Microsoft-Windows-Hyper-V-EmulatedStor

98 events across 3 channels

Event	Title	Channel	Sample
1	[VMID VmId]	Operational	N
1	[VMID VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
2	[VMID VmId]	Operational	N
2	[VMID VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
3	[VMID VmId]	Operational	N
3	[VMID VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
4	[VMID VmId]	Operational	N
4	[VMID VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
12140	'VmName': Failed to open attachment 'String'	Operational	N
12140	'VmName': Failed to open attachment 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	Y
12141	Failed to open attachment 'String'	Operational	N
12141	Failed to open attachment 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12146	'VmName': Failed to open ISO image 'String' because the file is corrupt or is …	Operational	N
12146	'VmName': Failed to open ISO image 'String' because the file is corrupt or is …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12147	Failed to open ISO image 'String' because the file is corrupt or is too small	Operational	N
12147	Failed to open ISO image 'String' because the file is corrupt or is too small.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12148	'VmName': Failed to open 'String': Compressed virtual hard disks are not …	Operational	N
12148	'VmName': Failed to open 'String': Compressed virtual hard disks are not …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12149	Failed to open 'String': Compressed virtual hard disks are not supported	Operational	N
12149	Failed to open 'String': Compressed virtual hard disks are not supported.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12162	'VmName': Failed to configure 'String': The storage where the virtual hard disk …	Operational	N
12162	'VmName': Failed to configure 'String': The storage where the virtual hard disk …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12163	Failed to configure 'String': The storage where the virtual hard disk is located …	Operational	N
12163	Failed to configure 'String': The storage where the virtual hard disk is located …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12200	'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' …	Operational	N
12200	'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12201	String: Virtual machine is out of Memory Error 'ErrorCodeString'	Operational	N
12201	String: Virtual machine is out of Memory Error 'ErrorCodeString'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12240	'VmName': Attachment 'String' not found	Operational	N
12240	'VmName': Attachment 'String' not found.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12241	Attachment 'String' not found	Operational	N
12241	Attachment 'String' not found.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12290	'VmName': Param1 Account does not have sufficient privilege to open attachment …	Operational	N
12290	'VmName': Param1 Account does not have sufficient privilege to open attachment …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12291	Param1 Account does not have sufficient privilege to open attachment 'String'	Operational	N
12291	Param1 Account does not have sufficient privilege to open attachment 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12292	'VmName' encountered an error while calculating the size of the disk chain for …	Operational	N
12292	'VmName' encountered an error while calculating the size of the disk chain for …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12293	There was an error while calculating the size of the disk chain for disk metrics	Operational	N
12293	There was an error while calculating the size of the disk chain for disk …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12300	Virtual machine='VmName', File 'String' is not a known floppy image type	Operational	N
12300	Virtual machine='VmName', File 'String' is not a known floppy image type.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12301	File 'String' is not a known floppy image type	Operational	N
12301	File 'String' is not a known floppy image type.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12350	'VmName': An error occurred while attempting to start the virtual machine	Operational	N
12350	'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12351	An error occurred while attempting to start the virtual machine	Operational	N
12351	An error occurred while attempting to start the virtual machine.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12352	'VmName': An error occurred while attaching 'String' to the virtual machine	Operational	N
12352	'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12353	An error occurred while attaching 'String' to the virtual machine	Operational	N
12353	An error occurred while attaching 'String' to the virtual machine.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12616	Physical DVD drives are not supported on SCSI controllers	Operational	N
12616	Physical DVD drives are not supported on SCSI controllers.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12617	Physical DVD drives are not supported on SCSI controllers	Operational	N
12617	Physical DVD drives are not supported on SCSI controllers.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12618	DVD drives are not supported on SCSI controllers in Generation 1 virtual …	Operational	N
12618	DVD drives are not supported on SCSI controllers in Generation 1 virtual …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12619	DVD drives are not supported on SCSI controllers in Generation 1 virtual …	Operational	N
12619	DVD drives are not supported on SCSI controllers in Generation 1 virtual …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12620	'VmName': Could not get information for attachment 'String'	Operational	N
12620	'VmName': Could not get information for attachment 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12621	Could not get information for attachment 'String'	Operational	N
12621	Could not get information for attachment 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12625	'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' …	Operational	N
12625	'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12626	'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'	Operational	N
12626	'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12628	'VmName': Failed to get the recovery status for the drive 'String'	Operational	N
12628	'VmName': Failed to get the recovery status for the drive 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12629	'VmName': Failed to get the recovery status for the drive 'String'	Operational	N
12629	'VmName': Failed to get the recovery status for the drive 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12630	'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'	Operational	N
12630	'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12634	'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'	Operational	N
12634	'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12635	'VmName': Virtual hard disk 'Path' received a resiliency status notification	Operational	N
12635	'VmName': Virtual hard disk 'Path' received a resiliency status notification.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12636	'VmName': Virtual hard disk 'Path' has detected a critical error	Operational	N
12636	'VmName': Virtual hard disk 'Path' has detected a critical error.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12637	'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error	Operational	N
12637	'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12638	The virtual machine VmName cannot load device Device because there are no …	Operational	N
12638	The virtual machine VmName cannot load device Device because there are no …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12639	The device Device cannot be loaded because there are no mutually support …	Operational	N
12639	The device Device cannot be loaded because there are no mutually support …	Microsoft-Windows-Hyper-V-Worker-Admin	N
12640	'VmName': Unsupported attachment Path 'String' in the drive	Operational	N
12640	'VmName': Unsupported attachment Path 'String' in the drive.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12641	Unsupported attachment Path 'String' in the drive	Operational	N
12641	Unsupported attachment Path 'String' in the drive.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12667	'VmName': Could not open file 'String'	Operational	N
12667	'VmName': Could not open file 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12668	Could not open file 'String'	Operational	N
12668	Could not open file 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12812	'VmName': Enabling change tracking failed for the drive 'String'	Operational	N
12812	'VmName': Enabling change tracking failed for the drive 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
12817	'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time	Operational	N
12817	'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time.	Microsoft-Windows-Hyper-V-Worker-Admin	N

Event ID 1: [VMID VmId]

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1: [VMID VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 2: [VMID VmId]

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 2: [VMID VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3: [VMID VmId]

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3: [VMID VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 4: [VMID VmId]

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 4: [VMID VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[VMID %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 12140: 'VmName': Failed to open attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to open attachment 'String'. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12140: 'VmName': Failed to open attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin
Level: Error

Description

'VmName': Failed to open attachment 'String'. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Message #

'%1': Failed to open attachment '%3'. Error: '%4' (%5). (Virtual machine ID %2)

Fields #

Name	Description
`VmlEventLog.VmName` UnicodeString
`VmlEventLog.VmId` UnicodeString
`VmlEventLog.String` UnicodeString
`VmlEventLog.ErrorCodeString` UnicodeString
`VmlEventLog.ErrorCode` UInt32
`VmlEventLog.Param1` UnicodeString
`VmlEventLog.Param2` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-EmulatedStor",
    "guid": "{86E15E01-EDF1-4AC7-89CF-B19563FD6894}",
    "event_source_name": "",
    "event_id": 12140,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T15:46:57.7400240+00:00",
    "event_record_id": 203,
    "correlation": {
      "ActivityID": "{0726B8BA-FB3C-0003-042C-29073CFBDC01}"
    },
    "execution": {
      "process_id": 8888,
      "thread_id": 5368
    },
    "channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-838361004-1162202325-2130707894-2078394515"
    }
  },
  "user_data": {
    "VmlEventLog": {
      "VmName": "evtgen-linux",
      "VmId": "31F85FAC-CCD5-4545-B605-007F93C8E17B",
      "String": "C:\\evtgen-hvlinux\\boot_075030EA-1355-4DB9-AC4E-69174C39DD74.avhdx",
      "ErrorCodeString": "%%2147942432",
      "ErrorCode": "7864368",
      "Param1": "80070020",
      "Param2": "IDE/ATAPI"
    }
  },
  "message": "'evtgen-linux': Failed to open attachment 'C:\\evtgen-hvlinux\\boot_075030EA-1355-4DB9-AC4E-69174C39DD74.avhdx'. Error: 'The process cannot access the file because it is being used by another process. ' (7864368). (Virtual machine ID 31F85FAC-CCD5-4545-B605-007F93C8E17B)"
}

Event ID 12141: Failed to open attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Failed to open attachment 'String'. Error: 'ErrorCodeString'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12141: Failed to open attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to open attachment 'String'. Error: 'ErrorCodeString'.

