detection.wiki

Microsoft-Windows-Hyper-V-EmulatedNic

EventTitleChannelSampleRule
1[VMID VmId]OperationalNN
1[VMID VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
2[VMID VmId]OperationalNN
2[VMID VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
3[VMID VmId]OperationalNN
3[VMID VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
4[VMID VmId]OperationalNN
4[VMID VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
12440'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12530'VmName' device Device could not allocate guest physical address spaceOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12531Device Device could not allocate guest physical address spaceOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12560'VmName' Static MAC address MacAddress for "NicName" (NicGuid) is invalidOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12562'VmName' Static MAC address MacAddress for "NicName" (NicGuid) conflicts with …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12564'VmName' No available MAC address for "NicName"Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12572'VmName' Dynamic MAC address for "NicName" (NicGuid) was not assignedOperationalNN
12572'.Microsoft-Windows-Hyper-V-Worker-AdminNN
12580'VmName' Dynamic MAC address MacAddress for NicName (NicGuid) is invalidOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12581Dynamic MAC address MacAddress for NicName (NicGuid) is invalidOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12670'VmName' failed to allocate a connection to a virtual network: ErrorCodeString …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12671Failed to allocate resources while connecting to a virtual networkOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12672The virtual machine VmName cannot load device Device because there are no …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12673The device Device cannot be loaded because there are no mutually support …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12692Bytes sent or received by 'VmName' is larger than what can fit inside of a …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
33010Could not find an Ethernet connection resource pool with ID 'Parameter0'Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN

Event ID 1: [VMID VmId]

#
Channel
Operational

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1: [VMID VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 2: [VMID VmId]

#
Channel
Operational

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 2: [VMID VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3: [VMID VmId]

#
Channel
Operational

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3: [VMID VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 4: [VMID VmId]

#
Channel
Operational

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 4: [VMID VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 12440: 'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during ethernet device startup

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' error 'ErrorCodeString' (ErrorCode) while opening file 'String' during ethernet device startup. The Hyper-V network service provider may not be installed. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12530: 'VmName' device Device could not allocate guest physical address space

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device could not allocate guest physical address space. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12531: Device Device could not allocate guest physical address space

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device could not allocate guest physical address space.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12560: 'VmName' Static MAC address MacAddress for "NicName" (NicGuid) is invalid

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12562: 'VmName' Static MAC address MacAddress for "NicName" (NicGuid) conflicts with another adapter

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12564: 'VmName' No available MAC address for "NicName"

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString

Event ID 12572: 'VmName' Dynamic MAC address for "NicName" (NicGuid) was not assigned

#
Channel
Operational

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12572: '.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Message #

'%1' Dynamic MAC address for "%4" (%3) was not assigned.  The virtual machine will not have network connectivity until this problem is resolved. To assign a new MAC address, restart the virtual machine.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12580: 'VmName' Dynamic MAC address MacAddress for NicName (NicGuid) is invalid

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12581: Dynamic MAC address MacAddress for NicName (NicGuid) is invalid

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Dynamic MAC address for () is invalid.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
NicGuid UnicodeString
NicName UnicodeString
MacAddress UnicodeString

Event ID 12670: 'VmName' failed to allocate a connection to a virtual network: ErrorCodeString (ErrorCode) (Virtual Machine ID VmId)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to allocate a connection to a virtual network: ErrorCodeString (ErrorCode) (Virtual Machine ID VmId). The Ethernet switch may not exist.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12671: Failed to allocate resources while connecting to a virtual network

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to allocate resources while connecting to a virtual network. The Ethernet switch may not exist.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12672: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 12673: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 12692: Bytes sent or received by 'VmName' is larger than what can fit inside of a 64-bit integer

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 33010: Could not find an Ethernet connection resource pool with ID 'Parameter0'

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
Parameter0 UnicodeString

Provenance

ETW provider GUID 09242393-1349-4f4d-9fd7-59cc79f553ce

Defined in VmEmulatedNic.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB