detection.wiki

Microsoft-Windows-Bluetooth-BthLEPrepairing

EventTitleChannelSampleRule
100Device successfully prepaired (DeviceID).OperationalNN

Event ID 100: Device successfully prepaired (DeviceID).

#
Channel
Operational
Task
BthLEPrepairing

Message #

Device successfully prepaired (%1)

Fields #

NameDescription
DeviceID Binary

Provenance

ETW provider GUID 4af188ac-e9c4-4c11-b07b-1fabc07dfeb2

Defined in bthserv.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3037, captured 2026-06-02 — Manifest XML pack, 2.0 MB