detection.wiki

Microsoft-Windows-HotspotAuth

EventTitleChannelSampleRule
1001Hotspot authentication started for interface InterfaceGuid.AnalyticNN
1002Hotspot authentication successfully completed for interface InterfaceGuid.OperationalNN
1003Hotspot authentication failed for interface InterfaceGuid with status (Result) …OperationalNN
1004Hotspot authentication has cancelled for interface InterfaceGuid.OperationalNN
1005Hotspot authentication has completed for interface InterfaceGuid with status …AnalyticNN
1006Hotspot authentication scenario has cancelled for interface InterfaceGuid.AnalyticNN
2001Discovering WISPr has started for interface InterfaceGuid.AnalyticNN
2002The hotspot on interface InterfaceGuid supports WISPr.AnalyticNN
2003WISPr detection failed for interface InterfaceGuid with error (Result).OperationalNN
2004WISPr detection completed for interface InterfaceGuid with status …AnalyticNN
2005WISPr detection scenario has cancelled for interface InterfaceGuid.AnalyticNN
2006The hotspot on interface InterfaceGuid does not support WISPr.OperationalNN
2007No WISPr discovery performed for the hotspot on interface InterfaceGuid.OperationalNN
3001No hotspot detected on interface InterfaceGuid.OperationalNN
3002Interface InterfaceGuid disconnected.AnalyticNN

Event ID 1001: Hotspot authentication started for interface InterfaceGuid.

#
Channel
Analytic
Task
HotspotAuthentication
Opcode
Start

Message #

Hotspot authentication started for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 1002: Hotspot authentication successfully completed for interface InterfaceGuid.

#
Channel
Operational
Task
HotspotAuthentication
Opcode
Stop

Message #

Hotspot authentication successfully completed for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 1003: Hotspot authentication failed for interface InterfaceGuid with status (Result) and response code (ResponseCode).

#
Channel
Operational
Task
HotspotAuthentication
Opcode
Stop

Message #

Hotspot authentication failed for interface %1 with status (%2) and response code (%3)

Fields #

NameDescription
InterfaceGuid GUID
Result Int32
ResponseCode UInt32

Event ID 1004: Hotspot authentication has cancelled for interface InterfaceGuid.

#
Channel
Operational
Task
HotspotAuthentication
Opcode
Stop

Message #

Hotspot authentication has cancelled for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 1005: Hotspot authentication has completed for interface InterfaceGuid with status (AuthenticationScenarioType).

#
Channel
Analytic
Task
HotspotAuthentication
Opcode
Stop

Message #

Hotspot authentication has completed for interface %1 with status (%2)

Fields #

NameDescription
InterfaceGuid GUID
AuthenticationScenarioType UInt32
Result Int32
ResponseCode UInt32

Event ID 1006: Hotspot authentication scenario has cancelled for interface InterfaceGuid.

#
Channel
Analytic
Task
HotspotAuthentication
Opcode
Stop

Message #

Hotspot authentication scenario has cancelled for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 2001: Discovering WISPr has started for interface InterfaceGuid.

#
Channel
Analytic
Task
WISPrDetection
Opcode
Start

Message #

Discovering WISPr has started for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 2002: The hotspot on interface InterfaceGuid supports WISPr.

#
Channel
Analytic
Task
WISPrDetection
Opcode
Stop

Message #

The hotspot on interface %1 supports WISPr

Fields #

NameDescription
InterfaceGuid GUID

Event ID 2003: WISPr detection failed for interface InterfaceGuid with error (Result).

#
Channel
Operational
Task
WISPrDetection
Opcode
Stop

Message #

WISPr detection failed for interface %1 with error (%2)

Fields #

NameDescription
InterfaceGuid GUID
Result Int32

Event ID 2004: WISPr detection completed for interface InterfaceGuid with status (WisprScenarioType).

#
Channel
Analytic
Task
WISPrDetection
Opcode
Stop

Message #

WISPr detection completed for interface %1 with status (%2)

Fields #

NameDescription
InterfaceGuid GUID
WisprScenarioType UInt32
Result Int32

Event ID 2005: WISPr detection scenario has cancelled for interface InterfaceGuid.

#
Channel
Analytic
Task
WISPrDetection
Opcode
Stop

Message #

WISPr detection scenario has cancelled for interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 2006: The hotspot on interface InterfaceGuid does not support WISPr.

#
Channel
Operational
Task
WISPrDetection
Opcode
Stop

Message #

The hotspot on interface %1 does not support WISPr

Fields #

NameDescription
InterfaceGuid GUID

Event ID 2007: No WISPr discovery performed for the hotspot on interface InterfaceGuid.

#
Channel
Operational
Task
WISPrDetection
Opcode
Stop

Message #

No WISPr discovery performed for the hotspot on interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 3001: No hotspot detected on interface InterfaceGuid.

#
Channel
Operational
Task
HotspotDetection
Opcode
Stop

Message #

No hotspot detected on interface %1

Fields #

NameDescription
InterfaceGuid GUID

Event ID 3002: Interface InterfaceGuid disconnected.

#
Channel
Analytic
Task
HotspotDetection
Opcode
Stop

Message #

Interface %1 disconnected

Fields #

NameDescription
InterfaceGuid GUID

Provenance

ETW provider GUID de095dbe-8667-4168-94c2-48ca61665aca

Defined in wifinetworkmanager.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB