Windows 10 diagnostic data for the Full diagnostic data level
Windows 10, version 1703
Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs. This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see Windows 10, version 1709 Basic level diagnostic events and fields and Windows 10, version 1703 Basic level diagnostic events and fields.
The data covered in this article is grouped into the following categories:
Common Data (diagnostic header information)
Device, Connectivity, and Configuration data
Product and Service Usage data
Product and Service Performance data
Software Setup and Inventory data
Browsing History data
Inking, Typing, and Speech Utterance data
The majority of diagnostic data falls into the first four categories.
Most diagnostic events contain a header of common data:
Information that is added to most diagnostic events, if relevant and available:
User ID - a unique identifier associated with the user's Microsoft Account (if one is used) or local account. The user's Microsoft Account identifier is not collected from devices configured to send Basic diagnostic data
Environment from which the event was logged - Application ID of app or component that logged the event, Session GUID. Used to track events over a given period of time such the period an app is running or between boots of the OS.
The diagnostic event name, Event ID, ETW opcode, version, schema signature, keywords, and flags
HTTP header information, including the IP address. This IP address is the source address that’s provided by the network packet header and received by the diagnostics ingestion service.
Various IDs that are used to correlate and sequence related events together.
Device ID. This ID is not the user provided device name, but an ID that is unique for that device.
Device class - Desktop, Server, or Mobile
Event collection time
Diagnostic level - Basic or Full, Sample level - for sampled data, what sample level is this device opted into
Device, Connectivity, and Configuration data
This type of data includes details about the device, its configuration and connectivity capabilities, and status.
Information about the OS and device hardware, such as:
OS - version name, Edition
Installation type, subscription status, and genuine OS status
Processor architecture, speed, number of cores, manufacturer, and model
OEM details - manufacturer, model, and serial number
Device identifier and Xbox serial number
Firmware/BIOS - type, manufacturer, model, and version
Memory - total memory, video memory, speed, and how much memory is available after the device has reserved memory
Storage - total capacity and disk type
Battery - charge capacity and InstantOn support
Hardware chassis type, color, and form factor
Is this machine a virtual machine?
Information about the specific device capabilities such as:
Camera - whether the device has a front facing, a rear facing camera, or both.
Touch screen - does the device include a touch screen? If so, how many hardware touch points are supported?
Processor capabilities - CompareExchange128, LahfSahf, NX, PrefetchW, and SSE2
Trusted Platform Module (TPM) – whether present and what version
Virtualization hardware - whether an IOMMU is present, SLAT support, is virtualization enabled in the firmware
Voice – whether voice interaction is supported and the number of active microphones
Number of displays, resolutions, DPI
OEM or platform face detection
OEM or platform video stabilization and quality level set
Advanced Camera Capture mode (HDR vs. LowLight), OEM vs. platform implementation, HDR probability, and Low Light probability
Device preferences and settings
Information about the device settings and user preferences such as:
User Settings – System, Device, Network & Internet, Personalization, Cortana, Apps, Accounts, Time & Language, Gaming, Ease of Access, Privacy, Update & Security
User-provided device name
Whether device is domain-joined, or cloud-domain joined (that is, part of a company-managed network)
Hashed representation of the domain name
MDM (mobile device management) enrollment settings and status
BitLocker, Secure Boot, encryption settings, and status
Windows Update settings and status
Developer Unlock settings and status
Default app choices
Default browser choice
Default language settings for app, input, keyboard, speech, and display
App store update settings
Enterprise OrganizationID, Commercial ID
Information about the device peripherals such as:
Peripheral name, device model, class, manufacturer, and description
Peripheral device state, install state, and checksum
Driver name, package name, version, and manufacturer
HWID - A hardware vendor defined ID to match a device to a driver INF file
Driver state, problem code, and checksum
Whether driver is kernel mode, signed, and image size
Device network info
Information about the device network configuration such as:
Network system capabilities
Local or Internet connectivity status
Proxy, gateway, DHCP, DNS details, and addresses
Paid or free network
Wireless driver is emulated or not
Access point mode capable
Access point manufacturer, model, and MAC address
Name of networking driver service
Wi-Fi Direct details
Wi-Fi device hardware ID and manufacturer
Wi-Fi scan attempt counts and item counts
Mac randomization is supported/enabled or not
Number of spatial streams and channel frequencies supported
Manual or Auto Connect enabled
Time and result of each connection attempt
Airplane mode status and attempts
Interface description provided by the manufacturer
Data transfer rates
Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO)
Mobile operator and service provider name
Available SSIDs and BSSIDs
IP Address type - IPv4 or IPv6
Signal Quality percentage and changes
Hotspot presence detection and success rate
TCP connection performance
Miracast device names
Hashed IP address
Product and Service Usage data
This type of data includes details about the usage of the device, operating system, applications, and services.
