Microsoft-Windows-Host-Network-Service

107 events across 3 channels

Event	Title	Channel	Sample
1000	HNS failed to create vmswitch with error 'Parameter0' and adapter id = …	Microsoft-Windows-Host-Network-Service-Admin	Y
1000	Event ID 1000	Operational	Y
1001	HNS failed to delete vmswitch with error = 'Parameter0', id = 'Parameter1' and …	Microsoft-Windows-Host-Network-Service-Admin	N
1001	Event ID 1001	Operational	N
1002	HNS failed to create intenal nic with error = 'Parameter0', id = 'Parameter1' …	Microsoft-Windows-Host-Network-Service-Admin	N
1002	Event ID 1002	Operational	N
1003	HNS failed to delete internal nic with error = 'HResult' and id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	N
1003	Event ID 1003	Operational	N
1004	HNS failed to create vmswitch port with error 'HResult', switch id = 'SwitchId', …	Microsoft-Windows-Host-Network-Service-Admin	N
1004	Event ID 1004	Operational	N
1005	HNS failed to delete vmswitch port with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1005	Event ID 1005	Operational	N
1006	HNS failed to connect vmswitch port with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1006	Event ID 1006	Operational	N
1007	HNS failed to disconnect vmswitch port with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1007	Event ID 1007	Operational	N
1008	HNS failed to bind external adapter to vswitch with error 'HResult' and adapter …	Microsoft-Windows-Host-Network-Service-Admin	N
1008	Event ID 1008	Operational	N
1009	HNS failed to unbind external adapter to vswitch with error 'HResult' and …	Microsoft-Windows-Host-Network-Service-Admin	N
1009	Event ID 1009	Operational	N
1010	HNS failed to set vmswitch extension with error 'HResult' on switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1010	Event ID 1010	Operational	N
1011	HNS failed to set vmswitch port profile with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1011	Event ID 1011	Operational	N
1012	HNS failed to set vmswitch port isolation with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1012	Event ID 1012	Operational	N
1013	Parameter0 :- Network id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1013	Event ID 1013	Operational	Y
1014	Parameter0 :- Network id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1014	Event ID 1014	Operational	Y
1015	Parameter0 :- Endpoint id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	N
1015	Event ID 1015	Operational	N
1016	Parameter0':- Endpoint id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1016	Event ID 1016	Operational	N
1017	HNS failed to configure hostagent traffic managment on vmswitch port with error …	Microsoft-Windows-Host-Network-Service-Admin	N
1017	Event ID 1017	Operational	N
1018	HNS failed to reset hostagent traffic management on vmswitch port with error …	Microsoft-Windows-Host-Network-Service-Admin	N
1018	Event ID 1018	Operational	N
1019	HNS failed to configure hostagent traffic managment on switch with error …	Microsoft-Windows-Host-Network-Service-Admin	N
1019	Event ID 1019	Operational	N
1020	HNS failed to add firewall rules for new container with error 'Parameter0' and …	Microsoft-Windows-Host-Network-Service-Admin	N
1020	Event ID 1020	Operational	N
1021	HNS failed to create winnat instance with error 'Parameter0', external ip prefix …	Microsoft-Windows-Host-Network-Service-Admin	N
1021	Event ID 1021	Operational	N
1022	HNS failed to delete winnat instance with error 'Parameter0', class name …	Microsoft-Windows-Host-Network-Service-Admin	N
1022	Event ID 1022	Operational	N
1023	HNS failed to set interface configuration with error 'Parameter0'.	Microsoft-Windows-Host-Network-Service-Admin	N
1023	Event ID 1023	Operational	N
1024	HNS failed to configure ipv4 address with error 'Parameter0'.	Microsoft-Windows-Host-Network-Service-Admin	N
1024	Event ID 1024	Operational	N
1025	HNS failed to configure default route with error 'Parameter0'.	Microsoft-Windows-Host-Network-Service-Admin	N
1025	Event ID 1025	Operational	N
1026	HNS failed to allocate nat port with error 'HResult'.	Microsoft-Windows-Host-Network-Service-Admin	N
1026	Event ID 1026	Operational	N
1027	HNS failed to restore all configuration from its data file with error HResult.	Microsoft-Windows-Host-Network-Service-Admin	N
1027	Event ID 1027	Operational	N
1028	HNS failed to set ethernet adapter MAC address with error = 'Parameter0', …	Microsoft-Windows-Host-Network-Service-Admin	N
1028	Event ID 1028	Operational	N
1030	'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1030	Event ID 1030	Operational	Y
1031	HNS failed to add encryption rules for new container with error 'Parameter0' and …	Microsoft-Windows-Host-Network-Service-Admin	N
1031	Event ID 1031	Operational	N
1032	'.	Microsoft-Windows-Host-Network-Service-Admin	N
1032	Event ID 1032	Operational	N
1033	HNS failed to get vmswitch info with error = 'HResult', switchid = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	N
1033	Event ID 1033	Operational	N
1034	HNS failed to enumerate vmswitch ports with error = 'HResult', switchid = …	Microsoft-Windows-Host-Network-Service-Admin	N
1034	Event ID 1034	Operational	N
1035	HNS failed to get port handle count with error = 'HResult', portname = …	Microsoft-Windows-Host-Network-Service-Admin	N
1035	Event ID 1035	Operational	N
1036	Mirrored Networking was requested.	Operational	N
1037	HNS failed to update vmswitch port isolation with error 'Parameter0', switch id …	Microsoft-Windows-Host-Network-Service-Admin	N
1037	Event ID 1037	Operational	N
1038	HNS failed to set vmswitch MAC spoofing with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1038	Event ID 1038	Operational	N
1039	HNS failed to delete vmswitch port property with error 'Parameter0', switch id = …	Microsoft-Windows-Host-Network-Service-Admin	N
1039	Event ID 1039	Operational	N
1040	Modified guest 'ResourceType' settings.	Operational	N
1041	Modified guest 'ResourceType' settings.	Operational	N
1042	Modified guest 'ResourceType' settings.	Operational	N
1043	Modified guest 'ResourceType' settings.	Operational	N
1044	Modified guest 'ResourceType' settings.	Operational	N
1045	Modified guest 'ResourceType' settings.	Operational	N
1046	Modified guest 'ResourceType' settings.	Operational	N
1047	Modified guest 'ResourceType' settings.	Operational	N
1048	Modified guest 'ResourceType' settings.	Operational	N
1049	Modified guest 'ResourceType' settings.	Operational	N
1050	Modified guest 'ResourceType' settings.	Operational	N
1051	Failed to modify guest 'ResourceType' settings with error 'Result'.	Operational	N
1052	Parameter0 :- GuestNetworkService id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	N
1052	Event ID 1052	Operational	N
1053	Parameter0 :- GuestNetworkService id = 'Parameter1'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1053	Event ID 1053	Operational	N
1054	Guest Network Service state changed.	Operational	Y
1055	RPC request received.	Operational	Y
1056	EventString :- Endpoint id = 'EndpointId'.	Microsoft-Windows-Host-Network-Service-Admin	N
1056	Event ID 1056	Operational	N
1057	EventString :- Endpoint id = 'EndpointId'.	Microsoft-Windows-Host-Network-Service-Admin	Y
1057	Event ID 1057	Operational	N
1058	HNS failed to configure IOV offload on vmswitch port with error 'Parameter0', …	Microsoft-Windows-Host-Network-Service-Admin	N
1058	Event ID 1058	Operational	N
1060	Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), …	Microsoft-Windows-Host-Network-Service-Admin	N
1060	Event ID 1060	Operational	N
1062	HNS failed to start a service or load a kernel driver.	Microsoft-Windows-Host-Network-Service-Admin	N
1062	Event ID 1062	Operational	N
entity	Entity	ETW Trace	Y
on-rundown	OnRundown	ETW Trace	Y

Event ID 1000: HNS failed to create vmswitch with error 'Parameter0' and adapter id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Error

Description

HNS failed to create vmswitch with error 'Parameter0' and adapter id = 'Parameter1'.

Message #

HNS failed to create vmswitch with error '%1' and adapter id = '%2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1000,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-14T01:40:09.308665+00:00",
    "event_record_id": 34,
    "correlation": {},
    "execution": {
      "process_id": 2476,
      "thread_id": 2776
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "0x800700b7",
    "Parameter1": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "Parameter2": "Default Switch"
  },
  "message": ""
}

Event ID 1000

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: 2

Description

HNS failed to create vmswitch with error 'Parameter0' and adapter id = 'Parameter1'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "{0C885E0D-6EB6-476C-A048-2457EED3A5C1}",
    "event_source_name": "",
    "event_id": 1000,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-17T20:05:36.0464973+00:00",
    "event_record_id": 261,
    "correlation": {
      "ActivityID": "{3C2340FB-4ED1-45DC-A89D-6438EE3C2BE7}"
    },
    "execution": {
      "process_id": 3180,
      "thread_id": 5852
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "0x800700b7",
    "Parameter1": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "Parameter2": "Default Switch"
  },
  "message": "HNS failed to create vmswitch with error '0x800700B7' and adapter id = 'C08CB7B8-9B3C-408E-8E30-5E16A3AEB444'."
}

Event ID 1001: HNS failed to delete vmswitch with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to delete vmswitch with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Message #

HNS failed to delete vmswitch with error = '%1', id = '%2' and friendly name = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1001

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to delete vmswitch with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1002: HNS failed to create intenal nic with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to create intenal nic with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Message #

HNS failed to create intenal nic with error = '%1', id = '%2' and friendly name = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1002

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to create intenal nic with error = 'Parameter0', id = 'Parameter1' and friendly name = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1003: HNS failed to delete internal nic with error = 'HResult' and id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to delete internal nic with error = 'HResult' and id = 'Parameter1'.

Message #

HNS failed to delete internal nic with error = '%1' and id = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1003

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to delete internal nic with error = 'HResult' and id = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1004: HNS failed to create vmswitch port with error 'HResult', switch id = 'SwitchId', port id = 'PortId' and type = 'PortType'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to create vmswitch port with error 'HResult', switch id = 'SwitchId', port id = 'PortId' and type = 'PortType'.

Message #

HNS failed to create vmswitch port with error '%1', switch id = '%2', port id = '%3' and type = '%4'.

Fields #

Name	Description
`HResult` HexInt32
`SwitchId` GUID
`PortId` GUID
`PortType` UInt32

Event ID 1004

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to create vmswitch port with error 'HResult', switch id = 'SwitchId', port id = 'PortId' and type = 'PortType'.

Fields #

Name	Description
`HResult` HexInt32
`SwitchId` GUID
`PortId` GUID
`PortType` UInt32

Event ID 1005: HNS failed to delete vmswitch port with error 'Parameter0', switch id = 'Parameter1' and port id = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to delete vmswitch port with error 'Parameter0', switch id = 'Parameter1' and port id = 'Parameter2'.

Message #

HNS failed to delete vmswitch port with error '%1', switch id = '%2' and port id = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1005

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to delete vmswitch port with error 'Parameter0', switch id = 'Parameter1' and port id = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1006: HNS failed to connect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to connect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Message #

HNS failed to connect vmswitch port with error '%1', switch id = '%2', port id = '%3' and nic name = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1006

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to connect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1007: HNS failed to disconnect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to disconnect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Message #

HNS failed to disconnect vmswitch port with error '%1', switch id = '%2', port id = '%3' and nic name = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1007

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to disconnect vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and nic name = 'Parameter4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1008: HNS failed to bind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to bind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Message #

HNS failed to bind external adapter to vswitch with error '%1' and adapter id = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1008

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to bind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1009: HNS failed to unbind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to unbind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Message #

HNS failed to unbind external adapter to vswitch with error '%1' and adapter id = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1009

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to unbind external adapter to vswitch with error 'HResult' and adapter id = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1010: HNS failed to set vmswitch extension with error 'HResult' on switch id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set vmswitch extension with error 'HResult' on switch id = 'Parameter1'.

Message #

HNS failed to set vmswitch extension with error '%1' on switch id = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1010

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set vmswitch extension with error 'HResult' on switch id = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1011: HNS failed to set vmswitch port profile with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and profile id = 'Parameter4'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set vmswitch port profile with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and profile id = 'Parameter4'.

Message #

HNS failed to set vmswitch port profile with error '%1', switch id = '%2', port id = '%3' and profile id = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1011

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set vmswitch port profile with error 'Parameter0', switch id = 'Parameter1', port id = 'Paramete3' and profile id = 'Parameter4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1012: HNS failed to set vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Message #

HNS failed to set vmswitch port isolation with error '%1', switch id = '%2', port id = '%3' and isolation id = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1012

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1013: Parameter0 :- Network id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Error

Message #

%1 :- 
 Network id = '%2'.
 Network type = '%3'.
  Result code = '%4'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` UInt32
`Parameter3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1013,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:13:59.744236+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 2364,
      "thread_id": 10356
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "HNS-Layer-Create",
    "Parameter1": "632711BF-FE3A-4CDE-94A3-B7D4B24574A6",
    "Parameter2": 6,
    "Parameter3": "0x80070057"
  },
  "message": ""
}

Event ID 1013

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: 2

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` UInt32
`Parameter3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "{0C885E0D-6EB6-476C-A048-2457EED3A5C1}",
    "event_source_name": "",
    "event_id": 1013,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-17T20:05:36.0478828+00:00",
    "event_record_id": 263,
    "correlation": {
      "ActivityID": "{3C2340FB-4ED1-45DC-A89D-6438EE3C2BE7}"
    },
    "execution": {
      "process_id": 3180,
      "thread_id": 5852
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "HNS-Network-Create",
    "Parameter1": "{c08cb7b8-9b3c-408e-8e30-5e16a3aeb444}",
    "Parameter2": "7",
    "Parameter3": "0x800700b7"
  },
  "message": "HNS-Network-Create :- \r\n Network id = '{c08cb7b8-9b3c-408e-8e30-5e16a3aeb444}'.\r\n Network type = 'ICS'.\r\n  Result code = '0x800700B7'. "
}

Event ID 1014: Parameter0 :- Network id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Informational

Message #

%1 :- 
 Network id = '%2'.
 Network type = '%3'.
  Result code = '%4'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` UInt32
`Parameter3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1014,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:02.402467+00:00",
    "event_record_id": 3,
    "correlation": {
      "ActivityID": "B3C94439-5656-4D26-8052-20033A5181C5"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "HNS-Network-Create",
    "Parameter1": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "Parameter2": 7,
    "Parameter3": "0x0"
  },
  "message": ""
}

Event ID 1014

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: 4

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` UInt32
`Parameter3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "event_id": 1014,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:25.0243826+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Host-Network-Service-Admin"
  },
  "event_data": {
    "Parameter0": "HNS-Network-Create",
    "Parameter2": "7",
    "Parameter1": "{c08cb7b8-9b3c-408e-8e30-5e16a3aeb444}",
    "Parameter3": "0x0"
  }
}

Event ID 1015: Parameter0 :- Endpoint id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

%1 :- 
 Endpoint id = '%2'.
  Network id = '%3'.
  Network type = '%4'.
  Result code = '%5'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` GUID
`Parameter3` UInt32
`Parameter4` HexInt32

Event ID 1015

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` GUID
`Parameter3` UInt32
`Parameter4` HexInt32

Event ID 1016: Parameter0':- Endpoint id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Informational

Message #

%1':- 
 Endpoint id = '%2'.
  Network id = '%3'.
  Network type = '%4'.
  Result code = '%5'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` GUID
`Parameter3` UInt32
`Parameter4` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1016,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:02.417112+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "95388E16-C0CB-4191-9FDE-E7B11BC8D046"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "HNS-Endpoint-Attach",
    "Parameter1": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "Parameter2": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "Parameter3": 7,
    "Parameter4": "0x0"
  },
  "message": ""
}

Event ID 1016

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` GUID
`Parameter3` UInt32
`Parameter4` HexInt32

Event ID 1017: HNS failed to configure hostagent traffic managment on vmswitch port with error 'Parameter0', port profile id = 'Paramete1', ip address = 'Paramete2' and isolation id = ...

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to configure hostagent traffic managment on vmswitch port with error 'Parameter0', port profile id = 'Paramete1', ip address = 'Paramete2' and isolation id = 'Parameter3'.

Message #

HNS failed to configure hostagent traffic managment on vmswitch port with error '%1', port profile id = '%2', ip address = '%3' and isolation id = '%4'

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1017

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to configure hostagent traffic managment on vmswitch port with error 'Parameter0', port profile id = 'Paramete1', ip address = 'Paramete2' and isolation id = 'Parameter3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1018: HNS failed to reset hostagent traffic management on vmswitch port with error 'HResult' and port profile id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to reset hostagent traffic management on vmswitch port with error 'HResult' and port profile id = 'Parameter1'.

Message #

HNS failed to reset hostagent traffic management on vmswitch port with error '%1' and port profile id = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1018

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to reset hostagent traffic management on vmswitch port with error 'HResult' and port profile id = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1019: HNS failed to configure hostagent traffic managment on switch with error 'Parameter0', switch id = 'Parameter1', managment ip address = 'Parameter2' and forward all traffi...

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to configure hostagent traffic managment on switch with error 'Parameter0', switch id = 'Parameter1', managment ip address = 'Parameter2' and forward all traffic to external network = 'Parameter3'.

Message #

HNS failed to configure hostagent traffic managment on switch with error '%1', switch id = '%2', managment ip address = '%3' and forward all traffic to external network = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString
`Parameter3` Boolean

Event ID 1019

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString
`Parameter3` Boolean

Event ID 1020: HNS failed to add firewall rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to add firewall rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Message #

HNS failed to add firewall rules for new container with error '%1' and unique error string "'%2'"

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32

Event ID 1020

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to add firewall rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32

Event ID 1021: HNS failed to create winnat instance with error 'Parameter0', external ip prefix = 'Parameter1', internal ip prefix = 'Paramete3' and nat name = 'Parameter4'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to create winnat instance with error 'Parameter0', external ip prefix = 'Parameter1', internal ip prefix = 'Paramete3' and nat name = 'Parameter4'.

Message #

HNS failed to create winnat instance with error '%1', external ip prefix = '%2', internal ip prefix = '%3' and nat name = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1021

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to create winnat instance with error 'Parameter0', external ip prefix = 'Parameter1', internal ip prefix = 'Paramete3' and nat name = 'Parameter4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Paramete3` UnicodeString
`Parameter4` UnicodeString

Event ID 1022: HNS failed to delete winnat instance with error 'Parameter0', class name 'Parameter1' and instance id = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to delete winnat instance with error 'Parameter0', class name 'Parameter1' and instance id = 'Parameter2'.

