-9341e98cfc2b", + "microsoft-windows-mediafoundation-mfreadwrite": "4b7eac67-fc53-448c-a49d-7cc6db524da7", + "microsoft-windows-mediafoundation-msvproc": "a4112d1a-6dfa-476e-bb75-e350d24934e1", + "microsoft-windows-mediafoundation-performance": "f404b94e-27e0-4384-bfe8-1d8d390b0aa3", + "microsoft-windows-mediafoundation-performance-core": "b20e65ac-c905-4014-8f78-1b6a508142eb", + "microsoft-windows-mediafoundation-platform": "bc97b970-d001-482f-8745-b8d7d5759f99", + "microsoft-windows-mediafoundation-playapi": "b65471e1-019d-436f-bc38-e15fa8e87f53", + "microsoft-windows-memory-diagnostic-task-handler": "babda89a-4d5e-48eb-af3d-e0e8410207c0", + "microsoft-windows-memorydiagnostics-results": "5f92bc59-248f-4111-86a9-e393e12c6139", + "microsoft-windows-memorydiagnostics-schedule": "73e9c9de-a148-41f7-b1db-4da051fdc327", + "microsoft-windows-mf": "a7364e1a-894f-4b3d-a930-2ed9c8c4c811", + "microsoft-windows-mf-frameserver": "9e22a3ed-7b32-4b99-b6c2-21dd6ace01e1", + "microsoft-windows-mf-mfdshowreversebridge": "aa1105fa-5af2-5fd6-89b5-002421c5e2ca", + "microsoft-windows-mfh264enc": "2a49de31-8a5b-4d3a-a904-7fc7409ae90d", + "microsoft-windows-minstore": "55b24b1d-dd9c-44c0-ba77-4f749f1b6976", + "microsoft-windows-mmcss": "36008301-e154-466c-acec-5f4cbd6b4694", + "microsoft-windows-mobile-broadband-experience-api": "2e2bbb16-0c36-4b9b-a567-40924a199fd5", + "microsoft-windows-mobile-broadband-experience-api-internal": "2aabd03b-f48b-419a-b4ce-7a14403f4a46", + "microsoft-windows-mobile-broadband-experience-smsapi": "0ff1c24b-7f05-45c0-abdc-3c8521be4f62", + "microsoft-windows-mobilitycenter": "91f42016-0b4e-4a4b-9bbb-825d06cbed35", + "microsoft-windows-mobsync": "b44aec44-38f4-4b59-8df3-10306abf19b2", + "microsoft-windows-moderndeployment-diagnostics-provider": "bab3ad92-fb96-5902-450b-b8421bdec7bd", + "microsoft-windows-moshost": "d116f0f2-a6d6-4f1f-bdda-0c88c8d1f2e9", + "microsoft-windows-mountmgr": "e3bac9f8-27be-4823-8d7f-1cc320c05fa7", + "microsoft-windows-mp4sdecd": "7f2bd991-ae93-454a-b219-0bc23f02262a", + "microsoft-windows-mpeg2_dlna-encoder": "86efff39-2bdd-4efd-bd0b-853d71b2a9dc", + "microsoft-windows-mprddm": "3a5bef13-d0f7-4e7f-9ec8-5e707df711d0", + "microsoft-windows-mprmsg": "f2c628ae-d26c-4352-9c45-74754e1e2f9f", + "microsoft-windows-mps-clnt": "37945dc2-899b-44d1-b79c-dd4a9e57ff98", + "microsoft-windows-mps-drv": "50bd1bfd-936b-4db3-86be-e25b96c25898", + "microsoft-windows-mps-srv": "5444519f-2484-45a2-991e-953e4b54c8e0", + "microsoft-windows-mptf": "ea6c5bea-f5cc-56a4-e146-671bf483d53b", + "microsoft-windows-msdtc": "719be4ed-e9bc-4dd8-a7cf-c85ce8e4975d", + "microsoft-windows-msdtc 2": "5d9e0020-3761-4f36-90c8-38ce6511bd12", + "microsoft-windows-msdtc client": "7a67066e-193f-4d3a-82d3-322fee5259de", + "microsoft-windows-msdtc client 2": "155cb334-3d7f-4ff1-b107-df8afc3c0363", + "microsoft-windows-msftedit": "9640427c-7d03-4331-b8ee-fb77625bf381", + "microsoft-windows-msiserver": "17e92e2a-3d08-413e-baeb-a79a262bf486", + "microsoft-windows-msmpeg2adec": "51311de3-d55e-454a-9c58-43dc7b4c01d2", + "microsoft-windows-msmpeg2vdec": "ae5cf422-786a-476a-ac96-753b05877c99", + "microsoft-windows-msmpeg2venc": "d17b213a-c505-49c9-98cc-734253ef65d4", + "microsoft-windows-mui": "a8a1f2f6-a13a-45e9-b1fe-3419569e5ef2", + "microsoft-windows-narrator": "835b79e2-e76a-44c4-9885-26ad122d3b4d", + "microsoft-windows-ncasvc": "126ded58-a28d-4113-8e7a-59d7444b2af1", + "microsoft-windows-ncdautosetup": "ec23f986-ae2d-4269-b52f-4e20765c1a94", + "microsoft-windows-ncsi": "314de49f-ce63-4779-ba2b-d616f6963a88", + "microsoft-windows-ndf-helperclassdiscovery": "fc3bc8a7-2f61-449c-a8b4-22ac22058f92", + "microsoft-windows-ndis": "cdead503-17f5-4a3e-b7ae-df8cc2902eb9", + "microsoft-windows-ndis-packetcapture": "2ed6006e-4729-4609-b423-3ee7bcd678ef", + "microsoft-windows-ndisimplatformeventprovider": "11c5d8ad-756a-42c2-8087-eb1b4a72a846", + "microsoft-windows-ndisimplatformsysevtprovider": "62de9e48-90c6-4755-8813-6a7d655b0802", + "microsoft-windows-ndu": "df271536-4298-45e1-b0f2-e88f78619c5d", + "microsoft-windows-netadaptercim-diag": "6cc2405d-817f-4886-886f-d5d1643210f0", + "microsoft-windows-netshell": "af2e340c-0743-4f5a-b2d3-2f7225d215de", + "microsoft-windows-network-and-sharing-center": "6a502821-ab44-40c8-b32f-37315d9d52e0", + "microsoft-windows-network-connection-broker": "3eb875eb-8f4a-4800-a00b-e484c97d7551", + "microsoft-windows-network-executioncontext": "0075e1ab-e1d1-5d1f-35f5-da36fb4f41b1", + "microsoft-windows-network-setup": "a111f1c2-5923-47c0-9a68-d0bafb577901", + "microsoft-windows-networkbridge": "a67075c2-3e39-4109-b6cd-6d750058a731", + "microsoft-windows-networkconnectivitystatus": "014de49f-ce63-4779-ba2b-d616f6963a87", + "microsoft-windows-networkgcw": "be932b00-0f8e-4386-ab89-873f7d0274aa", + "microsoft-windows-networking-correlation": "83ed54f0-4d48-4e45-b16e-726ffd1fa4af", + "microsoft-windows-networking-realtimecommunication": "1e39b4ce-d1e6-46ce-b65b-5ab05d6cc266", + "microsoft-windows-networkmanagertriggerprovider": "9b307223-4e4d-4bf5-9be8-995cd8e7420b", + "microsoft-windows-networkprofile": "fbcfac3f-8459-419f-8e48-1f0b49cdb85e", + "microsoft-windows-networkprofiletriggerprovider": "fbcfac3f-8460-419f-8e48-1f0b49cdb85e", + "microsoft-windows-networkprovider": "1e9a4978-78c2-441e-8858-75b5d1326bc5", + "microsoft-windows-networkprovisioning": "93a19ab3-fb2c-46eb-91ef-56b0a318b983", + "microsoft-windows-networksecurity": "7b702970-90bc-4584-8b20-c0799086ee5a", + "microsoft-windows-nlasvc": "63b530f8-29c9-4880-a5b4-b8179096e7b8", + "microsoft-windows-ntfs": "3ff37a1c-a68d-4d6e-8c9b-f79e8b16c482", + "microsoft-windows-ntfs-ubpm": "8e6a5303-a4ce-498f-afdb-e03a8a82b077", + "microsoft-windows-ntfslog_38cd4a5ae98f33938fa5234e6817e23d": "38cd4a5a-e98f-3393-8fa5-234e6817e23d", + "microsoft-windows-ntlm": "ac43300d-5fcc-4800-8e99-1bd3f85f0320", + "microsoft-windows-ntshrui": "676f167f-f72c-446e-a498-eda43319a5e3", + "microsoft-windows-nvmedisk": "9799276c-fb04-47e8-845e-36946045c218", + "microsoft-windows-nwifi": "0bd3506a-9030-4f76-9b88-3e8fe1f7cfb6", + "microsoft-windows-offlinefiles": "95353826-4fbe-41d4-9c42-f521c6e86360", + "microsoft-windows-offlinefiles-cscapi": "19ee4cf9-5322-4843-b0d8-bab81be4e81e", + "microsoft-windows-offlinefiles-cscdcluser": "d5418619-c167-44d9-bc36-765beb5d55f3", + "microsoft-windows-offlinefiles-cscfastsync": "791cd79c-65b5-48a3-804c-786048994f47", + "microsoft-windows-offlinefiles-cscnetapi": "361f227c-aa14-4d19-9007-0c8d1a8a541b", + "microsoft-windows-offlinefiles-cscservice": "89d89015-c0df-414c-bc48-f50e114832bc", + "microsoft-windows-offlinefiles-cscum": "5e23b838-5b71-47e6-b123-6fe02ef573ef", + "microsoft-windows-ole-perf": "84958368-7da7-49a0-b33d-07fabb879626", + "microsoft-windows-oleacc": "19d2c934-ee9b-49e5-aaeb-9cce721d2c65", + "microsoft-windows-onebackup": "72561cf0-c85c-4f78-9e8d-cba9093df62d", + "microsoft-windows-onex": "ab0d8ef9-866d-4d39-b83f-453f3b8f6325", + "microsoft-windows-oobe-firstlogonanim": "2d4c0c5e-6704-493a-a44b-f5add4fc9283", + "microsoft-windows-oobe-machine-core": "ec276cde-2a17-473c-a010-2ff78d5426d2", + "microsoft-windows-oobe-machine-dui": "f5dbaa02-15d6-4644-a784-7032d508bf64", + "microsoft-windows-oobeldr": "75ebc33e-8670-4eb6-b535-3b9d6bb222fd", + "microsoft-windows-osk": "4f768be8-9c69-4bbc-87fc-95291d3f9d0c", + "microsoft-windows-otpcredentialproviderevt": "5cad485a-210f-4c16-80c5-f892de74e28d", + "microsoft-windows-overlayfilter": "46c78e5c-a213-46a8-8a6b-622f6916201d", + "microsoft-windows-parentalcontrols": "01090065-b467-4503-9b28-533766761087", + "microsoft-windows-partition": "412bdff2-a8c4-470d-8f33-63fe0d8c20e2", + "microsoft-windows-pci": "1a9443d4-b099-44d6-8eb1-829b9c2fe290", + "microsoft-windows-pcrpf": "5909c524-5e57-5275-803f-ddb7b74c52f2", + "microsoft-windows-pdc": "a6bf0deb-3659-40ad-9f81-e25af62ce3c7", + "microsoft-windows-pdfreader": "dfa86faa-2c55-4140-bff9-5cc586217a7b", + "microsoft-windows-pdh": "04d66358-c4a1-419b-8023-23b73902de2c", + "microsoft-windows-perceptionruntime": "add0de40-32b0-4b58-9d5e-938b2f5c1d1f", + "microsoft-windows-perceptionsensordataservice": "85be49ea-38f1-4547-a604-80060202fb27", + "microsoft-windows-perfdisk": "7f9d83de-8abb-457f-98e8-4ad161449ecc", + "microsoft-windows-perflib": "13b197bd-7cee-4b4e-8dd0-59314ce374ce", + "microsoft-windows-perfnet": "cab2b8a5-49b9-4eec-b1b0-fac21da05a3b", + "microsoft-windows-performance-recorder-control": "36b6f488-aad7-48c2-afe3-d4ec2c8b46fa", + "microsoft-windows-perfos": "f82fb576-e941-4956-a2c7-a0cf83f6450a", + "microsoft-windows-perfproc": "72d211e1-4c54-4a93-9520-4901681b2271", + "microsoft-windows-persistentmemory-nvdimm": "a7f2235f-be51-51ed-decf-f4498812a9a2", + "microsoft-windows-persistentmemory-pmemdisk": "0fa2ee03-1feb-5057-3bb3-eb25521b8482", + "microsoft-windows-persistentmemory-scmbus": "c03715ce-ea6f-5b67-4449-da1d1e1afeb8", + "microsoft-windows-photo-image-codec": "be3a31ea-aa6c-4196-9dcc-9ca13a49e09f", + "microsoft-windows-photoacq": "76cfa528-b26e-b773-62d0-9588270442a6", + "microsoft-windows-pktmon": "4d4f80d9-c8bd-4d73-bb5b-19c90402c5ac", + "microsoft-windows-playtomanager": "bb311100-2d9f-4cd3-b2d6-f4ea3839c548", + "microsoft-windows-portabledevicestatusprovider": "8c63b5a5-b484-4381-892d-edd424582df7", + "microsoft-windows-portabledevicesyncprovider": "a3e1697b-a12c-46b9-84d1-7ffe73c4b678", + "microsoft-windows-power-cad": "daba4d32-cc40-4266-bb95-c30344dbc680", + "microsoft-windows-power-meter-polling": "306c4e0b-e148-543d-315b-c618eb93157c", + "microsoft-windows-power-troubleshooter": "cdc05e28-c449-49c6-b9d2-88cf761644df", + "microsoft-windows-powercfg": "9f0c4ea8-ec01-4200-a00d-b9701cbea5d8", + "microsoft-windows-powercpl": "b1f90b27-4551-49d6-b2bd-dfc6453762a6", + "microsoft-windows-powershell": "a0c1853b-5c40-4b15-8766-3cf1c58f985a", + "microsoft-windows-powershell-desiredstateconfiguration-filedownloadmanager": "aaf67066-0bf8-469f-ab76-275590c434ee", + "microsoft-windows-printbrm": "cf3f502e-b40d-4071-996f-00981edf938e", + "microsoft-windows-printservice": "747ef6fd-e535-4d16-b510-42c90f6873a1", + "microsoft-windows-printservice-usbmon": "7f812073-b28d-4afc-9ced-b8010f914ef6", + "microsoft-windows-privacy-auditing": "d67fbb76-d18a-5ae3-24a3-8c1db52d6c62", + "microsoft-windows-privacy-auditing-activity-history-privacy-settings": "63dd5dfb-2488-5e1f-7895-d49ff5bc7125", + "microsoft-windows-privacy-auditing-cpss": "15f4cd44-ca53-5422-db17-4e76821b5a69", + "microsoft-windows-privacy-auditing-diagnosticdata": "d3610dca-4501-5a5d-21a7-30ca91130711", + "microsoft-windows-privacy-auditing-onesettingsclient": "23f0f2c7-c77c-51ee-0ac1-5ac7796a85df", + "microsoft-windows-privacy-auditing-permissivelearningmode": "811a1ddb-2e69-5f25-adc0-4b186170e760", + "microsoft-windows-privacy-auditing-tailoredexperiences": "1bd672b8-445e-53fc-35ef-09f53672c385", + "microsoft-windows-processexitmonitor": "fd771d53-8492-4057-8e35-8c02813af49b", + "microsoft-windows-processor-aggregator": "cba16cf2-2fab-49f8-89ae-894e718649e7", + "microsoft-windows-processstatemanager": "d49918cf-9489-4bf1-9d7b-014d864cf71f", + "microsoft-windows-program-compatibility-assistant": "4cb314df-c11f-47d7-9c04-65fb0051561b", + "microsoft-windows-projfs-filter": "b6d7dc51-78cf-4e85-8bac-488a9f47a0bb", + "microsoft-windows-provisioning-diagnostics-provider": "ed8b9bd3-f66e-4ff2-b86b-75c7925f72a9", + "microsoft-windows-proximity-common": "28058203-d394-4afc-b2a6-2f9155a3bb95", + "microsoft-windows-push-to-install-service": "3a718a68-6974-4075-abd3-e8243caef398", + "microsoft-windows-pushnotifications-developer": "5cad3597-5fec-4c62-9ce1-9d7abc723d3a", + "microsoft-windows-pushnotifications-inproc": "815a1f4a-3f8d-4b37-9b31-5142f9d724a5", + "microsoft-windows-pushnotifications-platform": "88cd9180-4491-4640-b571-e3bee2527943", + "microsoft-windows-qos-pacer": "914ed502-b70d-4add-b758-95692854f8a3", + "microsoft-windows-qos-qwave": "6ba132c4-da49-415b-a7f4-31870dc9fe25", + "microsoft-windows-qos-wmi-diag": "725ba9b3-c1f3-4518-af1b-c8d669191e15", + "microsoft-windows-radiomanager": "92061e3d-21cd-45bc-a3df-0e8ae5e8580a", + "microsoft-windows-ras-agilevpn": "b5325cd6-438e-4ec1-aa46-14f46f2570e4", + "microsoft-windows-ras-ndiswanpacketcapture": "d84521f7-2235-4237-a7c0-14e3a9676286", + "microsoft-windows-rasserver": "29d13147-1c2e-48ec-9994-e29dfe496eb3", + "microsoft-windows-rassstp": "6c260f2c-049a-43d8-bf4d-d350a4e6611a", + "microsoft-windows-rdp-graphics-rdpavenc": "ec7b8a8b-1432-58b3-6025-be73d4ea28ed", + "microsoft-windows-rdp-graphics-rdplite": "54de4fb6-64d0-5710-3c14-13e4456119ce", + "microsoft-windows-readyboost": "e6307a09-292c-497e-aad6-498f68e2b619", + "microsoft-windows-readyboostdriver": "2a274310-42d5-4019-b816-e4b8c7abe95c", + "microsoft-windows-refs": "cd9c6198-bf73-4106-803b-c17d26559018", + "microsoft-windows-refs-v1": "059f0f37-910e-4ff0-a7ee-ae8d49dd319b", + "microsoft-windows-refsdedupsvc": "596cb176-fb71-587a-8ffb-f5cf15ee1e36", + "microsoft-windows-remote-filesystem-log": "20c46239-d059-4214-a11e-7d6769cbe020", + "microsoft-windows-remote-filesystem-monitor": "51734b23-5b7e-4892-ba8e-45bc110b735c", + "microsoft-windows-remoteapp and desktop connections": "1b8b402d-78dc-46fb-bf71-46e64aedf165", + "microsoft-windows-remoteassistance": "5b0a651a-8807-45cc-9656-7579815b6af0", + "microsoft-windows-remotedesktopservices-rdpclipcdv": "b1e2ee25-b5bc-5129-0582-81a0a146b59b", + "microsoft-windows-remotedesktopservices-rdpcorecdv": "c8e6dc53-660c-44ee-8d00-e47f189db87f", + "microsoft-windows-remotedesktopservices-rdpcorets": "1139c61b-b549-4251-8ed3-27250a1edec8", + "microsoft-windows-remotedesktopservices-sessionservices": "f1394de0-32c7-4a76-a6de-b245e48f4615", + "microsoft-windows-remotefs-rdbss": "1a870028-f191-4699-8473-6fcd299eab77", + "microsoft-windows-remotehelp": "8b7587bf-3253-5620-fb1f-625bca71d28d", + "microsoft-windows-reseteng": "a4445c76-ed85-c8a3-02c1-532a38614a9e", + "microsoft-windows-reseteng-trace": "7fa514b5-a023-4b62-a6ab-2946a483e065", + "microsoft-windows-resource-exhaustion-detector": "9988748e-c2e8-4054-85f6-0c3e1cad2470", + "microsoft-windows-resource-exhaustion-resolver": "91f5fb12-fdea-4095-85d5-614b495cd9de", + "microsoft-windows-resourcepublication": "74c2135f-cc76-45c3-879a-ef3bb1eeaf86", + "microsoft-windows-restartmanager": "0888e5ef-9b98-4695-979d-e92ce4247224", + "microsoft-windows-retaildemo": "d3f29eda-805d-428a-9902-b259b937f84b", + "microsoft-windows-rpc": "6ad52b32-d609-4be9-ae07-ce8dae937e39", + "microsoft-windows-rpc-audit": "3c578d57-f85a-5fc9-dea0-8c663ccff942", + "microsoft-windows-rpc-events": "f4aed7c7-a898-4627-b053-44a7caa12fcd", + "microsoft-windows-rpc-firewallmanager": "f997cd11-0fc9-4ab4-acba-bc742a4c0dd3", + "microsoft-windows-rpc-proxy-lbs": "272a979b-34b5-48ec-94f5-7225a59c85a0", + "microsoft-windows-rpcss": "d8975f88-7ddb-4ed0-91bf-3adf48c48e0c", + "microsoft-windows-rras": "24989972-0967-4e21-a926-93854033638e", + "microsoft-windows-rtworkqueue-extended": "83faaa86-63c8-4dd8-a2da-fbadddfc0655", + "microsoft-windows-rtworkqueue-threading": "e18d0fc9-9515-4232-98e4-89e456d8551b", + "microsoft-windows-runtime-graphics": "fa5cf675-72eb-49e2-b447-de5552faff1c", + "microsoft-windows-runtime-media": "8f0db3a8-299b-4d64-a4ed-907b409d4584", + "microsoft-windows-runtime-networking": "6eb875eb-8f4a-4800-a00b-e484c97d7561", + "microsoft-windows-runtime-networking-backgroundtransfer": "b9d5b35d-bbb8-4625-9450-f71a5d414f4f", + "microsoft-windows-runtime-web-http": "41877cb4-11fc-4188-b590-712c143c881d", + "microsoft-windows-runtime-webapi": "6bd96334-dc49-441a-b9c4-41425ba628d8", + "microsoft-windows-schannel-events": "91cc1150-71aa-47e2-ae18-c96e61736b6f", + "microsoft-windows-scpnp": "9f650c63-9409-453c-a652-83d7185a2e83", + "microsoft-windows-sdbus": "fe28004e-b08f-4407-92b3-bad3a2c51708", + "microsoft-windows-sdstor": "afe654eb-0a83-4eb4-948f-d4510ec39c30", + "microsoft-windows-search": "ca4e628d-8567-4896-ab6b-835b221f373f", + "microsoft-windows-search-core": "49c2c27c-fe2d-40bf-8c4e-c3fb518037e7", + "microsoft-windows-search-profilenotify": "fc6f77dd-769a-470e-bcf9-1b6555a118be", + "microsoft-windows-search-protocolhandlers": "dab065a9-620f-45ba-b5d6-d6bb8efedee9", + "microsoft-windows-sec": "16c6501a-ff2d-46ea-868d-8f96cb0cb52d", + "microsoft-windows-sec-wfp": "62834e12-795f-5ab2-b404-8d6d870dbbeb", + "microsoft-windows-security-audit-configuration-client": "08466062-aed4-4834-8b04-cddb414504e5", + "microsoft-windows-security-auditing": "54849625-5478-4994-a5ba-3e3b0328c30d", + "microsoft-windows-security-enterprisedata-filerevocationmanager": "2cd58181-0bb6-463e-828a-056ff837f966", + "microsoft-windows-security-exchangeactivesyncprovisioning": "9249d0d0-f034-402f-a29b-92fa8853d9f3", + "microsoft-windows-security-identitystore": "00b7e1df-b469-4c69-9c41-53a6576e3dad", + "microsoft-windows-security-isolation-brokeringfilesystem": "cd8b60a0-2a19-5eb9-564f-6154e2d987f4", + "microsoft-windows-security-kerberos": "98e6cfcb-ee0a-41e0-a57b-622d4e1b30b1", + "microsoft-windows-security-lessprivilegedappcontainer": "45eec9e5-4a1b-5446-7ad8-a4ab1313c437", + "microsoft-windows-security-mitigations": "fae10392-f0af-4ac0-b8ff-9f4d920c3cdf", + "microsoft-windows-security-netlogon": "e5ba83f6-07d0-46b1-8bc7-7e669a1d31dc", + "microsoft-windows-security-spp": "e23b33b0-c8c9-472c-a5f9-f2bdfea0f156", + "microsoft-windows-security-spp-ux": "6bdadc96-673e-468c-9f5b-f382f95b2832", + "microsoft-windows-security-spp-ux-gc": "bbbdd6a3-f35e-449b-a471-4d830c8eda1f", + "microsoft-windows-security-spp-ux-genuinecenter-logging": "fb829150-cd7d-44c3-af5b-711a3c31cedc", + "microsoft-windows-security-spp-ux-notifications": "c4efc9bb-2570-4821-8923-1bad317d2d4b", + "microsoft-windows-security-userconsentverifier": "40783728-8921-45d0-b231-919037b4b4fd", + "microsoft-windows-security-vault": "e6c92fb8-89d7-4d1f-be46-d56e59804783", + "microsoft-windows-securitymitigationsbroker": "ea8cd8a5-78ff-4418-b292-aadc6a7181df", + "microsoft-windows-sendto": "35642cf5-da5e-410b-9d9c-a45f3638042b", + "microsoft-windows-sens": "be69781c-b63b-41a1-8e24-a4fc7b3fc498", + "microsoft-windows-sense": "fae96d09-ade1-5223-0098-af7b67348531", + "microsoft-windows-senseir": "b6d775ef-1436-4fe6-bad3-9e436319e218", + "microsoft-windows-sensors": "d8900e18-36cb-4548-966f-13f068d1f78e", + "microsoft-windows-sensors-core": "751c292b-23e6-58cf-1fd4-38f8512c66c2", + "microsoft-windows-sensors-core-performance": "9e051eaa-7fee-4f9f-8897-d86f3692e8af", + "microsoft-windows-serial-classextension": "47bc9477-a8ba-452e-b951-4f2ed3593cf9", + "microsoft-windows-serial-classextension-v2": "eee173ef-7ed2-45de-9877-01c70a852fbd", + "microsoft-windows-servicereportingapi": "606a6a38-70ec-4309-b3a3-82ff86f73329", + "microsoft-windows-services": "0063715b-eeda-4007-9429-ad526f62696e", + "microsoft-windows-services-svchost": "06184c97-5201-480e-92af-3a3626c5b140", + "microsoft-windows-servicetriggerperfeventprovider": "6545939f-3398-411a-88b7-6a8914b8cec7", + "microsoft-windows-servicing": "bd12f3b8-fc40-4a61-a307-b7a013a069c1", + "microsoft-windows-setup": "75ebc33e-997f-49cf-b49f-ecc50184b75d", + "microsoft-windows-setupcl": "75ebc33e-d017-4d0f-93ab-0b4f86579164", + "microsoft-windows-setupplatform": "530fb9b9-c515-4472-9313-fb346f9255e3", + "microsoft-windows-setupqueue": "a615acb9-d5a4-4738-b561-1df301d207f8", + "microsoft-windows-setupugc": "75ebc33e-0870-49e5-bdce-9d7028279489", + "microsoft-windows-sharedaccess_nat": "a6f32731-9a38-4159-a220-3d9b7fc5fe5d", + "microsoft-windows-sharemedia-controlpanel": "02012a8a-adf5-4fab-92cb-ccb7bb3e689a", + "microsoft-windows-shell-appwizcpl": "08d945eb-c8bd-44aa-994f-86079d8dce35", + "microsoft-windows-shell-authui": "63d2bb1d-e39a-41b8-9a3d-52dd06677588", + "microsoft-windows-shell-connectedaccountstate": "6df57621-e7e4-410f-a7e9-e43eeb61b11f", + "microsoft-windows-shell-core": "30336ed4-e327-447c-9de0-51b652c86108", + "microsoft-windows-shell-defaultprograms": "65d99466-7a8e-489c-b8e1-962bc945031e", + "microsoft-windows-shell-lockscreencontent": "a3c0d58a-9fe5-4f24-a2ce-e16de8baa0d2", + "microsoft-windows-shell-openwith": "11bd2a68-77ff-4991-9658-f451f2eb6ce1", + "microsoft-windows-shell-shwebsvc": "f61cefc0-aa2e-11da-a746-0800200c9a66", + "microsoft-windows-shell-zipfolder": "1f84007d-19ce-4b15-9e81-8a3dd8eb9ecb", + "microsoft-windows-shellcommon-startlayoutpopulation": "97ca8142-10b1-4baa-9fbb-70a7d11231c3", + "microsoft-windows-shsvcs": "059c3e04-5535-4929-85e1-93030e78f47b", + "microsoft-windows-sleepstudy": "d37687e7-8bf0-4d11-b589-a7abe080756a", + "microsoft-windows-smartcard-audit": "09ac07b9-6ac9-43bc-a50f-58419a797c69", + "microsoft-windows-smartcard-deviceenum": "aaeac398-3028-487c-9586-44eacad03637", + "microsoft-windows-smartcard-server": "4fcbf664-a33a-4652-b436-9d558983d955", + "microsoft-windows-smartcard-tpm-vcard-module": "125f2cf1-2768-4d33-976e-527137d080f8", + "microsoft-windows-smartcard-trigger": "aedd909f-41c6-401a-9e41-dfc33006af5d", + "microsoft-windows-smartscreen": "3cb2a168-fe34-4a4e-bdad-dcf422f34473", + "microsoft-windows-smbclient": "988c59c5-0a1c-45b6-a555-0c62276e327d", + "microsoft-windows-smbdirect": "db66ea65-b7bb-4ca9-8748-334cb5c32400", + "microsoft-windows-smbserver": "d48ce617-33a2-4bc3-a5c7-11aa4f29619e", + "microsoft-windows-smbwitnessclient": "32254f6c-aa33-46f0-a5e3-1cbcc74bf683", + "microsoft-windows-smbwmiprovider": "50b9e206-9d55-4092-92e8-f157a8235799", + "microsoft-windows-softwarerestrictionpolicies": "7d29d58a-931a-40ac-8743-48c733045548", + "microsoft-windows-spb-classextension": "72cd9ff7-4af8-4b89-aede-5f26fda13567", + "microsoft-windows-spb-hidi2c": "991f8fe6-249d-44d6-b93d-5a3060c1dedb", + "microsoft-windows-specialadministrationconsole": "8551491d-2545-5955-44bd-f5f1efacfcda", + "microsoft-windows-speech-tts": "74dcc47a-846e-4c98-9e2c-80043ed82b15", + "microsoft-windows-speech-userexperience": "13480a22-d79f-4334-9d32-aa239398ad3c", + "microsoft-windows-spell-checking": "d0e22efc-ac66-4b25-a72d-382736b5e940", + "microsoft-windows-spellchecker": "b2fcd41f-9a40-4150-8c92-b224b7d8c8aa", + "microsoft-windows-spellchecking-host": "1bda2ab1-bbc1-4acb-a849-c0ef2b249672", + "microsoft-windows-srumon": "c8dbf506-e3d3-4822-930d-84c557eb6247", + "microsoft-windows-srumtelemetry": "48d445a8-2f64-4d49-b093-a5774d8dc531", + "microsoft-windows-startnameres": "277c9237-51d8-5c1c-b089-f02c683e5ba7", + "microsoft-windows-startuprepair": "c914f0df-835a-4a22-8c70-732c9a80c634", + "microsoft-windows-staterepository": "89592015-d996-4636-8f61-066b5d4dd739", + "microsoft-windows-stobject": "86133982-63d7-4741-928e-ef1349b80219", + "microsoft-windows-storage-tiering": "4a104570-ec6d-4560-a40f-858fa955e84f", + "microsoft-windows-storage-tiering-ioheat": "990c55fc-2662-47f6-b7d7-eb3c027cb13f", + "microsoft-windows-storagemanagement": "7e58e69a-e361-4f06-b880-ad2f4b64c944", + "microsoft-windows-storagemanagement-partutil": "93db76c2-63ab-5de1-88b3-c068686675b8", + "microsoft-windows-storagemanagement-wsp-fs": "435f8e4b-8cc4-430e-9796-28cae4976576", + "microsoft-windows-storagemanagement-wsp-health": "b1f01d1a-ae3a-4940-81ee-ddccbad380ef", + "microsoft-windows-storagemanagement-wsp-host": "595f33ea-d4af-4f4d-b4dd-9dacdd17fc6e", + "microsoft-windows-storagemanagement-wsp-spaces": "88c09888-118d-48fc-8863-e1c6d39ca4df", + "microsoft-windows-storagesettings": "e934e6dd-62be-55d8-1cc8-416d0039498b", + "microsoft-windows-storagespaces-api": "bcf0c6a7-6130-5208-f27d-fa77a91f12df", + "microsoft-windows-storagespaces-driver": "595f7f52-c90a-4026-a125-8eb5e083f15e", + "microsoft-windows-storagespaces-managementagent": "aa4c798d-d91b-4b07-a013-787f5803d6fc", + "microsoft-windows-storagespaces-parser": "5bcf2a5c-2e90-5a03-aa4e-2e459bae21b4", + "microsoft-windows-storagespaces-spacemanager": "69c8ca7e-1adf-472b-ba4c-a0485986b9f6", + "microsoft-windows-storagevolume": "c8127b86-e611-5638-63f4-ae37539084d2", + "microsoft-windows-stordiag": "f5d05b38-80a6-4653-825d-c414e4ab3c68", + "microsoft-windows-store": "9c2a37f3-e5fd-5cae-bcd1-43dafeee1ff0", + "microsoft-windows-storport": "c4636a1e-7986-4646-bf10-7bc3b4a76e8e", + "microsoft-windows-storsvc": "a963a23c-0058-521d-71ec-a1cce6173f21", + "microsoft-windows-subsys-csr": "e8316a2d-0d94-4f52-85dd-1e15b66c5891", + "microsoft-windows-subsys-smss": "43e63da5-41d1-4fbf-aded-1bbed98fdd1d", + "microsoft-windows-sudo": "9d74dc62-b75f-54cd-be9e-c28940b5feed", + "microsoft-windows-superfetch": "99806515-9f51-4c2f-b918-1eae407aa8cb", + "microsoft-windows-sysprep": "75ebc33e-77b8-4ba8-9474-4f4a9db2f5c6", + "microsoft-windows-system-profile-hardwareid": "3419de6d-5d7f-4668-acc8-f80566814d96", + "microsoft-windows-system-restore": "126cdb97-d346-4894-8a34-658da5eea1b6", + "microsoft-windows-systemeventsbroker": "b6bfcc79-a3af-4089-8d4d-0eecb1b80779", + "microsoft-windows-systemsettingshandlers": "fbbd52e1-df97-529d-4b67-53f67da99a98", + "microsoft-windows-systemsettingsthreshold": "8bcdf442-3070-4118-8c94-e8843be363b3", + "microsoft-windows-tabletpc-inputpanel": "e978f84e-582d-4167-977e-32af52706888", + "microsoft-windows-tabletpc-mathinput": "8443ccb7-feb0-4b8d-8e28-8d4c7cb814e8", + "microsoft-windows-tabletpc-mathrecognizer": "bdb462fc-a297-49a2-bf2e-4f1809e12abc", + "microsoft-windows-tabletpc-platform-input-core": "b5fd844a-01d4-4b10-a57f-58b13b561582", + "microsoft-windows-tabletpc-platform-input-ninput": "2c3e6d9f-8298-450f-8e5d-49b724f1216f", + "microsoft-windows-tabletpc-platform-input-wisp": "e5aa2a53-30be-40f5-8d84-ad3f40a404cd", + "microsoft-windows-tabletpc-platform-manipulations": "2fd7a9a5-b1a1-4fc7-b95c-c32fed818f30", + "microsoft-windows-taskbarcpl": "05d7b0f0-2121-4eff-bf6b-ed3f69b894d7", + "microsoft-windows-taskscheduler": "de7b24ea-73c8-4a09-985d-5bdadcfa9017", + "microsoft-windows-tcpip": "2f07e2ee-15db-40f1-90ef-9d7ba282188a", + "microsoft-windows-tenantrestrictions": "4053fada-178b-5aa8-746b-7cf8538b5118", + "microsoft-windows-terminalservices-clientactivexcore": "28aa95bb-d444-4719-a36f-40462168127e", + "microsoft-windows-terminalservices-clientusbdevices": "6e400999-5b82-475f-b800-cef6fe361539", + "microsoft-windows-terminalservices-localsessionmanager": "5d896912-022d-40aa-a3a8-4fa5515c76d7", + "microsoft-windows-terminalservices-mediaredirection": "3f7b2f99-b863-4045-ad05-f6afb62e7af1", + "microsoft-windows-terminalservices-pnpdevices": "27a8c1e2-eb19-463e-8424-b399df27a216", + "microsoft-windows-terminalservices-printers": "952773bf-c2b7-49bc-88f4-920744b82c43", + "microsoft-windows-terminalservices-rdpsounddriver": "127e0dc5-e13b-4935-985e-78fd508b1d80", + "microsoft-windows-terminalservices-remoteconnectionmanager": "c76baa63-ae81-421c-b425-340b4b24157f", + "microsoft-windows-terminalservices-serverusbdevices": "dcbe5aaa-16e2-457c-9337-366950045f0a", + "microsoft-windows-tethering-manager": "cc311f1f-623c-4ca4-ba44-a458016555e8", + "microsoft-windows-tethering-station": "585cab4f-9351-436e-9d99-dc4b41a20de0", + "microsoft-windows-textpredictionengine": "39a63500-7d76-49cd-994f-ffd796ef5a53", + "microsoft-windows-themecpl": "61f044af-9104-4ca5-81ee-cb6c51bb01ab", + "microsoft-windows-themeui": "869fb599-80aa-485d-bca7-db18d72b7219", + "microsoft-windows-thermal-polling": "e8a7c168-81ee-465c-8e8e-d39a2ac1ca41", + "microsoft-windows-threat-intelligence": "f4e1897c-bb5d-5668-f1d8-040f4d8dd344", + "microsoft-windows-time-service": "06edcfeb-0fd0-4e53-acca-a6f8bbf81bcb", + "microsoft-windows-time-service-ptp-provider": "cffb980e-327c-5b87-19c6-62c4c3be2290", + "microsoft-windows-timebroker": "0657adc1-9ae8-4e18-932d-e6079cda5ab3", + "microsoft-windows-tpm-wmi": "7d5387b0-cbe0-11da-a94d-0800200c9a66", + "microsoft-windows-triggeremulatorprovider": "f230d19a-5d93-47d9-a83f-53829edfb8df", + "microsoft-windows-troubleshooting-recommended": "4969de67-439c-516f-f805-a82a4f905730", + "microsoft-windows-tsf-msctf": "4fba1227-f606-4e5f-b9e8-fab9ab5740f3", + "microsoft-windows-tsf-msutb": "74b655a2-8958-410e-80e2-3457051b8dff", + "microsoft-windows-tsf-uimanager": "4dd778b8-379c-4d8c-b659-517a43d6df7d", + "microsoft-windows-tunneldriver": "4edbe902-9ed3-4cf0-93e8-b8b5fa920299", + "microsoft-windows-tunneldriver-sqm-provider": "4214dcd2-7c33-4f74-9898-719ccceec20f", + "microsoft-windows-tzsync": "3527cb55-1298-49d4-ab94-1243db0fcaff", + "microsoft-windows-tzutil": "2d318b91-e6e7-4c46-bd04-bfe6db412cf9", + "microsoft-windows-uac": "e7558269-3fa5-46ed-9f4d-3c6e282dde55", + "microsoft-windows-uac-filevirtualization": "c02afc2b-e24e-4449-ad76-bcc2c2575ead", + "microsoft-windows-ui-input-inking": "bf1db390-3e67-4d4d-a287-8958044a3db4", + "microsoft-windows-ui-search": "d8965fcf-7397-4e0e-b750-21a4580bd880", + "microsoft-windows-uianimation": "e0a40b26-30c4-4656-bc9a-74a5c3a0b2ec", + "microsoft-windows-uiautomationcore": "820a42d8-38c4-465d-b64e-d7d56ea1d612", + "microsoft-windows-uiribbon": "87d476fe-1a0f-4370-b785-60b028019693", + "microsoft-windows-universaltelemetryclient": "6489b27f-7c43-5886-1d00-0a61bb2a375b", + "microsoft-windows-urlmon": "245f975d-909d-49ed-b8f9-9a75691d6b6b", + "microsoft-windows-usb-ccid": "f708c483-4880-11e6-9121-5cf37068b67b", + "microsoft-windows-usb-mausbhost": "7725b5f9-1f2e-4e21-baeb-b2af4690bc87", + "microsoft-windows-usb-ucmucsicx": "569d11aa-5068-5ee5-da22-ce541c0b1481", + "microsoft-windows-usb-ucx": "36da592d-e43a-4e28-af6f-4bc57c5a11e8", + "microsoft-windows-usb-usb4devicerouter-eventlogs": "d07e8c3f-78fb-4c22-b77c-2203d00bfdf3", + "microsoft-windows-usb-usbhub": "7426a56b-e2d5-4b30-bdef-b31815c1a74a", + "microsoft-windows-usb-usbhub3": "ac52ad17-cc01-4f85-8df5-4dce4333c99b", + "microsoft-windows-usb-usbport": "c88a4ef5-d048-4013-9408-e04b7db2814a", + "microsoft-windows-usb-usbxhci": "30e1d284-5d88-459c-83fd-6345b39b19ec", + "microsoft-windows-user device registration": "23b8d46b-67dd-40a3-b636-d43e50552c6d", + "microsoft-windows-user profiles general": "db00dfb6-29f9-4a9c-9b3b-1f4f9e7d9770", + "microsoft-windows-user profiles service": "89b1e9f0-5aff-44a6-9b44-0a07a7ce5845", + "microsoft-windows-user-controlpanel": "319122a9-1485-4e48-af35-7db2d93b8ad2", + "microsoft-windows-user-diagnostic": "305fc87b-002a-5e26-d297-60223012ca9c", + "microsoft-windows-user-loader": "b059b83f-d946-4b13-87ca-4292839dc2f2", + "microsoft-windows-useraccountcontrol": "2683b597-3cca-410a-97fe-6f7ee3d09b94", + "microsoft-windows-userdataaccess-callhistoryclient": "f5988abb-323a-4098-8a34-85a3613d4638", + "microsoft-windows-userdataaccess-cemapi": "83a9277a-d2fc-4b34-bf81-8ceb4407824f", + "microsoft-windows-userdataaccess-pimindexmaintenance": "99c66ba7-5a97-40d5-aa01-8a07fb3db292", + "microsoft-windows-userdataaccess-poom": "0bd19909-eb6f-4b16-8074-6dce803f091d", + "microsoft-windows-userdataaccess-unifiedstore": "56f519ab-9df6-4345-8491-a4ba21ac825b", + "microsoft-windows-userdataaccess-userdataapis": "b9b2de3c-3fbd-4f42-8ff7-33c3bad35fd4", + "microsoft-windows-userdataaccess-userdataservice": "fb19ee2c-0d22-4a2e-969e-dd41ae0ce1a9", + "microsoft-windows-userdataaccess-userdatautils": "d1f688bf-012f-4aec-a38c-e7d4649f8cd2", + "microsoft-windows-usermodepowerservice": "ce8dee0b-d539-4000-b0f8-77bed049c590", + "microsoft-windows-userpnp": "96f4a050-7e31-453c-88be-9634f4e02139", + "microsoft-windows-usersettingsbackup-backupunitprocessor": "dc84bbf4-cded-56ef-bf3b-e2051d5589d5", + "microsoft-windows-usersettingsbackup-earlydownloader": "c675305e-51bd-5da6-08b4-d4cb88d198f0", + "microsoft-windows-usersettingsbackup-orchestrator": "47ae8351-b61a-51d1-0ad0-9d870c38f53a", + "microsoft-windows-uxinit": "4154a29c-40d9-445f-8d65-24da473e8f65", + "microsoft-windows-uxtheme": "422088e6-cd0c-4f99-bd0b-6985fa290bdf", + "microsoft-windows-vdrvroot": "e4480490-85b6-11dd-ad8b-0800200c9a66", + "microsoft-windows-verifyhardwaresecurity": "f3f53c76-b06d-4f15-b412-61164a0d2b73", + "microsoft-windows-vhdmp": "e2816346-87f4-4f85-95c3-0c79409aa89d", + "microsoft-windows-video-for-windows": "712abb2d-d806-4b42-9682-26da01d8b307", + "microsoft-windows-virtdisk": "4d20df22-e177-4514-a369-f1759feedeb3", + "microsoft-windows-volumecontrol": "07de7879-1c96-41ce-afbd-c659a0e8e643", + "microsoft-windows-volumesnapshot-driver": "67fe2216-727a-40cb-94b2-c02211edb34a", + "microsoft-windows-vpn-client": "3c088e51-65be-40d1-9b90-62bfec076737", + "microsoft-windows-vwifi": "314b2b0d-81ee-4474-b6e0-c2aaec0ddbde", + "microsoft-windows-wabsyncprovider": "17f14a23-551d-40cc-a086-e4194d64ed4c", + "microsoft-windows-wallet": "6ed11b00-c1b5-48cb-aecc-ff72ebefbae8", + "microsoft-windows-watchdog-events": "70e74dd8-39db-5f6f-6fd1-f5581b29e834", + "microsoft-windows-wcmsvc": "67d07935-283a-4791-8f8d-fa9117f3e6f2", + "microsoft-windows-wcn-config-registrar": "c100becf-d33a-4a4b-bf23-bbef4663d017", + "microsoft-windows-wcn-config-registrar-secure": "c100becc-d33a-4a4b-bf23-bbef4663d017", + "microsoft-windows-wcnwiz": "e8aa5402-26a1-455e-a21b-f240ed62d155", + "microsoft-windows-wdag-policyevaluator-csp": "64a98c25-9e00-404e-84ad-6700dfe02529", + "microsoft-windows-wdag-policyevaluator-gp": "e53df8ba-367a-4406-98d5-709ffb169681", + "microsoft-windows-webauth": "db6972b6-dddf-4820-84b1-2ed6ac0b96e5", + "microsoft-windows-webauthn": "3ae1ea61-c002-47fb-b06c-4022a8c98929", + "microsoft-windows-webcamexperience": "9e12ceb1-e3ff-46ad-a0aa-11738b122d20", + "microsoft-windows-webdavclient-lookupservicetrigger": "22b6d684-fa63-4578-87c9-effcbe6643c7", + "microsoft-windows-webdeploy": "ab77e98e-0138-4c77-8bfb-decd33edfe3c", + "microsoft-windows-webio": "50b3e73c-9370-461d-bb9f-26f32d68887d", + "microsoft-windows-webservices": "e04fe2e0-c6cf-4273-b59d-5c97c9c374a4", + "microsoft-windows-websocket-protocol-component": "cba5f63c-e2cf-4b36-8305-bde1311924fc", + "microsoft-windows-wephostsvc": "d5f7235b-48e2-4e9c-92fe-0e4950aba9e8", + "microsoft-windows-wer-diag": "ad8aa069-a01b-40a0-ba40-948d1d8dedc5", + "microsoft-windows-wer-payloadhealth": "4afddfde-002d-51ac-c109-c3b7897858d0", + "microsoft-windows-wer-systemerrorreporting": "abce23e7-de45-4366-8631-84fa6c525952", + "microsoft-windows-werkernel": "87a623f0-8db5-5c11-7c80-a2ebbcbe5189", + "microsoft-windows-wfp": "0c478c5b-0351-41b1-8c58-4a6737da32e3", + "microsoft-windows-whea-logger": "c26c4f3c-3f66-4e99-8f8a-39405cfed220", + "microsoft-windows-wifidisplay": "712880e9-7813-41a3-8e4c-e4e0c4f6580a", + "microsoft-windows-wifihotspotservice": "814182fe-58f7-11e1-853c-78e7d1ca7337", + "microsoft-windows-wifinetworkmanager": "e5c16d49-2464-4382-bb20-97a4b5465db9", + "microsoft-windows-win32k": "8c416c79-d49b-4f01-a467-e56d3aa8234c", + "microsoft-windows-windeploy": "75ebc33e-c8ae-4f93-9ca1-683a53e20cb6", + "microsoft-windows-windows defender": "11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78", + "microsoft-windows-windows firewall with advanced security": "d1bc9aff-2abf-4d71-9146-ecb2a986eb85", + "microsoft-windows-windowsbackup": "01979c6a-42fa-414c-b8aa-eee2c8202018", + "microsoft-windows-windowscolorsystem": "d53270e3-c8cf-4707-958a-dad20c90073c", + "microsoft-windows-windowssystemassessmenttool": "11a75546-3234-465e-bec8-2d301cb501ac", + "microsoft-windows-windowstogo-startupoptions": "2e6cb42e-161d-413b-a6c1-84ca4c1e5890", + "microsoft-windows-windowsuiimmersive": "74827cbb-1e0f-45a2-8523-c605866d2f22", + "microsoft-windows-windowsupdateclient": "945a8954-c147-4acd-923f-40c45405a658", + "microsoft-windows-winhttp": "7d44233d-3055-4b9c-ba64-0d47ca40a232", + "microsoft-windows-winhttp-diagnostics": "64de121b-5f08-5853-ab48-7758f2ea2dd3", + "microsoft-windows-winhttp-pca": "d071ce03-0d7b-5b27-e817-b9c12961934e", + "microsoft-windows-wininet": "43d1a55c-76d6-4f7e-995c-64c711e5cafe", + "microsoft-windows-wininet-capture": "a70ff94f-570b-4979-ba5c-e59c9feab61b", + "microsoft-windows-wininet-config": "5402e5ea-1bdd-4390-82be-e108f1e634f5", + "microsoft-windows-wininet-pca": "4860ea43-3f05-5fb8-20ce-7ba346a44747", + "microsoft-windows-wininit": "206f6dea-d3c5-4d10-bc72-989f03c8b84b", + "microsoft-windows-winlogon": "dbe9b383-7cf3-4331-91cc-a3cb16a3b538", + "microsoft-windows-winmde": "77549803-7bb1-418b-a98e-f2e22f35a873", + "microsoft-windows-winml": "c8517e09-bea2-5bb6-bef3-50b4c91c431e", + "microsoft-windows-winnat": "66c07ecd-6667-43fc-93f8-05cf07f446ec", + "microsoft-windows-winreagent": "1f7a6c55-5532-573b-35b7-2107e43a6ef5", + "microsoft-windows-winrm": "a7975c8f-ac13-49f1-87da-5a984a4ab417", + "microsoft-windows-winrt-error": "a86f8471-c31d-4fbc-a035-665d06047b03", + "microsoft-windows-winsock-afd": "e53c6823-7bb8-44bb-90dc-3f86090d48a6", + "microsoft-windows-winsock-nameresolution": "55404e71-4db9-4deb-a5f5-8f86e46dde56", + "microsoft-windows-winsock-sockets": "bde46aea-2357-51fe-7367-d5296f530bd1", + "microsoft-windows-winsock-sqm": "093da50c-0bb9-4d7d-b95c-3bb9fcda5ee8", + "microsoft-windows-winsock-ws2help": "d5c25f9a-4d47-493e-9184-40dd397a004d", + "microsoft-windows-winsrv": "9d55b53d-449b-4824-a637-24f9d69aa02f", + "microsoft-windows-wired-autoconfig": "b92cf7fd-dc10-4c6b-a72d-1613bf25e597", + "microsoft-windows-wlan-autoconfig": "9580d7dd-0379-4658-9870-d5be7d52d6de", + "microsoft-windows-wlan-driver": "daa6a96b-f3e7-4d4d-a0d6-31a350e6a445", + "microsoft-windows-wlandlg": "d4afa0dc-4dd1-40af-afce-cb0d0e6736a7", + "microsoft-windows-wlanpref": "ca5ba219-c0d4-4efa-9ceb-72aff92672b0", + "microsoft-windows-wlgpa": "46098845-8a94-442d-9095-366a6bcfefa9", + "microsoft-windows-wmbclass": "12d25187-6c0d-4783-ad3a-84caa135acfd", + "microsoft-windows-wmbclass-opn": "a42fe227-a7bf-4483-a502-6bcda428cd96", + "microsoft-windows-wmi": "1edeee53-0afe-4609-b846-d8c0b2075b1f", + "microsoft-windows-wmi-activity": "1418ef04-b0b4-4623-bf7e-d74ab47bbdaa", + "microsoft-windows-wmp": "f3f14ff3-7b80-4868-91d0-d77e497b025e", + "microsoft-windows-wmp-setup_wm": "0d759f0f-cff9-4902-8867-eb9e29d7a98b", + "microsoft-windows-wmpdmcui": "3f9e07bd-0e26-4241-a5a5-28cafa150a75", + "microsoft-windows-wmpnss-publicapi": "614696c9-85af-4e64-b389-d2c0db4ff87b", + "microsoft-windows-wmpnss-service": "6a2dc7c1-930a-4fb5-bb44-80b30aebed6c", + "microsoft-windows-wmpnssui": "7c314e58-8246-47d1-8f7a-4049dc543e0b", + "microsoft-windows-wmvdecod": "55bacc9f-9ac0-46f5-968a-a5a5dd024f8a", + "microsoft-windows-wmvencod": "313b0545-bf9c-492e-9173-8de4863b8573", + "microsoft-windows-workfolders": "34a3697e-0f10-4e48-af3c-f869b5babebb", + "microsoft-windows-workplace join": "76ab12d5-c986-4e60-9d7c-2a092b284cdd", + "microsoft-windows-wpd-api": "31569dcf-9c6f-4b8e-843a-b7c1cc7ffcba", + "microsoft-windows-wpd-compositeclassdriver": "355c44fe-0c8e-4bf8-be28-8bc7b5a42720", + "microsoft-windows-wpd-mtpbt": "92ab58d3-f351-4af5-9c72-d52f36ee2c92", + "microsoft-windows-wpd-mtpclassdriver": "21b7c16e-c5af-4a69-a74a-7245481c1b97", + "microsoft-windows-wpd-mtpip": "c374d21e-69b2-4cd7-9a25-62187c5a5619", + "microsoft-windows-wpd-mtpus": "dcfc4489-9ce0-403c-99df-a05422c60898", + "microsoft-windows-wpdclassinstaller": "ad5162d8-daf0-4a25-88a7-01cbeb33902e", + "microsoft-windows-wsc-srv": "5857d6ca-9732-4454-809b-2a87b70881f8", + "microsoft-windows-wusa": "09608c12-c1da-4104-a6fe-b959cf57560a", + "microsoft-windows-wwan-mm-events": "7839bb2a-2ea3-4eca-a00f-b558ba678bec", + "microsoft-windows-wwan-ndisuio-events": "b3eee223-d0a9-40cd-adfc-50f1888138ab", + "microsoft-windows-wwan-svc-events": "3cb40aaa-1145-4fb8-b27b-7e30f0454316", + "microsoft-windows-wwanclient_0ca4cac9670d3ec454b4175eb8aa80b3": "0ca4cac9-670d-3ec4-54b4-175eb8aa80b3", + "microsoft-windows-wwanprotdim_e72a6a5d74743941a6fa83201a9f8ef4": "e72a6a5d-7474-3941-a6fa-83201a9f8ef4", + "microsoft-windows-xaml": "531a35ab-63ce-4bcf-aa98-f88c7a89e455", + "microsoft-windows-xaml-diagnostics": "59e7a714-73a4-4147-b47e-0957048c75c4", + "microsoft-windows-xaudio2": "1ee3abdb-c1fc-4b43-9e56-11064abba866", + "microsoft-windows-xwizards": "777ba8fe-2498-4875-933a-3067de883070", + "microsoft-windows-ztdns": "8507cd07-f18b-54f0-b871-23c43a5bf118", + "microsoft-windows-zthelper": "40e3fc75-59e8-5443-47cb-a1e1b197fde0", + "microsoft-windows-ztracemaps": "b865b57b-bdda-4e1d-a2c8-adfa69fe6ab9", + "microsoft-windowsazure-diagnostics": "9148c98f-152c-44d3-a496-26350c475d74", + "microsoft-windowsazure-status": "9e3b8bee-15eb-444b-a692-bab4546644f2", + "microsoft-windowsphone-configmanager2": "2f94e1cc-a8c5-4fe7-a1c3-53d7bda8e73e", + "microsoft-windowsphone-coremessaging": "922cdcf3-6123-42da-a877-1a24f23e39c5", + "microsoft-windowsphone-coreuicomponents": "a0b7550f-4e9a-4f03-ad41-b8042d06a2f7", + "microsoft-windowsphone-ufx": "e98ebdbf-3058-4784-8521-47860b1d2b8e", + "microsoft-windowsphone-ufxsynopsys": "49b12c7c-4bd5-4f93-bb75-30fce739600b", + "microsoft.windows.hyperv.gpupvdev": "c3a331b2-af4f-5472-fd2f-4313035c4e77", + "microsoft.windows.hyperv.vmiccore": "e5ea3ca6-5eb0-597d-504a-2fd09ccdefda", + "microsoft.windows.resourcemanager": "4180c4f7-e238-5519-338f-ec214f0b49aa", + "microsoft_sidecar": "1db28f2e-8f80-4027-8c5a-a11f7f10f62d", + "mmc": "9c88041d-349d-4647-8bfd-2c0a167bfe58", + "mobility center performance trace": "8a8b5246-6eb6-4339-8b59-b0085b9f4890", + "mobility center trace": "082dff20-f430-11d9-8cd6-0800200c9a66", + "mount manager trace": "467c1914-37f0-4c7d-b6db-5cd7dfe7bd5e", + "msadce.1": "76dba919-5a36-fc80-2cad-3185532b7cb1", + "msadcf.1": "101c0e21-ebba-a60a-ec3d-58797788928a", + "msadco.1": "5c6ce734-1b3e-705e-c2ab-b272d99aaf8f", + "msadds.1": "13cd7f92-5baa-8c7c-3d72-b69fac139a46", + "msadox.1": "6c770d53-0441-afd4-dcab-1d89155fecfc", + "msdadiag.etw": "8b98d3f2-3cc6-0b9c-6651-9649cce5c752", + "msdaprst.1": "64a552e0-6c60-b907-e59c-10f1dff76b0d", + "msdarem.1": "564f1e24-fc86-28e1-74f8-5ca0d950bee0", + "msdart.1": "ceb7253c-bb96-9dfe-51d1-53d966d0cf8b", + "msdasql_1": "b6501ba0-c61a-c4e6-6fa2-a4e7f8c8e7a0", + "msdatl3.1": "87b93a44-1f73-ec83-7261-2dfc972d9b1e", + "msiscsi_iscsi": "1babefb4-59cb-49e5-9698-fd38ac830a91", + "mui resource trace": "d3de60b2-a663-45d5-9826-a0a5949d2cb0", + "native wifi filter driver trace": "d905ac1c-65e7-4242-99ea-fe66a8355df8", + "native wifi msm trace": "d905ac1d-65e7-4242-99ea-fe66a8355df8", + "netjoin": "9741fd4e-3757-479f-a3c6-fc49f6d5edd0", + "network location awareness trace": "1ac55562-d4ff-4bc5-8ef3-a18e07c4668e", + "network profile manager": "d9131565-e1dd-4c9e-a728-951999c2adb5", + "nisdrvwfp provider": "49d6ad7b-52c4-4f79-a164-4dcd908391e4", + "ntfs": "dd70bc80-ef44-421b-8ac3-cd31da613a4e", + "ntfs_ntfslog": "b2fc00c4-2941-4d11-983b-b16e8aa4e25d", + "ntlm security protocol": "c92cf544-91b3-4dc0-8e11-c580339a0bf8", + "odbc.1": "f34765f6-a1be-4b9d-1400-b8a12921f704", + "odbcbcp.1": "932b59f1-90c2-d8ba-0956-3975c344ae2b", + "officeairspace": "f562bb8e-422d-4b5c-b20e-90d710f7d11c", + "officeloggingliblet": "f50d9315-e17e-43c1-8370-3edf6cc057be", + "oledb.1": "0dd082c4-66f2-271f-74ba-2bf1f9f65c66", + "openssh": "c4b57d35-0636-4bc3-a262-370f249f9802", + "pnpx assocdb trace": "7311ad03-18d6-45ac-9b08-b020bdd6a590", + "portable device connectivity api trace": "02fe721a-0725-469e-a26d-37b3c09faac1", + "powershellcore": "f90714a8-5509-434a-bf6d-b1624c8a19a2", + "printfilterpipelinesvc_objectsguid": "aefe45f4-8548-42b4-b1c8-25673b07ad8b", + "refsv1wpptrace": "6d2fd9c5-8bd8-4a5d-8aa8-01e5c3b2ae23", + "refswpptrace": "740f3c34-57df-4bad-8eea-72ac69ad5df5", + "rmclient_restartmanager": "0888e5ef-9b98-4695-979d-e92ce4247224", + "rowsethelper.1": "74a75b02-36d8-ede6-d10e-95b691503408", + "rss platform backgroundsync perf trace": "ca1cf55c-9e49-4ad3-8038-39cb6f66af11", + "rss platform backgroundsync trace": "f59d1d86-cc03-4736-bc9c-4c7936871b3d", + "rss platform perf trace": "2b240425-3141-43ee-931f-ec9f997c7d7e", + "rss platform trace": "8c50fa6e-394e-4b47-b6d1-a880a5f225a2", + "runtimeinstaller": "417879eb-0efb-4a9a-87ef-b9b55086aaf1", + "runtimerestserver": "ec93adf0-a939-4e61-b96d-bfa285eba2d5", + "sbp2 port driver tracing provider": "6710597f-7319-4aae-9b85-c8d87136a56b", + "schannel": "1f678132-5938-4686-9fdc-c8ff68f15c85", + "sd bus trace": "3b9e3da4-70b8-46d3-9ef2-3ddf128bded8", + "security: kerberos authentication": "6b510852-3583-4e2d-affe-a67f9f223438", + "security: ntlm authentication": "5bbb6c18-aa45-49b1-a15f-085f7ed0aa90", + "security: schannel": "37d2c3cd-c5d4-4587-8531-4696c44244c8", + "security: tspkg": "6165f3e2-ae38-45d4-9b23-6b4818758bd9", + "security: wdigest": "fb6a424f-b5d6-4329-b9d5-a975b3a93ead", + "sensor classextension trace": "a1e89bb0-ef73-4980-8c99-dd15f7271d7e", + "service control manager": "555908d1-a6d7-4695-8e1e-26931d2012f4", + "service control manager trace": "ebcca1c2-ab46-4a1d-8c2a-906c2ff25f39", + "serviceruntime": "3a867e2e-2c45-4b6c-9654-d7575e57f3cf", + "sqloledb_1": "c5bffe2e-9d87-d568-a09e-08fc83d0c7c2", + "sqlsrv32.1": "4b647745-f438-0a42-f870-5dbd29949c99", + "tcpip service trace": "eb004a05-9b1a-11d4-9123-0050047759bc", + "telemetry": "7c203661-7420-49de-b8e0-7cc5878ebed0", + "terminalserver-mediafoundationplugin": "4199ee71-d55d-47d7-9f57-34a1d5b2c904", + "thread pool": "c861d0e2-a2c1-4d36-9f9c-970bab943a12", + "tpm": "1b6b0772-251b-4d42-917d-faca166bc059", + "transparentinstaller": "747c00b6-f0b4-438c-8b48-f3e5d7ed38a2", + "ts client activex control trace": "daa6caf5-6678-43f8-a6fe-b40ee096e06e", + "ts client trace": "0c51b20c-f755-48a8-8123-bf6da2adc727", + "ts rdp init trace": "c127c1a8-6ceb-11da-8bde-f66bad1e3f3a", + "ts rdp shell trace": "bfa655dc-6c51-11da-8bde-f66bad1e3f3a", + "ts rdp sound end point trace": "5a966d1c-6b48-11da-8bde-f66bad1e3f3a", + "umb trace": "96ab095a-9519-4f5c-81ee-c510b0a45463", + "umbus driver trace": "f9be9c98-10db-4318-bb61-cb0ddea08bf7", + "umdf - driver manager trace": "485e7dea-0a80-11d8-ad15-505054503030", + "umdf - framework trace": "485e7de9-0a80-11d8-ad15-505054503030", + "umdf - host process trace": "485e7df0-0a80-11d8-ad15-505054503030", + "umdf - lpc driver trace": "485e7ded-0a80-11d8-ad15-505054503030", + "umdf - lpc trace": "485e7def-0a80-11d8-ad15-505054503030", + "umdf - platform library trace": "485e7de8-0a80-11d8-ad15-505054503030", + "umdf - reflector trace": "485e7dee-0a80-11d8-ad15-505054503030", + "umdf - test trace": "485e7deb-0a80-11d8-ad15-505054503030", + "umdf - wdf core": "485e7de9-0a80-11d8-ad15-505054503030", + "umpass driver trace": "ff9e2bdd-0e24-437c-84be-7cfcae635808", + "usb storage driver tracing provider": "72fb9358-a9b3-41e0-ae41-e8deca41e3a8", + "user-mode pnp manager trace": "a676b545-4cfb-4306-a067-502d9a0f2220", + "user32": "b0aa8734-56f7-41cc-b2f4-de228e98b946", + "volsnap": "cb017cd2-1f37-4e65-82bc-3e91f6a37559", + "vss tracing provider": "9138500e-3648-4edb-aa4c-859e9f7b7c38", + "windows connect now": "c100bece-d33a-4a4b-bf23-bbef4663d017", + "windows defender firewall api": "28c9f48f-d244-45a8-842f-dc9fbc9b6e92", + "windows defender firewall api - gp": "0eff663f-8b6e-4e6d-8182-087a8eaa29cb", + "windows defender firewall driver": "d5e09122-d0b2-4235-adc1-c89faaaf1069", + "windows defender firewall netshell plugin": "28c9f48f-d244-45a8-842f-dc9fbc9b6e94", + "windows defender firewall service": "5eefebdb-e90c-423a-8abf-0241e7c5b87d", + "windows error reporting": "0ead09bd-2157-539a-8d6d-c87f95b64d70", + "windows kernel trace": "9e814aad-3204-11d2-9a82-006008a86939", + "windows media player trace": "a9c1a3b7-54f3-4724-adce-58bc03e3bc78", + "windows networkitemfactory trace": "d2a60d61-0f87-4673-a86c-9c461457fe27", + "windows notification facility provider": "42695762-ea50-497a-9068-5cbbb35e0b95", + "windows remote management trace": "04c6e16d-b99f-4a3a-9b3e-b8325bbc781e", + "windows wininit trace": "c2ba06e2-f7ce-44aa-9e7e-62652cdefe97", + "windows winlogon trace": "d451642c-63a6-11d7-9720-00b0d03e0347", + "windows-applicationmodel-store-sdk": "ff79a477-c45f-4a52-8ae0-2b324346d4e4", + "windowsazure-guestagent-diagnostic": "de49cbbe-8388-4c87-8310-2f9ec1338bde", + "windowsazure-guestagent-metrics": "fff0196f-ee4c-4eaf-9aa5-776f622deb4f", + "windowsazure-guestagent-status": "69b669b9-4af8-4c50-bdc4-6006fa76e975", + "windowsazureguestagent": "3000b92b-ca8b-4269-90ea-c4185ee09e92", + "winsatapi_etw_provider": "617853d6-728b-4b59-8a78-c3a9a5eade92", + "winsrvext": "2b9537f0-4a90-557b-1313-d0ce2827a94a", + "wireless client trace": "8a3cf0b5-e0bc-450b-ae4b-61728ffa1d58", + "wlan autoconfig trace": "0c5a3172-2248-44fd-b9a6-8389cb1dc56a", + "wlan diagnostics trace": "637a0f36-dff5-4b2f-83dd-b106c1c725e2", + "wlan dialog trace": "520319a9-b932-4ec7-943c-61e560939101", + "wlan extensibility trace": "e2eb5b52-08b1-4391-b670-f58317376247", + "wmi_tracing": "1ff6b227-2ca7-40f9-9a66-980eadaa602e", + "wmi_tracing_client_operations": "8e6b6962-ab54-4335-8229-3255b919dd0e", + "wmp network sharing api": "8ed60a3a-8c12-49c5-a518-fdf451bc10fc", + "wmp network sharing service": "a7eb57f6-145e-4f18-bd75-dbbf6f7e23a7", + "wmp network sharing taskbar": "d804a67f-4c25-43c1-896f-89ff78b3a911", + "wpd api trace": "c3c5d8af-2fd5-4500-a8e7-379c2d0bbe2e", + "wpd bluetooth mtp emumerator driver trace": "4b6efb94-30ea-49a7-bb29-e9ed9dce67da", + "wpd busenumservice trace": "0381564e-d5cb-4e48-ab35-be24389b0f59", + "wpd classextension trace": "a0a352c5-b8ec-41e9-9936-8452c1c0a6cf", + "wpd classinstaller trace": "45350d79-4497-42f1-bd1b-83587575b91a", + "wpd fsdriver trace": "1311095b-b9ff-497a-8560-2f43ca5438e4", + "wpd mtpdriver trace": "97496dda-c211-4ffe-b1b1-68e6e98ebc38", + "wpd shellextension trace": "a42c7bd1-5af3-4b32-9bc6-b85eb31d3f4a", + "wpd shellserviceobject trace": "1ab5ac29-037f-43a1-9484-78c9db61f869", + "wpd types trace": "58e8f67d-29e9-456c-b23d-c6489e341bb0", + "wpd wiacompat trace": "b809f4ff-3023-473c-971b-ab594429ea57", + "wpd wmdmcompat trace": "17abf473-982c-4d0e-b502-3a59d89e71de", + "wsat_traceprovider": "7f3fe630-462b-47c5-ab07-67ca84934abd", + "wudfx02000_kmdftraceguid": "485e7de9-0a80-11d8-ad15-505054503030", + "xwizard framework": "777ba8ff-2498-4875-933a-3067de883070", +} diff --git a/internal/vm/vmutils/etw/etw_map_test.go b/internal/vm/vmutils/etw/etw_map_test.go new file mode 100644 index 0000000000..eb1d3e23d8 --- /dev/null +++ b/internal/vm/vmutils/etw/etw_map_test.go @@ -0,0 +1,65 @@ +package etw + +import ( + "strings" + "testing" +) + +func TestETWNameToGUIDMap_AllKeysAndValuesAreLowercase(t *testing.T) { + if len(etwNameToGUIDMap) == 0 { + t.Fatal("etwNameToGUIDMap is empty") + } + + for key, value := range etwNameToGUIDMap { + if key != strings.ToLower(key) { + t.Fatalf("map key is not lowercase: key=%q value=%q", key, value) + } + if value != strings.ToLower(value) { + t.Fatalf("map value is not lowercase: key=%q value=%q", key, value) + } + } +} + +func isValidGUID(guid string) bool { + // GUID format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (8-4-4-4-12 hex digits) + if len(guid) != 36 { + return false + } + for i, c := range guid { + switch i { + case 8, 13, 18, 23: + if c != '-' { + return false + } + default: + if (c < '0' || c > '9') && (c < 'a' || c > 'f') { + return false + } + } + } + return true +} + +func TestETWNameToGUIDMap_AllGUIDsAreValid(t *testing.T) { + for key, guid := range etwNameToGUIDMap { + if !isValidGUID(guid) { + t.Fatalf("invalid GUID format: key=%q guid=%q", key, guid) + } + } +} + +func TestETWNameToGUIDMap_KeysAreNonEmpty(t *testing.T) { + for key := range etwNameToGUIDMap { + if strings.TrimSpace(key) == "" { + t.Fatal("found empty key in etwNameToGUIDMap") + } + } +} + +func TestETWNameToGUIDMap_ValuesAreNonEmpty(t *testing.T) { + for key, value := range etwNameToGUIDMap { + if strings.TrimSpace(value) == "" { + t.Fatalf("found empty value for key=%q", key) + } + } +} diff --git a/internal/vm/vmutils/etw/provider_map.go b/internal/vm/vmutils/etw/provider_map.go new file mode 100644 index 0000000000..5b35206602 --- /dev/null +++ b/internal/vm/vmutils/etw/provider_map.go @@ -0,0 +1,216 @@ +package etw + +import ( + "encoding/base64" + "encoding/json" + "fmt" + "strings" + + "github.com/Microsoft/go-winio/pkg/guid" +) + +// Log Sources JSON structure +type LogSourcesInfo struct { + LogConfig LogConfig `json:"LogConfig"` +} + +type LogConfig struct { + Sources []Source `json:"sources"` +} + +type Source struct { + Type string `json:"type"` + Providers []EtwProvider `json:"providers"` +} + +type EtwProvider struct { + ProviderName string `json:"providerName,omitempty"` + ProviderGUID string `json:"providerGuid,omitempty"` + Level string `json:"level,omitempty"` + Keywords string `json:"keywords,omitempty"` +} + +// GetDefaultLogSources returns the default log sources configuration. +func GetDefaultLogSources() LogSourcesInfo { + return defaultLogSourcesInfo +} + +// GetProviderGUIDFromName returns the provider GUID for a given provider name. If the provider name is not found in the map, it returns an empty string. +func getProviderGUIDFromName(providerName string) string { + if guid, ok := etwNameToGUIDMap[strings.ToLower(providerName)]; ok { + return guid + } + return "" +} + +// providerKey returns a unique key for an EtwProvider, used for deduplication during merge. +// If both Name and GUID are present, key is "Name|GUID". If only GUID, key is GUID. Otherwise, key is Name. +func providerKey(provider EtwProvider) string { + if provider.ProviderGUID != "" { + if provider.ProviderName != "" { + return provider.ProviderName + "|" + provider.ProviderGUID + } + return provider.ProviderGUID + } + return provider.ProviderName +} + +// mergeProviders merges two slices of EtwProvider, with userProviders taking precedence over defaultProviders +// on key conflicts (same name, same GUID, or same name|GUID combination). +func mergeProviders(defaultProviders, userProviders []EtwProvider) []EtwProvider { + providerMap := make(map[string]EtwProvider) + for _, provider := range defaultProviders { + providerMap[providerKey(provider)] = provider + } + for _, provider := range userProviders { + providerMap[providerKey(provider)] = provider + } + + merged := make([]EtwProvider, 0, len(providerMap)) + for _, provider := range providerMap { + merged = append(merged, provider) + } + return merged +} + +// mergeLogSources merges userSources into resultSources. Sources with matching types have their +// providers merged; unmatched user sources are appended as new entries. +func mergeLogSources(resultSources []Source, userSources []Source) []Source { + for _, userSrc := range userSources { + merged := false + for i, resSrc := range resultSources { + if userSrc.Type == resSrc.Type { + resultSources[i].Providers = mergeProviders(resSrc.Providers, userSrc.Providers) + merged = true + break + } + } + if !merged { + resultSources = append(resultSources, userSrc) + } + } + return resultSources +} + +// decodeAndUnmarshalLogSources decodes a base64-encoded JSON string and unmarshals it into a LogSourcesInfo. +func decodeAndUnmarshalLogSources(base64EncodedJSONLogConfig string) (LogSourcesInfo, error) { + jsonBytes, err := base64.StdEncoding.DecodeString(base64EncodedJSONLogConfig) + if err != nil { + return LogSourcesInfo{}, fmt.Errorf("error decoding base64 log config: %w", err) + } + + var userLogSources LogSourcesInfo + if err := json.Unmarshal(jsonBytes, &userLogSources); err != nil { + return LogSourcesInfo{}, fmt.Errorf("error unmarshalling user log config: %w", err) + } + return userLogSources, nil +} + +func trimGUID(in string) string { + s := strings.TrimSpace(in) + s = strings.TrimPrefix(s, "{") + s = strings.TrimSuffix(s, "}") + s = strings.TrimSpace(s) + return s +} + +// resolveGUIDsWithLookup normalizes and fills in provider GUIDs from the well-known ETW map +// for all providers across all sources. Providers with an invalid GUID are warned and skipped. +func resolveGUIDsWithLookup(sources []Source) ([]Source, error) { + for i, src := range sources { + for j, provider := range src.Providers { + if provider.ProviderGUID != "" { + guid, err := guid.FromString(trimGUID(provider.ProviderGUID)) + if err != nil { + return nil, fmt.Errorf("invalid GUID %q for provider %q: %w", provider.ProviderGUID, provider.ProviderName, err) + } + sources[i].Providers[j].ProviderGUID = strings.ToLower(guid.String()) + } + if provider.ProviderName != "" && provider.ProviderGUID == "" { + sources[i].Providers[j].ProviderGUID = getProviderGUIDFromName(provider.ProviderName) + } + } + } + return sources, nil +} + +// stripRedundantGUIDs removes the GUID from providers where both Name and GUID are present and +// the GUID matches the well-known lookup by name. This ensures sidecar-GCS prefers name-based +// policy verification. Invalid GUIDs are errored out. +func stripRedundantGUIDs(sources []Source) ([]Source, error) { + for i, src := range sources { + for j, provider := range src.Providers { + if provider.ProviderName == "" || provider.ProviderGUID == "" { + continue + } + guid, err := guid.FromString(trimGUID(provider.ProviderGUID)) + if err != nil { + return nil, fmt.Errorf("invalid GUID %q for provider %q: %w", provider.ProviderGUID, provider.ProviderName, err) + } + if strings.EqualFold(guid.String(), getProviderGUIDFromName(provider.ProviderName)) { + sources[i].Providers[j].ProviderGUID = "" + } else { + // If the GUID doesn't match the well-known GUID for the provider name, + // we keep it but ensure it's normalized to lowercase without braces. + // However, we remove the provider name to avoid incorrect policy matches + // in sidecar-GCS, since the GUID is the source of truth in this case. + sources[i].Providers[j].ProviderName = "" + sources[i].Providers[j].ProviderGUID = strings.ToLower(guid.String()) + } + } + } + return sources, nil +} + +// applyGUIDPolicy applies GUID resolution or stripping to all sources depending on the includeGUIDs flag. +// See resolveGUIDsWithLookup and stripRedundantGUIDs for the respective behaviors. +func applyGUIDPolicy(sources []Source, includeGUIDs bool) ([]Source, error) { + if len(sources) == 0 { + return sources, nil + } + if includeGUIDs { + return resolveGUIDsWithLookup(sources) + } + return stripRedundantGUIDs(sources) +} + +// marshalAndEncodeLogSources marshals the given LogSourcesInfo to JSON and encodes it as a base64 string. +// On error, it logs and returns the original fallback string. +func marshalAndEncodeLogSources(logCfg LogSourcesInfo) (string, error) { + jsonBytes, err := json.Marshal(logCfg) + if err != nil { + return "", fmt.Errorf("error marshalling log config: %w", err) + } + return base64.StdEncoding.EncodeToString(jsonBytes), nil +} + +// UpdateLogSources updates the user provided log sources with the default log sources based on the +// configuration and returns the updated log sources as a base64 encoded JSON string. +// If there is an error in the process, it returns the original user provided log sources string. +func UpdateLogSources(base64EncodedJSONLogConfig string, useDefaultLogSources bool, includeGUIDs bool) (string, error) { + var resultLogCfg LogSourcesInfo + if useDefaultLogSources { + resultLogCfg = defaultLogSourcesInfo + } + + if base64EncodedJSONLogConfig != "" { + userLogSources, err := decodeAndUnmarshalLogSources(base64EncodedJSONLogConfig) + if err != nil { + return "", fmt.Errorf("failed to decode and unmarshal user log sources: %w", err) + } + resultLogCfg.LogConfig.Sources = mergeLogSources(resultLogCfg.LogConfig.Sources, userLogSources.LogConfig.Sources) + + } + + var err error + resultLogCfg.LogConfig.Sources, err = applyGUIDPolicy(resultLogCfg.LogConfig.Sources, includeGUIDs) + if err != nil { + return "", fmt.Errorf("failed to apply GUID policy: %w", err) + } + + result, err := marshalAndEncodeLogSources(resultLogCfg) + if err != nil { + return "", fmt.Errorf("failed to marshal and encode log sources: %w", err) + } + return result, nil +} diff --git a/internal/vm/vmutils/etw/provider_map_test.go b/internal/vm/vmutils/etw/provider_map_test.go new file mode 100644 index 0000000000..4aa62d861c --- /dev/null +++ b/internal/vm/vmutils/etw/provider_map_test.go @@ -0,0 +1,386 @@ +package etw + +import ( + "encoding/base64" + "encoding/json" + "reflect" + "strings" + "testing" + + "github.com/Microsoft/go-winio/pkg/guid" +) + +func TestGetProviderGUIDFromName(t *testing.T) { + // These names should be present in the etwNameToGUIDMap for the tests to pass. + tests := []struct { + name string + expected string + }{ + {"Microsoft.Windows.HyperV.Compute", etwNameToGUIDMap["microsoft.windows.hyperv.compute"]}, + {"Microsoft.Windows.Containers.Setup", etwNameToGUIDMap["microsoft.windows.containers.setup"]}, + {"nonexistent.provider", ""}, + {"", ""}, + } + + for _, tt := range tests { + got := getProviderGUIDFromName(tt.name) + if got != tt.expected { + t.Errorf("getProviderGUIDFromName(%q) = %q, want %q", tt.name, got, tt.expected) + } + } +} + +func TestUpdateLogSources_Combinations(t *testing.T) { + originalDefaults := cloneLogSourcesInfo(defaultLogSourcesInfo) + t.Cleanup(func() { + defaultLogSourcesInfo = cloneLogSourcesInfo(originalDefaults) + }) + + userConfig := buildTestUserLogSources(t) + + tests := []struct { + name string + base64Input string + useDefault bool + includeGUIDs bool + expectedLogCfg LogSourcesInfo + }{ + { + name: "empty_input_no_defaults_no_guids", + base64Input: "", + useDefault: false, + includeGUIDs: false, + expectedLogCfg: LogSourcesInfo{}, + }, + { + name: "empty_input_no_defaults_with_guids", + base64Input: "", + useDefault: false, + includeGUIDs: true, + expectedLogCfg: LogSourcesInfo{}, + }, + { + name: "empty_input_with_defaults_no_guids", + base64Input: "", + useDefault: true, + includeGUIDs: false, + expectedLogCfg: expectedLogSources(originalDefaults, LogSourcesInfo{}, true, false, false), + }, + { + name: "empty_input_with_defaults_with_guids", + base64Input: "", + useDefault: true, + includeGUIDs: true, + expectedLogCfg: expectedLogSources(originalDefaults, LogSourcesInfo{}, true, true, false), + }, + { + name: "user_input_no_defaults_no_guids", + base64Input: mustEncodeLogSources(t, userConfig), + useDefault: false, + includeGUIDs: false, + expectedLogCfg: expectedLogSources(originalDefaults, userConfig, false, false, true), + }, + { + name: "user_input_no_defaults_with_guids", + base64Input: mustEncodeLogSources(t, userConfig), + useDefault: false, + includeGUIDs: true, + expectedLogCfg: expectedLogSources(originalDefaults, userConfig, false, true, true), + }, + { + name: "user_input_with_defaults_no_guids", + base64Input: mustEncodeLogSources(t, userConfig), + useDefault: true, + includeGUIDs: false, + expectedLogCfg: expectedLogSources(originalDefaults, userConfig, true, false, true), + }, + { + name: "user_input_with_defaults_with_guids", + base64Input: mustEncodeLogSources(t, userConfig), + useDefault: true, + includeGUIDs: true, + expectedLogCfg: expectedLogSources(originalDefaults, userConfig, true, true, true), + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + defaultLogSourcesInfo = cloneLogSourcesInfo(originalDefaults) + + gotEncoded, err := UpdateLogSources(tt.base64Input, tt.useDefault, tt.includeGUIDs) + if err != nil { + t.Fatalf("UpdateLogSources returned error: %v", err) + } + got := mustDecodeLogSources(t, gotEncoded) + + if !reflect.DeepEqual(got, tt.expectedLogCfg) { + t.Fatalf("unexpected log config.