Information about Windows and application usage such as:
OS component and app feature usage
User navigation and interaction with app and Windows features. This information could include user input, such as the name of a new alarm set, user menu choices, or user favorites.
Time of and count of app/component launches, duration of use, session GUID, and process ID
App time in various states – running foreground or background, sleeping, or receiving active user interaction
User interaction method and duration – whether and length of time user used the keyboard, mouse, pen, touch, speech, or game controller
Cortana launch entry point/reason
Notification delivery requests and status
Apps used to edit images and videos
SMS, MMS, VCard, and broadcast message usage statistics on primary or secondary line
Incoming and Outgoing calls and Voicemail usage statistics on primary or secondary line
Emergency alerts are received or displayed statistics
Information about Windows and application state such as:
Start Menu and Taskbar pins
App launch state –- with deep-link such as Groove launched with an audio track to play, or share contract such as MMS launched to share a picture.
Personalization impressions delivered
Whether the user clicked or hovered on UI controls or hotspots
User feedback Like or Dislike or rating was provided
Caret location or position within documents and media files - how much of a book has been read in a single session or how much of a song has been listened to.
Login success or failure
Login sessions and state
Product and Service Performance data
This type of data includes details about the health of the device, operating system, apps, and drivers.
Description and Examples
Device health and crash data
Information about the device and software health such as:
Error codes and error messages, name and ID of the app, and process reporting the error
DLL library predicted to be the source of the error - xyz.dll
System-generated files - app or product logs and trace files to help diagnose a crash or hang
System settings such as registry keys
User-generated files – .doc, .ppt, .csv files where they are indicated as a potential cause for a crash or hang
Details and counts of abnormal shutdowns, hangs, and crashes
Crash failure data – OS, OS component, driver, device, 1st and 3rd party app data
Crash and Hang dumps
The recorded state of the working memory at the point of the crash.
Memory in use by the kernel at the point of the crash.
Memory in use by the application at the point of the crash.
All the physical memory used by Windows at the point of the crash.
Class and function name within the module that failed.
Device performance and reliability data
Information about the device and software performance such as:
User Interface interaction durations - Start Menu display times, browser tab switch times, app launch and switch times, and Cortana and search performance and reliability.
Device on/off performance - Device boot, shutdown, power on/off, lock/unlock times, and user authentication times (fingerprint and face recognition durations).
In-app responsiveness - time to set alarm, time to fully render in-app navigation menus, time to sync reading list, time to start GPS navigation, time to attach picture MMS, and time to complete a Microsoft Store transaction.
User input responsiveness – onscreen keyboard invocation times for different languages, time to show autocomplete words, pen or touch latencies, latency for handwriting recognition to words, Narrator screen reader responsiveness, and CPU score.
UI and media performance and glitches/smoothness - video playback frame rate, audio glitches, animation glitches (stutter when bringing up Start), graphics score, time to first frame, play/pause/stop/seek responsiveness, time to render PDF, dynamic streaming of video from OneDrive performance
Disk footprint - Free disk space, out of memory conditions, and disk score.
Excessive resource utilization – components impacting performance or battery life through high CPU usage during different screen and power states
Background task performance - download times, Windows Update scan duration, Microsoft Defender Antivirus scan times, disk defrag times, mail fetch times, service startup and state transition times, and time to index on-device files for search results
Peripheral and devices - USB device connection times, time to connect to a wireless display, printing times, network availability, and connection times (time to connect to Wi-Fi, time to get an IP address from DHCP, and so on), smart card authentication times, automatic brightness environmental response times
Device setup - first setup experience times (time to install updates, install apps, connect to network etc.), time to recognize connected devices (printer and monitor), and time to setup Microsoft Account.