Message #

HNS failed to delete winnat instance with error '%1', class name '%2' and instance id = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1022

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to delete winnat instance with error 'Parameter0', class name 'Parameter1' and instance id = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1023: HNS failed to set interface configuration with error 'Parameter0'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set interface configuration with error 'Parameter0'.

Message #

HNS failed to set interface configuration with error '%1'.
NetCfgInstanceId = '%2'.
HostDnsServerList = '%3'.
HostDnsSuffix = '%4'.
EnableLLMNR = '%5'.
Unique error string = '%6'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString
`Parameter3` UnicodeString
`Parameter4` Boolean
`Parameter5` UInt32

Event ID 1023

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set interface configuration with error 'Parameter0'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString
`Parameter3` UnicodeString
`Parameter4` Boolean
`Parameter5` UInt32

Event ID 1024: HNS failed to configure ipv4 address with error 'Parameter0'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to configure ipv4 address with error 'Parameter0'.

Message #

HNS failed to configure ipv4 address with error '%1'.
Adapter index = '%2'.
Compartment id = '%3'.
Prefix length = '%4'.
IPv4 address = '%5'. 
Persistent = '%6'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32
`Parameter2` UInt32
`Parameter3` UInt32
`Parameter4` UnicodeString
`Parameter5` Boolean

Event ID 1024

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to configure ipv4 address with error 'Parameter0'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32
`Parameter2` UInt32
`Parameter3` UInt32
`Parameter4` UnicodeString
`Parameter5` Boolean

Event ID 1025: HNS failed to configure default route with error 'Parameter0'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to configure default route with error 'Parameter0'.

Message #

HNS failed to configure default route with error '%1'.
Adapter index = '%2'.
Compartment id = '%3'.
Gateway ip address = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32
`Parameter2` UInt32
`Parameter3` UnicodeString

Event ID 1025

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to configure default route with error 'Parameter0'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32
`Parameter2` UInt32
`Parameter3` UnicodeString

Event ID 1026: HNS failed to allocate nat port with error 'HResult'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to allocate nat port with error 'HResult'.

Message #

HNS failed to allocate nat port with error '%1'.
Port Number= '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter0` UInt32

Event ID 1026

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to allocate nat port with error 'HResult'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter0` UInt32

Event ID 1027: HNS failed to restore all configuration from its data file with error HResult.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to restore all configuration from its data file with error HResult.

Message #

HNS failed to restore all configuration from its data file with error %1

Fields #

Name	Description
`HResult` HexInt32

Event ID 1027

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to restore all configuration from its data file with error.

Fields #

Name	Description
`HResult` HexInt32

Event ID 1028: HNS failed to set ethernet adapter MAC address with error = 'Parameter0', adapter guid = 'Parameter1' and MAC address = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set ethernet adapter MAC address with error = 'Parameter0', adapter guid = 'Parameter1' and MAC address = 'Parameter2'.

Message #

HNS failed to set ethernet adapter MAC address with error = '%1', adapter guid = '%2' and MAC address = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1028

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set ethernet adapter MAC address with error = 'Parameter0', adapter guid = 'Parameter1' and MAC address = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1030: '.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Error

Message #

'%2' : '%1'.

Fields #

Name	Description
`HResult` HexInt32
`API` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:02.350163+00:00",
    "event_record_id": 2,
    "correlation": {
      "ActivityID": "B3C94439-5656-4D26-8052-20033A5181C5"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HResult": "0x80070032",
    "API": 1
  },
  "message": ""
}

Event ID 1030

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: 2

Fields #

Name	Description
`HResult` HexInt32
`API` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "event_id": 1030,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.5797600+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-Host-Network-Service-Admin"
  },
  "event_data": {
    "API": "1",
    "HResult": "0x80070032"
  }
}

Event ID 1031: HNS failed to add encryption rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to add encryption rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Message #

HNS failed to add encryption rules for new container with error '%1' and unique error string "'%2'"

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32

Event ID 1031

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to add encryption rules for new container with error 'Parameter0' and unique error string "'Parameter1'".

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UInt32

Event ID 1032: '.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

'%2' : '%1'.

Fields #

Name	Description
`HResult` HexInt32
`API` UInt32

Event ID 1032

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`HResult` HexInt32
`API` UInt32

Event ID 1033: HNS failed to get vmswitch info with error = 'HResult', switchid = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to get vmswitch info with error = 'HResult', switchid = 'Parameter1'.

