Microsoft-Windows-Hyper-V-Chipset
76 events across 4 channels
Event ID 1500: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1500: [Virtual machine VmId] TraceData.
#Event ID 1510: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1510: [Virtual machine VmId] TraceData.
#Event ID 1520: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1520: [Virtual machine VmId] TraceData.
#Event ID 1530: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1530: [Virtual machine VmId] TraceData.
#Event ID 1540: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1540: [Virtual machine VmId] TraceData.
#Event ID 1550: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1550: [Virtual machine VmId] TraceData.
#Event ID 1560: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1560: [Virtual machine VmId] TraceData.
#Event ID 1570: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1570: [Virtual machine VmId] TraceData.
#Event ID 12530: 'VmName' device Device could not allocate guest physical address space
#Description
'VmName' device Device could not allocate guest physical address space. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString |
Event ID 12530: 'VmName' device Device could not allocate guest physical address space.
#Event ID 12531: Device Device could not allocate guest physical address space
#Description
Device could not allocate guest physical address space.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString |
Event ID 12531: Device Device could not allocate guest physical address space.
#Event ID 12722: The SMBIOS tables contain data for CPU information that is not valid
#Description
The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UnicodeString | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 12722: The SMBIOS tables contain data for CPU information that is not valid.
#Description
The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UnicodeString | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 12723: The SMBIOS tables contain data for CPU information that is not valid
#Description
The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UnicodeString | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 12723: The SMBIOS tables contain data for CPU information that is not valid.
#Description
The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
String UnicodeString | |
ErrorCodeString UnicodeString | |
ErrorCode UnicodeString | |
Param1 UnicodeString | |
Param2 UnicodeString |
Event ID 12724: The virtual machine 'VmName' cannot start because secure boot is off
#Description
The virtual machine 'VmName' cannot start because secure boot is off. Enable secure boot to start a shielded virtual machine. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 12724: The virtual machine 'VmName' cannot start because secure boot is off.
#Event ID 12725: The virtual machine 'VmName' cannot start because secure boot is off
#Description
The virtual machine 'VmName' cannot start because secure boot is off.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 12725: The virtual machine 'VmName' cannot start because secure boot is off.
#Event ID 12730: The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId)
#Description
The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Parameter0 UnicodeString |
Event ID 12730: The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId).
#Event ID 12731: The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode)
#Description
The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Parameter0 UnicodeString |
Event ID 12731: The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode).
#Event ID 18600: 'VmName' has encountered a watchdog timeout and was reset
#Description
'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18600: 'VmName' has encountered a watchdog timeout and was reset.
#Event ID 18601: 'VmName' successfully booted an operating system
#Description
'VmName' successfully booted an operating system. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18601: 'VmlEventLog.VmName' successfully booted an operating system.
#Description
'VmlEventLog.VmName' successfully booted an operating system. (Virtual machine ID VmlEventLog.VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Hyper-V-Chipset",
"guid": "DE9BA731-7F33-4F44-98C9-6CAC856B9F83",
"event_source_name": "",
"event_id": 18601,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:08:20.711339+00:00",
"event_record_id": 8,
"correlation": {
"ActivityID": "A5B814C5-B324-0007-3329-B8A524B3DC01"
},
"execution": {
"process_id": 9752,
"thread_id": 8468
},
"channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-83-1-754131803-1256623942-3691508397-1420384594"
}
},
"user_data": {
"VmlEventLog": {
"VmName": "2cf3235b-8f46-4ae6-adf2-07dc5259a954",
"VmId": "2CF3235B-8F46-4AE6-ADF2-07DC5259A954",
"VmBootSourceCount": 1,
"VmBootSourceResult": "<VmBootSourceResultDetail><Status>0x00010005</Status><ExtendedStatus>0x00000000</ExtendedStatus><DevicePath>AcpiEx(VMBus,0,0)/VenHw(9B17E5A2-0891-42DD-B653-80B5C22809BA,C3C176C376D2D24890A9C04748072C60DF9B3CC6A55F0842B03F6B458B365592)/\\EFI\\Microsoft\\Boot\\bootmgfw.efi</DevicePath></VmBootSourceResultDetail>"
}
},
"message": ""
}
Event ID 18602: 'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation
#Description
'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18602: 'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation.
#Event ID 18603: 'VmName' failed to boot an operating system
#Description
'VmName' failed to boot an operating system. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18603: 'VmlEventLog.VmName' failed to boot an operating system.
#Description
'VmlEventLog.VmName' failed to boot an operating system. (Virtual machine ID VmlEventLog.VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Hyper-V-Chipset",
"guid": "DE9BA731-7F33-4F44-98C9-6CAC856B9F83",
"event_source_name": "",
"event_id": 18603,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:25:28.192759+00:00",
"event_record_id": 43,
"correlation": {},
"execution": {
"process_id": 2520,
"thread_id": 8480
},
"channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-83-1-2656045725-1227044221-1802231738-3450451864"
}
},
"user_data": {
"VmlEventLog": {
"VmName": "TestVM2",
"VmId": "9E500A9D-357D-4923-BADF-6B6B98B7A9CD",
"VmBootSourceCount": 4,
"VmBootSourceResult": "Optical",
"VmBootSourceResult_1": "HardDrive",
"VmBootSourceResult_2": "Network",
"VmBootSourceResult_3": "Floppy"
}
},
"message": ""
}
Event ID 18604: 'VmName' failed to boot an operating system
#Description
'VmName' failed to boot an operating system. At least one boot source failed secure boot validation. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18604: 'VmName' failed to boot an operating system.
#Event ID 18605: 'VmName' No bootable devices are configured
#Description
'VmName' No bootable devices are configured. Use Hyper-V Manager to configure a bootable device. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18605: 'VmName' No bootable devices are configured.
#Event ID 18606: 'VmName' is attempting to boot an operating system
#Description
'VmName' is attempting to boot an operating system. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Event ID 18606: 'VmName' is attempting to boot an operating system.
#Description
'VmName' is attempting to boot an operating system. (Virtual machine ID VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmlEventLog.VmName UnicodeString | |
VmlEventLog.VmId UnicodeString | |
VmlEventLog.VmBootSourceCount | |
VmlEventLog.VmBootSourceResult | |
VmName UnicodeString | |
VmId UnicodeString | |
BootSourceCount UInt32 | |
BootSourceResult UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Hyper-V-Chipset",
"guid": "{DE9BA731-7F33-4F44-98C9-6CAC856B9F83}",
"event_source_name": "",
"event_id": 18606,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T15:12:00.6967133+00:00",
"event_record_id": 70,
"correlation": {},
"execution": {
"process_id": 9832,
"thread_id": 8208
},
"channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
"computer": "telemetry-W11-d.cell-d.ludus.domain",
"security": {
"user_id": "S-1-5-83-1-601903291-1075843831-834788227-4211237455"
}
},
"user_data": {
"VmlEventLog": {
"VmName": "evtgen-tiny",
"VmId": "23E050BB-12F7-4020-83DB-C1314F6202FB",
"VmBootSourceCount": "4",
"VmBootSourceResult": "Floppy"
}
},
"message": "'evtgen-tiny' is attempting to boot an operating system. (Virtual machine ID 23E050BB-12F7-4020-83DB-C1314F6202FB)"
}
Event ID 18607: 'VmName' was unable to exit UEFI boot services
#Description
'VmName' was unable to exit UEFI boot services. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18607: 'VmName' was unable to exit UEFI boot services.
#Event ID 18608: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions
#Description
The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Event ID 18608: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions.
#Description
The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions. The server version is ServerVersion and the client version is ClientVersion (Virtual machine ID VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Event ID 18609: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client
#Description
The device cannot be loaded because there are no mutually support protocol versions between the server and client.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Event ID 18609: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.
#Event ID 18610: 'VmName' failed to initialize due to a failure in attestation and key release
#Description
'VmName' failed to initialize due to a failure in attestation and key release. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18610: 'VmName' failed to initialize due to a failure in attestation and key release.
#Event ID 18611: 'VmName' cleared VM guest state due to a configuration change
#Description
'VmName' cleared VM guest state due to a configuration change. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18611: 'VmName' cleared VM guest state due to a configuration change.
#Event ID 18612: 'VmName' VM guest state initialization failed
#Description
'VmName' VM guest state initialization failed. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18612: 'VmName' VM guest state initialization failed.
#Event ID 18613: 'VmName' cleared VM guest state due to invalid data
#Description
'VmName' cleared VM guest state due to invalid data. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18613: 'VmName' cleared VM guest state due to invalid data.
#Event ID 18614: 'VmName' cleared VM guest state due to corrupt data
#Description
'VmName' cleared VM guest state due to corrupt data. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18614: 'VmName' cleared VM guest state due to corrupt data.
#Event ID 18615: 'VmName' VM guest state encryption key not released
#Description
'VmName' VM guest state encryption key not released. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18615: 'VmName' VM guest state encryption key not released.
#Event ID 18616: 'VmName' failed to decrypt VM guest state disk encryption key
#Description
'VmName' failed to decrypt VM guest state disk encryption key. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18616: 'VmName' failed to decrypt VM guest state disk encryption key.
#Event ID 18617: 'VmName' has encountered a watchdog timeout and was reset
#Description
'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18617: 'VmName' has encountered a watchdog timeout and was reset.
#Event ID 18618: 'VmName' failed while applying management VTL settings:
#Description
'VmName' failed while applying management VTL settings: ResultDocument. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Status UInt32 | NTSTATUS reference |
ResultDocument UnicodeString |
Event ID 18618: 'VmName' failed while applying management VTL settings: ResultDocument.
#Description
'VmName' failed while applying management VTL settings: ResultDocument. (Virtual machine ID VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Status UInt32 | NTSTATUS reference |
ResultDocument UnicodeString |
Event ID 18620: 'VmName' failed in the management VTL before starting guest VTL0:
#Description
'VmName' failed in the management VTL before starting guest VTL0: ResultDocument. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Status UInt32 | NTSTATUS reference |
ResultDocument UnicodeString |
Event ID 18620: 'VmName' failed in the management VTL before starting guest VTL0: ResultDocument.
#Description
'VmName' failed in the management VTL before starting guest VTL0: ResultDocument. (Virtual machine ID VmId).
Message #
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Status UInt32 | NTSTATUS reference |
ResultDocument UnicodeString |
Event ID 18622: 'VmName' has firmware debugging enabled and cannot be started without COM1 configured
#Description
'VmName' has firmware debugging enabled and cannot be started without COM1 configured. (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString |
Event ID 18622: 'VmName' has firmware debugging enabled and cannot be started without COM1 configured.
#Event ID 18624: 'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode)
#Description
'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode). (Virtual machine ID VmId).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
ErrorMessage UnicodeString | |
ErrorCode UnicodeString | |
Parameter0 UnicodeString |
Event ID 18624: 'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID de9ba731-7f33-4f44-98c9-6cac856b9f83
Defined in vmchipset.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02