Power and Battery life – power draw by component (Process/CPU/GPU/Display), hours of screen off time, sleep state transition details, temperature and thermal throttling, battery drain in a power state (screen off or screen on), processes and components requesting power use during screen off, autobrightness details, time device is plugged into AC vs. battery, battery state transitions
Service responsiveness - Service URI, operation, latency, service success/error codes, and protocol.
Diagnostic heartbeat – regular signal to validate the health of the diagnostics system
Information about movie consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
Video Width, height, color pallet, encoding (compression) type, and encryption type
Instructions for how to stream content for the user - the smooth streaming manifest of chunks of content files that must be pieced together to stream the content based on screen resolution and bandwidth
URL for a specific two-second chunk of content if there is an error
Full screen viewing mode details
Music & TV
Information about music and TV consumption on the device. This information isn't intended to capture user viewing, listening, or habits.
Service URL for song being downloaded from the music service – collected when an error occurs to facilitate restoration of service
Content type (video, audio, surround audio)
Local media library collection statistics - number of purchased tracks, number of playlists
Region mismatch - User OS Region, and Xbox Live region
Information about reading consumption functionality on the device. This information isn't intended to capture user viewing, listening, or habits.
App accessing content and status and options used to open a Microsoft Store book
Language of the book
Time spent reading content
Content type and size details
Information about photos usage on the device. This information isn't intended to capture user viewing, listening, or habits.
File source data - local, SD card, network device, and OneDrive
Image & video resolution, video length, file sizes types and encoding
Collection view or full screen viewer use and duration of view
On-device file query
Information about local search activity on the device such as:
Type of query issued and index type (ConstraintIndex, SystemIndex)
Number of items requested and retrieved
File extension of search result user interacted with
Launched item kind, file extension, index of origin, and the App ID of the opening app.
Name of process calling the indexer and time to service the query.
A hash of the search scope (file, Outlook, OneNote, IE history)
The state of the indices (fully optimized, partially optimized, being built)
Information about purchases made on the device such as:
Product ID, edition ID, and product URI
Offer details - price
Order requested date/time
Store client type - web or native client
Purchase quantity and price
Payment type - credit card type and PayPal
Information about entitlements on the device such as:
Service subscription status and errors
DRM and license rights details - Groove subscription or OS volume license
Entitlement ID, lease ID, and package ID of the install package
License type (trial, offline versus online) and duration
License usage session
Software Setup and Inventory data
This type of data includes software installation and update information on the device.
Installed Applications and Install History
Information about apps, drivers, update packages, or OS components installed on the device such as:
App, driver, update package, or component’s Name, ID, or Package Family Name
Product, SKU, availability, catalog, content, and Bundle IDs
OS component, app or driver publisher, language, version and type (Win32 or UWP)
Install date, method, and install directory, count of install attempts
MSI package code and product code
Original OS version at install time
User or administrator or mandatory installation/update
Installation type – clean install, repair, restore, OEM, retail, upgrade, and update
Device update information
Information about Windows Update such as:
Update Readiness analysis of device hardware, OS components, apps, and drivers (progress, status, and results)
Number of applicable updates, importance, type
Update download size and source - CDN or LAN peers
Delay upgrade status and configuration
OS uninstall and rollback status and count
Windows Update server and service URL
Windows Update machine ID
Windows Insider build details
Browsing History data
Microsoft browser data: This type of data includes details about web browsing, the address bar, and search box performance on the device in the Microsoft browsers, such as:
Text typed in address bar and search box
Text selected for Ask Cortana search
Service response time
Autocompleted text if there was an autocomplete
Navigation suggestions provided based on local history and favorites
URLs (which may include search terms)
Inking Typing and Speech Utterance data
Voice, inking, and typing: This type of data gathers details about the voice, inking, and typing input features on the device, such as:
Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
Text input from Windows on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
Text of speech recognition results - result codes and recognized text
Language and model of the recognizer, System Speech language
App ID using speech features
Whether user is known to be a child
Confidence and Success/Failure of speech recognition