Message #

HNS failed to get vmswitch info with error = '%1', switchid = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1033

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to get vmswitch info with error = 'HResult', switchid = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1034: HNS failed to enumerate vmswitch ports with error = 'HResult', switchid = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to enumerate vmswitch ports with error = 'HResult', switchid = 'Parameter1'.

Message #

HNS failed to enumerate vmswitch ports with error = '%1', switchid = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1034

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to enumerate vmswitch ports with error = 'HResult', switchid = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1035: HNS failed to get port handle count with error = 'HResult', portname = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to get port handle count with error = 'HResult', portname = 'Parameter1'.

Message #

HNS failed to get port handle count with error = '%1', portname = '%2'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1035

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to get port handle count with error = 'HResult', portname = 'Parameter1'.

Fields #

Name	Description
`HResult` HexInt32
`Parameter1` UnicodeString

Event ID 1036: Mirrored Networking was requested.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Mirrored Networking was requested.

Message #

Mirrored Networking was requested.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter2` UInt32
`Parameter3` HexInt32

Event ID 1037: HNS failed to update vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to update vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Message #

HNS failed to update vmswitch port isolation with error '%1', switch id = '%2', port id = '%3' and isolation id = '%4'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1037

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to update vmswitch port isolation with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2' and isolation id = 'Parameter3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1038: HNS failed to set vmswitch MAC spoofing with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to set vmswitch MAC spoofing with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Message #

HNS failed to set vmswitch MAC spoofing with error '%1', switch id = '%2', port id = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1038

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to set vmswitch MAC spoofing with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1039: HNS failed to delete vmswitch port property with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to delete vmswitch port property with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Message #

HNS failed to delete vmswitch port property with error '%1', switch id = '%2', port id = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1039

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to delete vmswitch port property with error 'Parameter0', switch id = 'Paramete1', port id = 'Paramete2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Paramete1` UnicodeString
`Paramete2` UnicodeString
`Parameter3` UInt64

Event ID 1040: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1041: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1042: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1043: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1044: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1045: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1046: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1047: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1048: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1049: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1050: Modified guest 'ResourceType' settings.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Modified guest 'ResourceType' settings. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Modified guest '%4' settings. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1051: Failed to modify guest 'ResourceType' settings with error 'Result'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Failed to modify guest 'ResourceType' settings with error 'Result'. Entity: 'EntityType', Id: 'EntityId', Operation: 'OperationType', Settings: 'Settings'.

Message #

Failed to modify guest '%4' settings with error '%6'. Entity: '%1', Id: '%2', Operation: '%3', Settings: '%5'

Fields #

Name	Description
`EntityType` UInt32
`EntityId` GUID
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`ResourceType` UInt32
`Settings` UnicodeString
`Result` HexInt32

Event ID 1052: Parameter0 :- GuestNetworkService id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

%1 :- 
 GuestNetworkService id = '%2'.
 Result code = '%3'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter3` HexInt32

Event ID 1052

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter3` HexInt32

Event ID 1053: Parameter0 :- GuestNetworkService id = 'Parameter1'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Informational

Message #

%1 :- 
 GuestNetworkService id = '%2'.
 Result code = '%3'.

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1053,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:02.416617+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "95388E16-C0CB-4191-9FDE-E7B11BC8D046"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Parameter0": "HNS-GuestNetworkService-Create",
    "Parameter1": "29A7892D-8743-4A3F-85E3-06FE9D7977B4",
    "Parameter3": "0x0"
  },
  "message": ""
}

Event ID 1053

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`Parameter0` UnicodeString
`Parameter1` GUID
`Parameter3` HexInt32

Event ID 1054: Guest Network Service state changed.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: Informational

Description

Guest Network Service state changed. Id: 'GnsId', State: 'GnsState'.

Message #

Guest Network Service state changed. Id: '%1', State: '%2'

Fields #

Name	Description
`GnsId` GUID
`GnsState` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1054,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-11T06:32:02.416768+00:00",
    "event_record_id": 7,
    "correlation": {
      "ActivityID": "95388E16-C0CB-4191-9FDE-E7B11BC8D046"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "GnsId": "29A7892D-8743-4A3F-85E3-06FE9D7977B4",
    "GnsState": 3
  },
  "message": ""
}

Event ID 1055: RPC request received.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational
Level: Informational

Description

RPC request received. Type: 'Data_0', Entity: 'Request', Id: 'Entity', Access Level: 'RpcAccessLevel', Data: 'Id'.

Message #

RPC request received. Type: '%1', Entity: '%2', Id: '%3', Access Level: '%5', Data: '%4'

Fields #

Name	Description
`Request` UnicodeString
`Entity` UnicodeString
`Id` GUID
`Data` UnicodeString
`RpcAccessLevel` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1055,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-11T06:32:02.422796+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "76236D51-D0B4-40EE-96C0-426CDBEB2766"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 10060
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data_0": "{\"ID\":\"ad2366c4-0be2-4636-8124-f3bddfd27e15\",\"Name\":\"Ethernet\",\"Version\":64424509440,\"Health\":{\"Extra\":{\"Resources\":{\"AdditionalParams\":{},\"AllocationOrder\":1,\"Allocators\":[{\"AdditionalParams\":{},\"AllocationOrder\":0,\"Connected\":false,\"EndpointId\":\"AD2366C4-0BE2-4636-8124-F3BDDFD27E15\",\"EndpointPortGuid\":\"AD2366C4-0BE2-4636-8124-F3BDDFD27E15\",\"Flags\":0,\"Health\":{\"LastErrorCode\":0,\"LastUpdateTime\":134176843224049781},\"ID\":\"14C2D8AC-D409-41E0-873B-AA38FB908377\",\"IsPolicy\":false,\"IsolationId\":0,\"MacAddress\":\"00-15-5D-CF-7E-0C\",\"ManagementPort\":false,\"NetworkId\":\"B95D0C5E-57D4-412B-B571-18A81A16E005\",\"NicId\":\"29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15\",\"PortFriendlyNamePrefix\":\"Endpoint Port\",\"PreferredPortFriendlyName\":\"AD2366C4-0BE2-4636-8124-F3BDDFD27E15\",\"State\":3,\"SwitchId\":\"B95D0C5E-57D4-412B-B571-18A81A16E005\",\"Tag\":\"VM Port\",\"VmPort\":true,\"nonPersistentPort\":true}],\"CompartmentOperationTime\":0,\"Flags\":0,\"Health\":{\"LastErrorCode\":0,\"LastUpdateTime\":134176843223894715},\"ID\":\"958DB0CF-E213-4033-99A7-14D3ED54D19C\",\"PortOperationTime\":0,\"State\":1,\"SwitchOperationTime\":0,\"VfpOperationTime\":0,\"parentId\":\"05D7D175-0BA4-482B-A21D-3968B8A854EC\"},\"SharedContainers\":[],\"VirtualMachine\":\"29a7892d-8743-4a3f-85e3-06fe9d7977b4\"}},\"SchemaVersion\":{\"Major\":2,\"Minor\":0},\"HostComputeNetwork\":\"b95d0c5e-57d4-412b-b571-18a81a16e005\",\"IpConfigurations\":[{\"IpAddress\":\"172.18.253.78\",\"PrefixLength\":20,\"IpSubnetId\":\"ad36f57c-b3cd-40da-bbd8-3fb22e0dbc19\"}],\"Dns\":{\"ServerList\":[\"172.18.240.1\"]},\"Routes\":[{\"NextHop\":\"172.18.240.1\",\"DestinationPrefix\":\"0.0.0.0/0\"}],\"MacAddress\":\"00-15-5D-CF-7E-0C\"}",
    "Request": "Query",
    "Entity": "Endpoint",
    "Id": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "RpcAccessLevel": 1
  },
  "message": ""
}

Event ID 1056: EventString :- Endpoint id = 'EndpointId'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Message #

%1 :- 
 Endpoint id = '%2'.
  Network id = '%3'.
  Policy type = '%4'.
  Result code = '%5'.

Fields #

Name	Description
`EventString` UnicodeString
`EndpointId` GUID
`NetworkId` GUID
`PolicyType` UInt32
`Result` HexInt32

Event ID 1056

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`EventString` UnicodeString
`EndpointId` GUID
`NetworkId` GUID
`PolicyType` UInt32
`Result` HexInt32

Event ID 1057: EventString :- Endpoint id = 'EndpointId'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin
Level: Informational

Message #

%1 :- 
 Endpoint id = '%2'.
  Network id = '%3'.
  Policy type = '%4'.
  Result code = '%5'.

Fields #

Name	Description
`EventString` UnicodeString
`EndpointId` GUID
`NetworkId` GUID
`PolicyType` UInt32
`Result` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "0C885E0D-6EB6-476C-A048-2457EED3A5C1",
    "event_source_name": "",
    "event_id": 1057,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T06:32:02.482204+00:00",
    "event_record_id": 7,
    "correlation": {
      "ActivityID": "95388E16-C0CB-4191-9FDE-E7B11BC8D046"
    },
    "execution": {
      "process_id": 2820,
      "thread_id": 10064
    },
    "channel": "Microsoft-Windows-Host-Network-Service-Admin",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "EventString": "HNS-Policy-Apply",
    "EndpointId": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NetworkId": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "PolicyType": 3,
    "Result": "0x0"
  },
  "message": ""
}

Event ID 1057

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Fields #

Name	Description
`EventString` UnicodeString
`EndpointId` GUID
`NetworkId` GUID
`PolicyType` UInt32
`Result` HexInt32

Event ID 1058: HNS failed to configure IOV offload on vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Parameter2'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to configure IOV offload on vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Parameter2'.

Message #

HNS failed to configure IOV offload on vmswitch port with error '%1', switch id = '%2', port id = '%3'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1058

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to configure IOV offload on vmswitch port with error 'Parameter0', switch id = 'Parameter1', port id = 'Parameter2'.

Fields #

Name	Description
`Parameter0` HexInt32
`Parameter1` UnicodeString
`Parameter2` UnicodeString

Event ID 1060: Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), result='Result'.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), result='Result'.

Message #

Action taken to remove orphaned component: '%1' '%2' ('%3'), result='%4'

Fields #

Name	Description
`Action` UnicodeString
`Name` UnicodeString
`Detail` UnicodeString
`Result` HexInt32

Event ID 1060

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

Action taken to remove orphaned component: 'Action' 'Name' ('Detail'), result='Result'.

Fields #

Name	Description
`Action` UnicodeString
`Name` UnicodeString
`Detail` UnicodeString
`Result` HexInt32

Event ID 1062: HNS failed to start a service or load a kernel driver.

Provider: Microsoft-Windows-Host-Network-Service
Channel: Microsoft-Windows-Host-Network-Service-Admin

Description

HNS failed to start a service or load a kernel driver. Name = 'ServiceOrDriverName' HResult = 'HResult'.

Message #

HNS failed to start a service or load a kernel driver. Name = '%2' HResult = '%1'.

Fields #

Name	Description
`HResult` HexInt32
`ServiceOrDriverName` UnicodeString

Event ID 1062

Provider: Microsoft-Windows-Host-Network-Service
Channel: Operational

Description

HNS failed to start a service or load a kernel driver. Name = 'ServiceOrDriverName' HResult = 'HResult'.

Fields #

Name	Description
`HResult` HexInt32
`ServiceOrDriverName` UnicodeString

Event ID entity: Entity

Provider: Microsoft-Windows-Host-Network-Service
Channel: ETW Trace
Also via: realtime ETW trace
Task: Entity
Source: Trace

Fields #

Name	Description
`Json` tlg:UnicodeString
`Type` tlg:UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "{0C885E0D-6EB6-476C-A048-2457EED3A5C1}",
    "event_source_name": "",
    "event_id": "entity",
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": "",
    "time_created": "2026-06-02T05:52:19.191+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2412,
      "thread_id": 8112
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Json": "{\"ActivityId\":\"1323CCF7-1496-4985-97B0-09053E23EC8B\",\"AdditionalParams\":{},\"Extensions\":[{\"Id\":\"E7C3B2F0-F3C5-48DF-AF2B-10FED6D72E7A\",\"IsEnabled\":false,\"Name\":\"Microsoft Windows Filtering Platform\"},{\"Id\":\"430BDADD-BAB0-41AB-A369-94B67FA5BE0A\",\"IsEnabled\":true,\"Name\":\"Microsoft NDIS Capture\"}],\"Flags\":0,\"Health\":{\"LastErrorCode\":0,\"LastUpdateTime\":134243839434405480},\"HostPortPresent\":true,\"ID\":\"02FF6FD7-6AC3-408F-B550-7F2124335698\",\"IsFSE\":false,\"IsSDN\":false,\"MacPools\":[{\"EndMacAddress\":\"00-15-5D-5C-7F-FF\",\"StartMacAddress\":\"00-15-5D-5C-70-00\"}],\"Name\":\"Default Switch\",\"Policies\":[],\"State\":0,\"SubType\":\"NAT\",\"SupportsIpv6\":false,\"Type\":\"Layered\",\"Version\":68719476736}",
    "Type": "Layered"
  },
  "message": "Entity"
}

Event ID on-rundown: OnRundown

Provider: Microsoft-Windows-Host-Network-Service
Channel: ETW Trace
Also via: realtime ETW trace
Task: OnRundown
Source: Trace

Fields #

Name	Description
`"Begin Rundown"` tlg:AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Host-Network-Service",
    "guid": "{0C885E0D-6EB6-476C-A048-2457EED3A5C1}",
    "event_source_name": "",
    "event_id": "on-rundown",
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": "",
    "time_created": "2026-06-02T05:52:19.191+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 2412,
      "thread_id": 8112
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "\"Begin Rundown\"": "Begin Rundown"
  },
  "message": "OnRundown"
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {0C885E0D-6EB6-476C-A048-2457EED3A5C1}

Defined in HostNetSvc.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Host-Network-Service registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)