Microsoft-Windows-Host-Network-Management

Event	Title	Channel	Sample	Rule
1000	Event ID 1000	Operational	N	N
1000	A reboot is required to complete switch creation.	Microsoft-Windows-Host-Network-Service-Admin	N	N
1001	Event ID 1001	Operational	N	N
1001	Virtual Switch Extension could not be deleted, name='Parameter0', friendly …	Microsoft-Windows-Host-Network-Service-Admin	N	N
1002	Event ID 1002	Operational	N	N
1002	Internal miniport deleted, name = 'Parameter0', friendly name = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	N	N
1003	Event ID 1003	Operational	N	N
1003	Ethernet switch port disconnected (switch name = 'Parameter0', port name = …	Microsoft-Windows-Host-Network-Service-Admin	N	N
1004	Event ID 1004	Operational	N	N
1004	A reboot is required before the internal ethernet port 'Parameter0' will be …	Microsoft-Windows-Host-Network-Service-Admin	N	N
1005	Event ID 1005	Operational	N	N
1005	Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), …	Microsoft-Windows-Host-Network-Service-Admin	N	N

Event ID 1000

Channel: Operational

Description

A reboot is required to complete switch creation. The data path will not be active until reboot. name = 'Parameter0', friendly name = 'Parameter1'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1000: A reboot is required to complete switch creation.

Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

A reboot is required to complete switch creation. The data path will not be active until reboot. name = 'Parameter0', friendly name = 'Parameter1'.

Message #

A reboot is required to complete switch creation. The data path will not be active until reboot. name = '%1', friendly name = '%2'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1001

Channel: Operational

Description

Virtual Switch Extension could not be deleted, name='Parameter0', friendly name='Parameter1': ErrorMessage (ErrorCode).

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` UnicodeString
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1001: Virtual Switch Extension could not be deleted, name='Parameter0', friendly name='Parameter1': ErrorMessage (ErrorCode).

Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

Virtual Switch Extension could not be deleted, name='%3', friendly name='%4': %1 (%2).

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` UnicodeString
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1002

Channel: Operational

Description

Internal miniport deleted, name = 'Parameter0', friendly name = 'Parameter1'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1002: Internal miniport deleted, name = 'Parameter0', friendly name = 'Parameter1'.

Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

Internal miniport deleted, name = '%1', friendly name = '%2'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1003

Channel: Operational

Description

Ethernet switch port disconnected (switch name = 'Parameter0', port name = 'Parameter1').

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1003: Ethernet switch port disconnected (switch name = 'Parameter0', port name = 'Parameter1').

Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

Ethernet switch port disconnected (switch name = '%1', port name = '%2').

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1004

Channel: Operational

Description

A reboot is required before the internal ethernet port 'Parameter0' will be usable.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1004: A reboot is required before the internal ethernet port 'Parameter0' will be usable.

Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

A reboot is required before the internal ethernet port '%1' will be usable.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` UnicodeString

Event ID 1005

Channel: Operational

Description

Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), result='Result'.

Fields #

Name	Description
`Action` UnicodeString
`Name` UnicodeString
`Detail` UnicodeString
`Result` HexInt32

Event ID 1005: Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), result='Result'.

Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

Action taken to remove orphaned component: '%1' '%2' ('%3'), result='%4'

Fields #

Name	Description
`Action` UnicodeString
`Name` UnicodeString
`Detail` UnicodeString
`Result` HexInt32

Provenance

ETW provider GUID 93f693dc-9163-4dee-af64-d855218af242

Defined in NetMgmtIF.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB