#line 1 "C:\\WINDOWS\\SYSTEM32\\WBEM\\SCM.MOF"
// © 2000 Microsoft Corporation.  All rights reserved.

#pragma autorecover
#pragma namespace ("\\\\.\\root\\cimv2")

/////////////////////////////////////////////////////////////////////////////
// Base classes for SCM events

class MSFT_SCMEvent : __ExtrinsicEvent
{
};

// Base class for events destined for the system Event Log.
class MSFT_SCMEventLogEvent : MSFT_SCMEvent
{
};

/////////////////////////////////////////////////////////////////////////////
// Net events

//
// MessageId: EVENT_BAD_ACCOUNT_NAME
//
// MessageText:
//
//  No backslash is in the account name.
//
[
    EventId(0xC0001B60) : ToInstance,
    EventType(1) : ToInstance
]
class MSFT_NetBadAccount : MSFT_SCMEventLogEvent
{
};


//
// MessageId: EVENT_CALL_TO_FUNCTION_FAILED
//
// MessageText:
//
//  The %1 call failed with the following error: %n%2
//
[
    EventId(0xC0001B5D) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%FunctionName%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetCallToFunctionFailed : MSFT_SCMEventLogEvent
{
    string FunctionName;
    uint32 Error;
};


//
// MessageId: EVENT_CALL_TO_FUNCTION_FAILED_II
//
// MessageText:
//
//  The %1 call failed for %2 with the following error: %n%3
//
[
    EventId(0xC0001B5E) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%FunctionName%", "%Argument%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetCallToFunctionFailedII : MSFT_SCMEventLogEvent
{
    string FunctionName;
    string Argument;
    uint32 Error;
};


//
// MessageId: EVENT_FIRST_LOGON_FAILED
//
// MessageText:
//
//  Logon attempt with current password failed with the following error: %n%1
//
[
    EventId(0xC0001B65) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%%%%%Error%"} : ToInstance
]
class MSFT_NetFirstLogonFailed : MSFT_SCMEventLogEvent
{
    uint32 Error;
};


//
// MessageId: EVENT_REVERTED_TO_LASTKNOWNGOOD
//
// MessageText:
//
//  The system reverted to its last known good configuration.  The system is restarting....
//
[
    EventId(0xC0001B5F) : ToInstance,
    EventType(1) : ToInstance
]
class MSFT_NetRevertedToLastKnownGood : MSFT_SCMEventLogEvent
{
};


//
// MessageId: EVENT_CONNECTION_TIMEOUT
//
// MessageText:
//
//  Timeout (%1 milliseconds) waiting for the %2 service to connect.
//
[
    EventId(0xC0001B61) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Milliseconds%", "%Service%"} : ToInstance
]
class MSFT_NetConnectionTimeout : MSFT_SCMEventLogEvent
{
    uint32 Milliseconds;
    string Service;
};


//
// MessageId: EVENT_READFILE_TIMEOUT
//
// MessageText:
//
//  Timeout (%1 milliseconds) waiting for ReadFile.
//
[
    EventId(0xC0001B62) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Milliseconds%"} : ToInstance
]
class MSFT_NetReadfileTimeout : MSFT_SCMEventLogEvent
{
    uint32 Milliseconds;
};


//
// MessageId: EVENT_TRANSACT_TIMEOUT
//
// MessageText:
//
//  Timeout (%1 milliseconds) waiting for a transaction response from the %2 service.
//
[
    EventId(0xC0001B63) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Milliseconds%", "%Service%"} : ToInstance
]
class MSFT_NetTransactTimeout : MSFT_SCMEventLogEvent
{
    uint32 Milliseconds;
    string Service;
};


//
// MessageId: EVENT_TRANSACT_INVALID
//
// MessageText:
//
//  Message returned in transaction has incorrect size.
//
[
    EventId(0xC0001B64) : ToInstance,
    EventType(1) : ToInstance
]
class MSFT_NetTransactInvalid : MSFT_SCMEventLogEvent
{
};


//
// Parameter %4 is the value, in decimal, of the SC_ACTION_ constant for
// the action described in parameter %5.
//
//
// MessageId: EVENT_SERVICE_CRASH
//
// MessageText:
//
//  The %1 service terminated unexpectedly.  It has done this %2 time(s).  The following corrective action will be taken in %3 milliseconds: %5.
//
[
    EventId(0xC0001B77) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%TimesFailed%", "%ActionDelay%", "%ActionType%", "%Action%"} : ToInstance
]
class MSFT_NetServiceCrash : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 TimesFailed;
    uint32 ActionDelay;
    uint32 ActionType;
    string Action;
};


//
// MessageId: EVENT_SERVICE_CRASH_NO_ACTION
//
// MessageText:
//
//  The %1 service terminated unexpectedly.  It has done this %2 time(s).
//
[
    EventId(0xC0001B7A) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%TimesFailed%" } : ToInstance
]
class MSFT_NetServiceCrashNoAction : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 TimesFailed;
};


//
// MessageId: EVENT_SERVICE_NOT_INTERACTIVE
//
// MessageText:
//
//  The %1 service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
//
[
    EventId(0xC0001B76) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetServiceNotInteractive : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// Parameter %1 is the value, in decimal, of the SC_ACTION_ constant for
// the action described in parameter %2.
//
//
// MessageId: EVENT_SERVICE_RECOVERY_FAILED
//
// MessageText:
//
//  The Service Control Manager tried to take a corrective action (%2) after the unexpected termination of the %3 service, but this action failed with the following error: %n%4
//
[
    EventId(0xC0001B78) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%ActionType%", "%Action%", "%Service%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetServiceRecoveryFailed : MSFT_SCMEventLogEvent
{
    uint32 ActionType;
    string Action;
    string Service;
    uint32 Error;
};


//
// MessageId: EVENT_SERVICE_START_FAILED
//
// MessageText:
//
//  The %1 service failed to start due to the following error: %n%2
//
[
    EventId(0xC0001B58) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetServiceStartFailed : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 Error;
};


//
// MessageId: EVENT_SERVICE_START_FAILED_II
//
// MessageText:
//
//  The %1 service depends on the %2 service which failed to start because
//  of the following error: %n%3
//
[
    EventId(0xC0001B59) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%DependedOnService%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetServiceStartFailedII : MSFT_SCMEventLogEvent
{
    string Service;
    string DependedOnService;
    uint32 Error;
};


//
// MessageId: EVENT_CIRCULAR_DEPENDENCY_DEMAND
//
// MessageText:
//
//  Detected circular dependencies demand starting %1.
//
[
    EventId(0xC0001B69) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetCircularDependencyDemand : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// MessageId: EVENT_CIRCULAR_DEPENDENCY_AUTO
//
// MessageText:
//
//  Detected circular dependencies auto-starting services.
//
[
    EventId(0xC0001B6A) : ToInstance,
    EventType(1) : ToInstance
]
class MSFT_NetCircularDependencyAuto : MSFT_SCMEventLogEvent
{
};


//
// MessageId: EVENT_SERVICE_START_FAILED_NONE
//
// MessageText:
//
//  The %1 service depends on the following nonexistent service: %2
//
[
    EventId(0xC0001B5B) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%NonExistingService%"} : ToInstance
]
class MSFT_NetServiceStartFailedNone : MSFT_SCMEventLogEvent
{
    string Service;
    string NonExistingService;
};


//
// MessageId: EVENT_DEPEND_ON_LATER_SERVICE
//
// MessageText:
//
//  Circular dependency: The %1 service depends on a service in a group which starts later.
//
[
    EventId(0xC0001B6B) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetDependOnLaterService : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// MessageId: EVENT_SERVICE_START_FAILED_GROUP
//
// MessageText:
//
//  The %1 service depends on the %2 group and no member of this group started.
//
[
    EventId(0xC0001B5A) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Group%"} : ToInstance
]
class MSFT_NetServiceStartFailedGroup : MSFT_SCMEventLogEvent
{
    string Service;
    string Group;
};


//
// MessageId: EVENT_DEPEND_ON_LATER_SERVICE
//
// MessageText:
//
//  Circular dependency: The %1 service depends on a service in a group which starts later.
//
[
    EventId(0xC0001B6B) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetDependOnLaterGroup : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// MessageId: EVENT_SERVICE_START_HUNG
//
// MessageText:
//
//  The %1 service hung on starting.
//
[
    EventId(0xC0001B6E) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetServiceStartHung : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// MessageId: EVENT_SEVERE_SERVICE_FAILED
//
// MessageText:
//
//  About to revert to the last known good configuration because the %1 service failed to start.
//
[
    EventId(0xC0001B6D) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetSevereServiceFailed : MSFT_SCMEventLogEvent
{
    string Service;
};


//
// MessageId: EVENT_TAKE_OWNERSHIP
//
// MessageText:
//
//  The %1 Registry key denied access to SYSTEM account programs so the Service Control Manager took ownership of the Registry key.
//
[
    EventId(0xC0001B74) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%RegistryKey%"} : ToInstance
]
class MSFT_NetTakeOwnership : MSFT_SCMEventLogEvent
{
    string RegistryKey;
};


//
// MessageId: EVENT_BAD_SERVICE_STATE
//
// MessageText:
//
//  The %1 service has reported an invalid current state %2.
//
[
    EventId(0xC0001B68) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%State%"} : ToInstance
]
class MSFT_NetBadServiceState : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 State;
};


//
// MessageId: EVENT_SERVICE_EXIT_FAILED
//
// MessageText:
//
//  The %1 service terminated with the following error: %n%2
//
[
    EventId(0xC0001B6F) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetServiceExitFailed : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 Error;
};


//
// MessageId: EVENT_SERVICE_EXIT_FAILED_SPECIFIC
//
// MessageText:
//
//  The %1 service terminated with service-specific error %2.
//
[
    EventId(0xC0001B70) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Error% (%Error(0x%X)%)"} : ToInstance
]
class MSFT_NetServiceExitFailedSpecific : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 Error;
};


//
// MessageId: EVENT_BOOT_SYSTEM_DRIVERS_STOPPED
//
// MessageText:
//
//  The following boot-start or system-start driver(s) did not load: %1
//
[
    EventId(0xC0001B72) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%DriverList%"} : ToInstance
]
class MSFT_NetBootSystemDriversFailed : MSFT_SCMEventLogEvent
{
    string DriverList;
};


//
// MessageId: EVENT_SERVICE_CONTROL_SUCCESS
//
// MessageText:
//
//  The %1 service was successfully sent a %2 control.
//
[
    EventId(0x40001B7B) : ToInstance,
    EventType(4) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Control%"} : ToInstance
]
class MSFT_NetServiceControlSuccess : MSFT_SCMEventLogEvent
{
    string Service;
    string Control;
    string sid;
};


//
// MessageId: EVENT_SERVICE_STATUS_SUCCESS
//
// MessageText:
//
//  The %1 service entered the %2 state.
//
[
    EventId(0x40001B7C) : ToInstance,
    EventType(4) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Control%"} : ToInstance
]
class MSFT_NetServiceStatusSuccess : MSFT_SCMEventLogEvent
{
    string Service;
    string Control;
};


//
// MessageId: EVENT_SERVICE_CONFIG_BACKOUT_FAILED
//
// MessageText:
//
//  The Service Control Manager encountered an error undoing a change to the
//  %1 for the %2 service after a failed attempt to update the service's
//  configuration information, leaving the service's configuration information
//  in an unpredictable state.  Use the Services MMC snap-in to make sure
//  the service is configured as expected.
//
[
    EventId(0xC0001B7D) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%ConfigField%"} : ToInstance
]
class MSFT_NetServiceConfigBackoutFailed : MSFT_SCMEventLogEvent
{
    string Service;
    string ConfigField;
};


//
// MessageId: EVENT_FIRST_LOGON_FAILED_II
//
// MessageText:
//
//  The %1 service was unable to log on as %2 with the currently configured
//  password due to the following error: %n%3.  To ensure that the service is
//  configured properly, use the Services snap-in in Microsoft Management
//  Console (MMC).
//
[
    EventId(0xC0001B7E) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Account%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetFirstLogonFailedII : MSFT_SCMEventLogEvent
{
    string Service;
    string Account;
    uint32 Error;
};


//
// MessageId: EVENT_SERVICE_DIFFERENT_PID_CONNECTED
//
// MessageText:
//
//  A service process other than the one launched by the Service Control Manager
//  connected when starting the %1 service.  The Service Control Manager launched
//  process %2 and process %3 connected instead.
//
//  Note that if this service is configured to start under a debugger, this behavior
//  is expected.
//
[
    EventId(0x80001B7F) : ToInstance,
    EventType(2) : ToInstance,
    InsertionStringTemplates {"%Service%", "%ExpectedPID%", "%ActualPID%"} : ToInstance
]
class MSFT_NetServiceDifferentPIDConnected : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 ExpectedPID;
    uint32 ActualPID;
};

//
// MessageId: EVENT_SERVICE_START_TYPE_CHANGED
//
// MessageText:
//
// The start type of the %1 service was changed from %2 to %3.
//
[
    EventId(0x40001B80) : ToInstance,
    EventType(4) : ToInstance,
    InsertionStringTemplates {"%Service%", "%OldStartType%", "%NewStartType%"} : ToInstance
]
class MSFT_NetServiceStartTypeChanged : MSFT_SCMEventLogEvent
{
    string Service;
    string OldStartType;
    string NewStartType;
    string sid;
};

//
// MessageId: EVENT_SERVICE_LOGON_TYPE_NOT_GRANTED
//
// MessageText:
//
//  The %1 service was unable to log on as %2 with the currently configured
//  password due to the following error: %n%3.  To ensure that the service is
//  configured properly, use the Services snap-in in Microsoft Management
//  Console (MMC).
//
[
    EventId(0xC0001B81) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Account%", "%%%%%Error%"} : ToInstance
]
class MSFT_NetServiceLogonTypeNotGranted : MSFT_SCMEventLogEvent
{
    string Service;
    string Account;
    uint32 Error;
};

//
// MessageId: EVENT_SERVICE_STOP_SUCCESS_WITH_REASON
//
// MessageText:
//
//  The %1 service was successfully sent a %2 control.%n%n
//  The reason specified was: %3 [%4]%n%n
//  Comment: %5
//
[
    EventId(0x40001B82) : ToInstance,
    EventType(4) : ToInstance,
    InsertionStringTemplates {"%Service%", "%Control%", "%Reason%", "%ReasonText%", "%Comment%"} : ToInstance
]
class MSFT_NetServiceStopControlSuccess : MSFT_SCMEventLogEvent
{
    string Service;
    string Control;
    string Reason;
    string ReasonText;
    string Comment;
    string sid;
};

//
// MessageId: EVENT_SERVICE_SHUTDOWN_FAILED
//
// MessageText:
//
// The %1 service did not shutdown properly on a preshutdown notification.
//
[
    EventId(0xC0001B83) : ToInstance,
    EventType(1) : ToInstance,
    InsertionStringTemplates {"%Service%"} : ToInstance
]
class MSFT_NetServiceShutdownFailed : MSFT_SCMEventLogEvent
{
    string Service;
};

//
// MessageId: EVENT_SERVICE_SLOW_STARTUP
//
// MessageText:
//
//  The following service is taking more than %2 minutes to start and may be hung: %1%n%n 
//  Contact your system administrator or service vendor for approximate startup times for this service.%n%n
//  If you think this service might be slowing system response or logon time, talk to your system administrator 
//  about whether the service should be disabled until the problem is identified.%n%nYou may have to restart the
//  computer in safe mode before you can disable the service.
//
[
    EventId(0x80001B84) : ToInstance,
    EventType(2) : ToInstance,
    InsertionStringTemplates {"%Service%", "%StartupTime%"} : ToInstance
]
class MSFT_NetServiceSlowStartup : MSFT_SCMEventLogEvent
{
    string Service;
    uint32 StartupTime;
};

/////////////////////////////////////////////////////////////////////////////
// SCM Event Provider registration.

#pragma DeleteInstance("MSFT_WMI_NonCOMEventProvider.Name=\"SCM Event Provider\"", NOFAIL)

instance of __Win32Provider as $P1
{
    Name = "SCM Event Provider";
    HostingModel = "Decoupled:NonCOM";
};

instance of __EventProviderRegistration
{
    Provider = $P1;

    EventQueryList = 
    {
        "select * from MSFT_SCMEvent"
    };
};

/////////////////////////////////////////////////////////////////////////////
// SCM Event Log consumer registration

//
// clean up any old subscriptions in root\cimv2 ( left by whistler beta1 )
//

#pragma deleteinstance("__FilterToConsumerBinding.Consumer=\"NTEventLogEventConsumer.Name=\\\"SCM Event Log Consumer\\\"\",Filter=\"__EventFilter.Name=\\\"SCM Event Log Filter\\\"\"", NOFAIL )
#pragma deleteinstance("__EventFilter.Name=\"SCM Event Log Filter\"", NOFAIL )
 
#pragma namespace ("\\\\.\\root\\subscription")

instance of NTEventLogEventConsumer
{
    Name = "SCM Event Log Consumer";
    SourceName = "Service Control Manager";
    EventType = 1;
    Category = 0;
    NameOfUserSIDProperty = "sid";
    CreatorSid = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
};

/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter

instance of __EventFilter
{
    Name = "SCM Event Log Filter";
    QueryLanguage = "WQL";
    Query = "select * from MSFT_SCMEventLogEvent";
    EventNamespace = "root\\cimv2";
    CreatorSid = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
};

/////////////////////////////////////////////////////////////////////////////
// SCM Event Log filter-to-consumer binding

instance of __FilterToConsumerBinding
{
    Consumer = "NTEventLogEventConsumer.Name=\"SCM Event Log Consumer\"";
    Filter = "__EventFilter.Name=\"SCM Event Log Filter\"";
    CreatorSid = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
};