detection.wiki

Microsoft-Windows-Diagnostics-Networking

EventTitleChannelSampleRule
1000Network Diagnostics Framework started because the user requested a diagnostics …OperationalNN
2000Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
2100Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
2200Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
2300Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
2400Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
2500Network Diagnostics Framework stopped because it completed the user initiated …OperationalNN
3000An error occurred.OperationalNN
3100An error occurred.OperationalNN
4000This event is not emitted, it remains manifested for AppCompatSystemNN
4100The Network Diagnostics Framework has completed the diagnosis phase of …SystemNN
4200An error occurred.SystemNN
5000This event is not emitted, it remains manifested for AppCompatSystemNN
5100This event is not emitted, it remains manifested for AppCompatSystemNN
5200This event is not emitted, it remains manifested for AppCompatSystemNN
5300An error occurred.SystemNN
6000Details about HelperClassName diagnosis.OperationalNN
6100Details about HelperClassName diagnosis.SystemNN
6200Details about HelperClassName diagnosis.DebugNN
7000DebugMessage.DebugNN
7010DebugMessage.DebugNN
7020DebugMessage.DebugNN
7030DebugMessage.DebugNN
7040DebugMessage.DebugNN
7050DebugMessage.DebugNN
7100DebugMessage.DebugNN
8001Start NDF IncidentDebugNN
8002Stop NDF IncidentDebugNN
8003Start NDF DiagnoseDebugNN
8004Stop NDF DiagnoseDebugNN
8005Start NDF RepairDebugNN
8006Stop NDF RepairDebugNN
8007Start NDF ValidateDebugNN
8008Stop NDF ValidateDebugNN
8009Start NDF Reproduce FailureDebugNN
8010Stop NDF Reproduce FailureDebugNN
8103Start NDF Helper Class 'HelperClassName' Diagnose.DebugNN
8104Stop NDF Helper Class 'HelperClassName' Diagnose.DebugNN
8107Start NDF Helper Class 'HelperClassName' Validate.DebugNN
8108Stop NDF Helper Class 'HelperClassName' Validate.DebugNN

Event ID 1000: Network Diagnostics Framework started because the user requested a diagnostics session.

#
Channel
Operational
Task
Start
Opcode
Start

Message #

Network Diagnostics Framework started because the user requested a diagnostics session. 

Helper Class Name: %1 

Number of parameters: %2 

Attributes passed to helper class: 
%3

Fields #

NameDescription
HelperClassName UnicodeString
NumberOfAttributes UInt32
HelperClassAttributes UnicodeString

Event ID 2000: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Success, no problems found. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 2100: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Success, problems repaired. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 2200: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Failed during diagnosis. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 2300: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Failed during repair. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 2400: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Cancelled during diagnosis. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 2500: Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

#
Channel
Operational
Task
Stop
Opcode
Stop

Message #

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Cancelled during repair. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 3000: An error occurred.

#
Channel
Operational
Task
Fail
Opcode
ThefailureoccurredintheFrameworkcode.

Description

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [ResultHR].

Message #

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [%1].

Fields #

NameDescription
ResultHR UInt32

Event ID 3100: An error occurred.

#
Channel
Operational
Task
Fail
Opcode
ThefailureoccurredintheHelperclasscode.

Description

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [ResultHR].

Message #

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [%1].

Fields #

NameDescription
ResultHR UInt32

References #

Event ID 4000: This event is not emitted, it remains manifested for AppCompat

#
Channel
System
Task
DiagnosisSuccess

Fields #

NameDescription
RootCause UnicodeString
RootCauseGUID GUID
RepairOption UnicodeString
RepairGUID GUID
SecondsRequired UInt32
SIDTypeRequired UInt32
HelperClassName UnicodeString
InterfaceDesc UnicodeString
InterfaceGUID GUID

Event ID 4100: The Network Diagnostics Framework has completed the diagnosis phase of operation, but no network problem was identified.

#
Channel
System
Task
DiagnosisSuccess

Event ID 4200: An error occurred.

#
Channel
System
Task
DiagnosisFailure

Description

An error occurred. The Network Diagnostics Framework failed to complete the diagnosis phase of operation. A Windows Error Report was generated. [ResultHR].

Message #

An error occurred. The Network Diagnostics Framework failed to complete the diagnosis phase of operation. A Windows Error Report was generated. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 5000: This event is not emitted, it remains manifested for AppCompat

#
Channel
System
Task
ValidationSuccess

Fields #

NameDescription
RootCause UnicodeString
RootCauseGUID GUID
RepairOption UnicodeString
RepairGUID GUID
SecondsRequired UInt32
SIDTypeRequired UInt32
HelperClassName UnicodeString
InterfaceDesc UnicodeString
InterfaceGUID GUID

Event ID 5100: This event is not emitted, it remains manifested for AppCompat

#
Channel
System
Task
ValidationFailure

Fields #

NameDescription
RootCause UnicodeString
RootCauseGUID GUID
RepairOption UnicodeString
RepairGUID GUID
SecondsRequired UInt32
SIDTypeRequired UInt32
HelperClassName UnicodeString
InterfaceDesc UnicodeString
InterfaceGUID GUID

References #

Event ID 5200: This event is not emitted, it remains manifested for AppCompat

#
Channel
System
Task
RepairOptionFailure

Fields #

NameDescription
RootCause UnicodeString
RootCauseGUID GUID
RepairOption UnicodeString
RepairGUID GUID
SecondsRequired UInt32
SIDTypeRequired UInt32
HelperClassName UnicodeString
InterfaceDesc UnicodeString
InterfaceGUID GUID

Event ID 5300: An error occurred.

#
Channel
System
Task
RepairFailure

Description

An error occurred. The Network Diagnostics Framework failed to complete the repair phase of operation. A Windows Error Report was generated. [ResultHR].

Message #

An error occurred. The Network Diagnostics Framework failed to complete the repair phase of operation. A Windows Error Report was generated. [%1]

Fields #

NameDescription
ResultHR UInt32

Event ID 6000: Details about HelperClassName diagnosis.

#
Channel
Operational
Task
HelperClassInfo

Message #

Details about %1 diagnosis: 

%2

Fields #

NameDescription
HelperClassName UnicodeString
EventDescription UnicodeString
EventVerbosity UInt16

Event ID 6100: Details about HelperClassName diagnosis.

#
Channel
System
Task
HelperClassInfo

Message #

Details about %1 diagnosis: 

%2

Fields #

NameDescription
HelperClassName UnicodeString
EventDescription UnicodeString
EventVerbosity UInt16

Event ID 6200: Details about HelperClassName diagnosis.

#
Channel
Debug
Task
HelperClassInfo

Message #

Details about %1 diagnosis: 

%2

Fields #

NameDescription
HelperClassName UnicodeString
EventDescription UnicodeString
EventVerbosity UInt16

Event ID 7000: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7010: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7020: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7030: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7040: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7050: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 7100: DebugMessage.

#
Channel
Debug
Task
Debug

Message #

%1

Fields #

NameDescription
DebugMessage UnicodeString

Event ID 8001: Start NDF Incident

#
Channel
Debug
Task
Start
Opcode
Start

Event ID 8002: Stop NDF Incident

#
Channel
Debug
Task
Stop
Opcode
Stop

Event ID 8003: Start NDF Diagnose

#
Channel
Debug
Task
Start
Opcode
Start

Event ID 8004: Stop NDF Diagnose

#
Channel
Debug
Task
Stop
Opcode
Stop

References #

Event ID 8005: Start NDF Repair

#
Channel
Debug
Task
Start
Opcode
Start

Event ID 8006: Stop NDF Repair

#
Channel
Debug
Task
Stop
Opcode
Stop

Event ID 8007: Start NDF Validate

#
Channel
Debug
Task
Start
Opcode
Start

Event ID 8008: Stop NDF Validate

#
Channel
Debug
Task
Stop
Opcode
Stop

Event ID 8009: Start NDF Reproduce Failure

#
Channel
Debug
Task
Start
Opcode
Start

Event ID 8010: Stop NDF Reproduce Failure

#
Channel
Debug
Task
Stop
Opcode
Stop

Event ID 8103: Start NDF Helper Class 'HelperClassName' Diagnose.

#
Channel
Debug
Task
Start
Opcode
Start

Message #

Start NDF Helper Class '%1' Diagnose

Fields #

NameDescription
HelperClassName UnicodeString

Event ID 8104: Stop NDF Helper Class 'HelperClassName' Diagnose.

#
Channel
Debug
Task
Stop
Opcode
Stop

Message #

Stop NDF Helper Class '%1' Diagnose

Fields #

NameDescription
HelperClassName UnicodeString

Event ID 8107: Start NDF Helper Class 'HelperClassName' Validate.

#
Channel
Debug
Task
Start
Opcode
Start

Message #

Start NDF Helper Class '%1' Validate

Fields #

NameDescription
HelperClassName UnicodeString

Event ID 8108: Stop NDF Helper Class 'HelperClassName' Validate.

#
Channel
Debug
Task
Stop
Opcode
Stop

Message #

Stop NDF Helper Class '%1' Validate

Fields #

NameDescription
HelperClassName UnicodeString

Provenance

ETW provider GUID 36c23e18-0e66-11d9-bbeb-505054503030

Defined in netdiagfx.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB