Looking for a Source for CallerId = Update;ScanForUpdatesForUser
Hello,
I am aware of the process UpdateOrchestrator which is the Windows process that is used to Manage the Windows Updates.
However, while analyzing the below windows update log I found process Update;ScanForUpdatesForUser under CallerId which means this process is triggering Windows update to find patches.
I am trying to find which Source/Process is executing Update;ScanForUpdatesForUser, is this also one of the Windows processes? If yes then how can we confirm it?
What is the best way to identify sources for such CallerId in the future?
How we can stop Update;ScanForUpdatesForUser from downloading activity?
===========================
Operating System: Windows 10 Pro version 21H2
2022/07/19 08:41:59.5535098 19504 112160 ComApi Federated Search: Starting search against 1 service(s) (cV = wJVfie8Y+kqYb+7M.1.0.1.0)
2022/07/19 08:41:59.5536032 19504 112160 ComApi * START * Search ClientId = Update;ScanForUpdatesForUser, ServiceId = 855E8A7C-ECB4-4CA3-B045-1DFA50104289, Flags: 0X8000000 (cV = wJVfie8Y+kqYb+7M.1.0.1.0.0)
2022/07/19 08:41:59.5548830 115400 111620 IdleTimer WU operation (CSearchCall::Init ID 6) started; operation # 38; does not use network; is at background priority
2022/07/19 08:41:59.5676970 115400 111620 Agent * START * Queueing Finding updates [CallerId = Update;ScanForUpdatesForUser Id = 6]
2022/07/19 08:41:59.5677016 115400 111620 Agent Service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 is not in sequential scan list
2022/07/19 08:41:59.5678279 115400 124816 Agent Service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 is not in sequential scan list
2022/07/19 08:41:59.5684416 115400 118048 Agent * END * Queueing Finding updates [CallerId = Update;ScanForUpdatesForUser Id = 6]
2022/07/19 08:41:59.5688848 115400 118048 Agent * START * Finding updates CallerId = Update;ScanForUpdatesForUser Id = 6 (cV = wJVfie8Y+kqYb+7M.1.0.1.0.0.1)
2022/07/19 08:41:59.5688865 115400 118048 Agent Online = No; Interactive = No; AllowCachedResults = No; Ignore download priority = No
2022/07/19 08:41:59.5688872 115400 118048 Agent Criteria = IsInstalled=0 AND AppCategoryIDs contains '421ba874-f903-4965-9b82-d60f3ba3cae0'""
2022/07/19 08:41:59.5688894 115400 118048 Agent ServiceID = {855E8A7C-ECB4-4CA3-B045-1DFA50104289} Third party service
2022/07/19 08:41:59.5688902 115400 118048 Agent Search Scope = {Current User}
2022/07/19 08:41:59.5688922 115400 118048 Agent Caller SID for Applicability: S-1-5-21-3361381113-1190506322-3074018767-9174
2022/07/19 08:42:00.1409324 115400 118048 SLS Get response for service 855E8A7C-ECB4-4CA3-B045-1DFA50104289 - forceExpire[False] asyncRefreshOnExpiry[False]
2022/07/19 08:42:00.1409364 115400 118048 SLS path used for cache lookup: /SLS/{855E8A7C-ECB4-4CA3-B045-1DFA50104289}/x64/10.0.19044.1645/0?CH=18&L=en-US&P=&PT=0x30&WUA=10.0.19041.1503&MK=Dell+Inc.&MD=OptiPlex+7060
2022/07/19 08:42:00.7155143 115400 118048 Handler FAILED [80070032] Method failed [AppxPackage::Initialize:232]
2022/07/19 08:42:00.7155170 115400 118048 Handler FAILED [80070032] Method failed [AppxApplicabilityData::Initialize:549]
2022/07/19 08:42:00.7155783 115400 118048 EEHandler FAILED [80070032] EvaluateManifestBasedRule failed for update 9E8CFD76-C0A2-4EE9-92A7-96F8DB39B1A4.1, idExpr=57
2022/07/19 08:42:00.7155824 115400 118048 Agent FAILED [80070032] Evaluate Installed rule, updateId = {<!-- -->{9E8CFD76-C0A2-4EE9-92A7-96F8DB39B1A4}.1}
2022/07/19 08:42:00.7169906 115400 118048 Handler FAILED [80070032] Method failed [AppxPackage::Initialize:232]
2022/07/19 08:42:00.7169932 115400 118048 Handler FAILED [80070032] Method failed [AppxApplicabilityData::Initialize:549]
2022/07/19 08:42:00.7170449 115400 118048 EEHandler FAILED [80070032] EvaluateManifestBasedRule failed for update 9E8CFD76-C0A2-4EE9-92A7-96F8DB39B1A4.1, idExpr=56
2022/07/19 08:42:00.7170489 115400 118048 Agent FAILED [80070032] Evaluate Installable rule, updateId = {<!-- -->{9E8CFD76-C0A2-4EE9-92A7-96F8DB39B1A4}.1}
2022/07/19 08:42:00.9814104 115400 118048 Agent Added update 755634B9-311E-4763-9AD1-DFBCFD715915.1 to search result
2022/07/19 08:42:00.9814138 115400 118048 Agent Added update E066C2CC-9C49-4345-8ECD-058D3DB06BC6.1 to search result
2022/07/19 08:42:00.9814189 115400 118048 Agent Added update 885527E4-6919-4F0C-9B8E-93BE80D6CD8D.1 to search result
2022/07/19 08:42:00.9814218 115400 118048 Agent Added update 78A23D20-7A4F-4E7B-9F60-75E43049B0CF.1 to search result
2022/07/19 08:42:00.9814245 115400 118048 Agent Added update F3AF6919-173C-46D5-9AF7-C301D15DF839.1 to search result
2022/07/19 08:42:00.9814309 115400 118048 Agent Added update 55DB280B-C056-4E85-9CF6-BC0EDC41270B.1 to search result
2022/07/19 08:42:00.9814366 115400 118048 Agent Removing unreferenced framework update {F3AF6919-173C-46D5-9AF7-C301D15DF839}.1 from search result.
2022/07/19 08:42:00.9814421 115400 118048 Agent Removing unreferenced framework update {78A23D20-7A4F-4E7B-9F60-75E43049B0CF}.1 from search result.
2022/07/19 08:42:00.9814462 115400 118048 Agent Removing unreferenced framework update {885527E4-6919-4F0C-9B8E-93BE80D6CD8D}.1 from search result.
2022/07/19 08:42:00.9814504 115400 118048 Agent Removing unreferenced framework update {E066C2CC-9C49-4345-8ECD-058D3DB06BC6}.1 from search result.
2022/07/19 08:42:00.9814531 115400 118048 Agent Removing unreferenced framework update {755634B9-311E-4763-9AD1-DFBCFD715915}.1 from search result.
2022/07/19 08:42:00.9814706 115400 118048 Agent Found 1 updates and 8 categories in search; evaluated appl. rules of 60 out of 100 deployed entities
2022/07/19 08:42:00.9836817 115400 118048 Agent * END * Finding updates CallerId = Update;ScanForUpdatesForUser, Id = 6, Exit code = 0x00000000 (cV = wJVfie8Y+kqYb+7M.1.0.1.0.0.1)
2022/07/19 08:42:01.0120494 115400 118048 IdleTimer WU operation (CSearchCall::Init ID 6, operation # 38) stopped; does not use network; is at background priority
2022/07/19 08:42:01.0289437 19504 122468 ComApi RESUMED Search ClientId = Update;ScanForUpdatesForUser, ServiceId = 855E8A7C-ECB4-4CA3-B045-1DFA50104289 (cV = wJVfie8Y+kqYb+7M.1.0.1.0.0)
2022/07/19 08:42:01.0424978 19504 122468 ComApi UpdateId=55DB280B-C056-4E85-9CF6-BC0EDC41270B.1, DeploymentID=383738959, ClientMetadata: audience=(null), admin=(null), update=(null)
2022/07/19 08:42:01.0425023 19504 122468 ComApi * END * Search ClientId = Update;ScanForUpdatesForUser, Updates found = 1, ServiceId = 855E8A7C-ECB4-4CA3-B045-1DFA50104289 (cV = wJVfie8Y+kqYb+7M.1.0.1.0.0)
2022/07/19 08:42:02.8686979 19504 104132 ComApi * END * All federated searches have completed. Jobs = 1, Succeeded = 1, ClientId = Update;ScanForUpdatesForUser (cV = wJVfie8Y+kqYb+7M.1.0.1.1)