Evidence to preserve
- 1
Record provider name and GUID - 2
Record event ID and version - 3
Preserve the channel and computer
How to use this reference safely
Start with the exact affected operation and collect the evidence above before selecting a repair branch. Change one relevant variable at a time, repeat the same operation, and preserve any changed result.
Official source: Microsoft Windows Event Log documentation
An event ID is not globally unique; preserve its provider, channel, timestamp, version, and payload.
An event ID is not globally unique; preserve its provider, channel, timestamp, version, and payload.