Microsoft-Windows-Hyper-V-EmulatedDevices
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1500 | [Virtual machine VmId] | Operational | N | N |
| 1500 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1510 | [Virtual machine VmId] | Operational | N | N |
| 1510 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1520 | [Virtual machine VmId] | Operational | N | N |
| 1520 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1530 | [Virtual machine VmId] | Operational | N | N |
| 1530 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1550 | The virtual machine VmName cannot load device Device because there are no … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 1551 | The device Device cannot be loaded because there are no mutually support … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 12530 | 'VmName' device Device could not allocate guest physical address space | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
Event ID 1500: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1500: [Virtual machine VmId] TraceData.
#Event ID 1510: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1510: [Virtual machine VmId] TraceData.
#Event ID 1520: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1520: [Virtual machine VmId] TraceData.
#Event ID 1530: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmName UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module Int32 |
Event ID 1530: [Virtual machine VmId] TraceData.
#Event ID 1550: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions
#Description
The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Event ID 1551: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client
#Description
The device cannot be loaded because there are no mutually support protocol versions between the server and client.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Provenance
ETW provider GUID da5a028b-b248-4a75-b60a-024fe6457484
Defined in vmemulateddevices.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB