Collect evidence for an escalation-only runtime event#

When to use this procedure#

Use when the Event ID page states that no safe self-service repair exists.

This procedure applies to EventReporter.

Use an account that can read the product configuration and Windows diagnostic state.
Replace angle-bracket placeholders with values from the affected system.

Do not delete queues, clear Event Logs, reset collection positions, disable TLS validation, or broaden permissions.
Preserve timestamps and pre-change state.

Configuration Client > the service, rule, or action named on the Event ID page.

Preserve the first event, neighboring events, exact reproduction sequence, and pre-change state.

Expected result: The affected object and its effective settings are identified.

If it fails: Return to the complete Event Log detail and configuration export before changing settings.
Run the native Windows checks below from the affected product host.
```
Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture
Get-CimInstance Win32_Service -Filter "Name='<SERVICE_NAME>'" | Format-List Name,State,StartName,ExitCode
```
Expected result: The support package identifies environment, service context, configuration, and the bounded failure interval.

If it fails: Do not repeatedly restart, clear logs, reset positions, broaden permissions, or alter queue files to obtain different evidence.
Perform one uniquely identifiable product test through the same service, rule, or action.

Expected result: The intended destination records the test exactly once.

If it fails: Collect the first new product event and bounded debug output; do not change unrelated settings.

Repeat the affected operation, confirm its positive output, and verify that queues, collection positions, or remote delivery continue normally.

The complete Event Log entry and neighboring product events with timestamps.
The command output, relevant configuration export, and bounded debug log from the same interval.