\n got: %#v\nwant: %#v", got, tt.expectedLogCfg) + } + }) + } +} + +func buildTestUserLogSources(t *testing.T) LogSourcesInfo { + t.Helper() + + nameOnlyProvider := "Microsoft.Windows.HyperV.Compute" + nameAndGUIDProvider := "Microsoft.Windows.Containers.Setup" + + guid := getProviderGUIDFromName(nameAndGUIDProvider) + if guid == "" { + t.Fatalf("missing GUID mapping for provider %q", nameAndGUIDProvider) + } + if getProviderGUIDFromName(nameOnlyProvider) == "" { + t.Fatalf("missing GUID mapping for provider %q", nameOnlyProvider) + } + + return LogSourcesInfo{ + LogConfig: LogConfig{ + Sources: []Source{ + { + Type: "UserETW", + Providers: []EtwProvider{ + { + ProviderName: nameOnlyProvider, + Level: "Verbose", + }, + { + ProviderName: nameAndGUIDProvider, + ProviderGUID: "{" + strings.ToUpper(guid) + "}", + Level: "Warning", + }, + }, + }, + }, + }, + } +} + +func expectedLogSources(defaults LogSourcesInfo, user LogSourcesInfo, useDefault bool, includeGUIDs bool, includeUser bool) LogSourcesInfo { + var result LogSourcesInfo + + if useDefault { + result = cloneLogSourcesInfo(defaults) + } + + if includeUser { + userCopy := cloneLogSourcesInfo(user) + result.LogConfig.Sources = append(result.LogConfig.Sources, userCopy.LogConfig.Sources...) + } + + applyExpectedGUIDBehavior(&result, includeGUIDs) + return result +} + +func applyExpectedGUIDBehavior(cfg *LogSourcesInfo, includeGUIDs bool) { + for i, src := range cfg.LogConfig.Sources { + for j, provider := range src.Providers { + if includeGUIDs { + if provider.ProviderGUID != "" { + guid, err := guid.FromString(trimGUID(provider.ProviderGUID)) + if err != nil { + cfg.LogConfig.Sources[i].Providers[j].ProviderGUID = "" + } else { + cfg.LogConfig.Sources[i].Providers[j].ProviderGUID = strings.ToLower(guid.String()) + } + } + if provider.ProviderName != "" && provider.ProviderGUID == "" { + cfg.LogConfig.Sources[i].Providers[j].ProviderGUID = getProviderGUIDFromName(provider.ProviderName) + } + continue + } + + if provider.ProviderName != "" && provider.ProviderGUID != "" { + guid, err := guid.FromString(trimGUID(provider.ProviderGUID)) + if err != nil { + continue + } + if strings.EqualFold(guid.String(), getProviderGUIDFromName(provider.ProviderName)) { + cfg.LogConfig.Sources[i].Providers[j].ProviderGUID = "" + } else { + cfg.LogConfig.Sources[i].Providers[j].ProviderGUID = strings.ToLower(guid.String()) + } + } + } + } +} + +func cloneLogSourcesInfo(in LogSourcesInfo) LogSourcesInfo { + out := LogSourcesInfo{} + if in.LogConfig.Sources == nil { + return out + } + + out.LogConfig.Sources = make([]Source, len(in.LogConfig.Sources)) + for i, src := range in.LogConfig.Sources { + out.LogConfig.Sources[i].Type = src.Type + if src.Providers != nil { + out.LogConfig.Sources[i].Providers = append([]EtwProvider(nil), src.Providers...) + } + } + return out +} + +func mustEncodeLogSources(t *testing.T, cfg LogSourcesInfo) string { + t.Helper() + + b, err := json.Marshal(cfg) + if err != nil { + t.Fatalf("failed to marshal log sources: %v", err) + } + return base64.StdEncoding.EncodeToString(b) +} + +func mustDecodeLogSources(t *testing.T, encoded string) LogSourcesInfo { + t.Helper() + + b, err := base64.StdEncoding.DecodeString(encoded) + if err != nil { + t.Fatalf("failed to decode base64 log sources: %v", err) + } + + var cfg LogSourcesInfo + if err := json.Unmarshal(b, &cfg); err != nil { + t.Fatalf("failed to unmarshal log sources: %v", err) + } + return cfg +} + +func TestUpdateLogSources_ErrorCases(t *testing.T) { + originalDefaults := cloneLogSourcesInfo(defaultLogSourcesInfo) + t.Cleanup(func() { + defaultLogSourcesInfo = cloneLogSourcesInfo(originalDefaults) + }) + + // Build a config with an invalid GUID to trigger applyGUIDPolicy errors. + invalidGUIDConfig := LogSourcesInfo{ + LogConfig: LogConfig{ + Sources: []Source{ + { + Type: "ETW", + Providers: []EtwProvider{ + { + ProviderName: "SomeProvider", + ProviderGUID: "not-a-valid-guid", + }, + }, + }, + }, + }, + } + invalidGUIDBase64 := mustEncodeLogSources(t, invalidGUIDConfig) + + // Build a config with an invalid GUID but no provider name (only GUID set), + // to trigger the resolveGUIDsWithLookup path specifically. + invalidGUIDOnlyConfig := LogSourcesInfo{ + LogConfig: LogConfig{ + Sources: []Source{ + { + Type: "ETW", + Providers: []EtwProvider{ + { + ProviderGUID: "zzz-invalid", + }, + }, + }, + }, + }, + } + invalidGUIDOnlyBase64 := mustEncodeLogSources(t, invalidGUIDOnlyConfig) + + tests := []struct { + name string + base64Input string + useDefault bool + includeGUIDs bool + errContains string + }{ + { + name: "invalid_base64_input", + base64Input: "not-valid-base64!@#$", + useDefault: false, + includeGUIDs: false, + errContains: "failed to decode and unmarshal user log sources", + }, + { + name: "valid_base64_invalid_json", + base64Input: base64.StdEncoding.EncodeToString([]byte("{{not json}}")), + useDefault: false, + includeGUIDs: false, + errContains: "failed to decode and unmarshal user log sources", + }, + { + name: "invalid_base64_with_defaults", + base64Input: "!!!bad-base64!!!", + useDefault: true, + includeGUIDs: false, + errContains: "failed to decode and unmarshal user log sources", + }, + { + name: "invalid_base64_with_defaults_and_guids", + base64Input: "???", + useDefault: true, + includeGUIDs: true, + errContains: "failed to decode and unmarshal user log sources", + }, + { + name: "valid_base64_malformed_json_structure", + base64Input: base64.StdEncoding.EncodeToString([]byte(`{"LogConfig": {"sources": "not_an_array"}}`)), + useDefault: false, + includeGUIDs: false, + errContains: "failed to decode and unmarshal user log sources", + }, + { + name: "invalid_guid_with_includeGUIDs_resolveGUIDsWithLookup", + base64Input: invalidGUIDBase64, + useDefault: false, + includeGUIDs: true, + errContains: "failed to apply GUID policy", + }, + { + name: "invalid_guid_without_includeGUIDs_stripRedundantGUIDs", + base64Input: invalidGUIDBase64, + useDefault: false, + includeGUIDs: false, + errContains: "failed to apply GUID policy", + }, + { + name: "invalid_guid_only_no_name_with_includeGUIDs", + base64Input: invalidGUIDOnlyBase64, + useDefault: false, + includeGUIDs: true, + errContains: "failed to apply GUID policy", + }, + { + name: "invalid_guid_with_defaults_and_includeGUIDs", + base64Input: invalidGUIDBase64, + useDefault: true, + includeGUIDs: true, + errContains: "failed to apply GUID policy", + }, + { + name: "invalid_guid_with_defaults_without_includeGUIDs", + base64Input: invalidGUIDBase64, + useDefault: true, + includeGUIDs: false, + errContains: "failed to apply GUID policy", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + defaultLogSourcesInfo = cloneLogSourcesInfo(originalDefaults) + + got, err := UpdateLogSources(tt.base64Input, tt.useDefault, tt.includeGUIDs) + if err == nil { + t.Fatalf("expected error containing %q, got nil (result: %q)", tt.errContains, got) + } + if !strings.Contains(err.Error(), tt.errContains) { + t.Fatalf("expected error containing %q, got: %v", tt.errContains, err) + } + if got != "" { + t.Fatalf("expected empty result on error, got %q", got) + } + }) + } +} diff --git a/pkg/annotations/annotations.go b/pkg/annotations/annotations.go index ef35d6c325..6cd6cfe9aa 100644 --- a/pkg/annotations/annotations.go +++ b/pkg/annotations/annotations.go @@ -466,12 +466,15 @@ const ( // // Would be encoded as: // - // "io.microsoft.virtualmachine.wcow.logsources" = + // "io.microsoft.virtualmachine.forwardlogs.sources" = // "eyJsb2dDb25maWciOnsic291cmNlcyI6W3sidHlwZSI6IkVUVyIsInByb3ZpZGVycyI6W3sicHJvdmlkZXJHdWlkIjoiODBDRTUwREUtRDI2NC00NTgxLTk1MEQtQUJBREVFRTBEMzQwIiwicHJvdmlkZXJOYW1lIjoiTWljcm9zb2Z0LldpbmRvd3MuSHlwZXJWLkNvbXB1dGUiLCJsZXZlbCI6IkluZm9ybWF0aW9uIn1dfV19fQ==" - LogSources = "io.microsoft.virtualmachine.wcow.logsources" + LogSources = "io.microsoft.virtualmachine.forwardlogs.sources" - // ForwardLogs specifies whether to forward logs to the host or not. - ForwardLogs = "io.microsoft.virtualmachine.wcow.forwardlogs" + // Specifies whether to enable forwarding logs to the host or not. Defaults to false for (non-confidential) WCOW, meaning logs will be forwarded to the host if LogSources is set. And true for confidential containers, meaning logs will not be forwarded to the host by default. + LogForwardingEnabled = "io.microsoft.virtualmachine.forwardlogs.enable" + + // Specifies whether to enable default providers or not. Defaults to true. + DefaultLogSourcesEnabled = "io.microsoft.virtualmachine.forwardlogs.defaultsources.enable" ) // LCOW uVM annotations.