Message #

Failed to open attachment '%3'. Error: '%4'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12146: 'VmName': Failed to open ISO image 'String' because the file is corrupt or is too small

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to open ISO image 'String' because the file is corrupt or is too small. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12146: 'VmName': Failed to open ISO image 'String' because the file is corrupt or is too small.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to open ISO image 'String' because the file is corrupt or is too small. (Virtual machine ID VmId).

Message #

'%1': Failed to open ISO image '%3' because the file is corrupt or is too small. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12147: Failed to open ISO image 'String' because the file is corrupt or is too small

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Failed to open ISO image 'String' because the file is corrupt or is too small.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12147: Failed to open ISO image 'String' because the file is corrupt or is too small.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to open ISO image 'String' because the file is corrupt or is too small.

Message #

Failed to open ISO image '%3' because the file is corrupt or is too small.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12148: 'VmName': Failed to open 'String': Compressed virtual hard disks are not supported

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to open 'String': Compressed virtual hard disks are not supported.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12148: 'VmName': Failed to open 'String': Compressed virtual hard disks are not supported.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to open 'String': Compressed virtual hard disks are not supported.

Message #

'%1': Failed to open '%3': Compressed virtual hard disks are not supported.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12149: Failed to open 'String': Compressed virtual hard disks are not supported

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Failed to open 'String': Compressed virtual hard disks are not supported.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12149: Failed to open 'String': Compressed virtual hard disks are not supported.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to open 'String': Compressed virtual hard disks are not supported.

Message #

Failed to open '%3': Compressed virtual hard disks are not supported.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12162: 'VmName': Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12162: 'VmName': Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Message #

'%1': Failed to configure '%3': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12163: Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12163: Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to configure 'String': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Message #

Failed to configure '%3': The storage where the virtual hard disk is located does not support virtual hard disk sharing.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12200: 'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' (ErrorCode)

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12200: 'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' (ErrorCode).

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' String: virtual machine is out of Memory Error 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Message #

'%1' %3: virtual machine is out of Memory Error '%4' (%5). (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12201: String: Virtual machine is out of Memory Error 'ErrorCodeString'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

String: Virtual machine is out of Memory Error 'ErrorCodeString'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12201: String: Virtual machine is out of Memory Error 'ErrorCodeString'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

String: Virtual machine is out of Memory Error 'ErrorCodeString'.

Message #

%3: Virtual machine is out of Memory Error '%4'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12240: 'VmName': Attachment 'String' not found

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Attachment 'String' not found. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12240: 'VmName': Attachment 'String' not found.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Attachment 'String' not found. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Message #

'%1': Attachment '%3' not found. Error: '%4' (%5). (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12241: Attachment 'String' not found

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Attachment 'String' not found. Error: 'ErrorCodeString'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12241: Attachment 'String' not found.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Attachment 'String' not found. Error: 'ErrorCodeString'.

Message #

Attachment '%3' not found. Error: '%4'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12290: 'VmName': Param1 Account does not have sufficient privilege to open attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Param1 Account does not have sufficient privilege to open attachment 'String'. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12290: 'VmName': Param1 Account does not have sufficient privilege to open attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Param1 Account does not have sufficient privilege to open attachment 'String'. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Message #

'%1': %6 Account does not have sufficient privilege to open attachment '%3'. Error: '%4' (%5). (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12291: Param1 Account does not have sufficient privilege to open attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Param1 Account does not have sufficient privilege to open attachment 'String'. Error: 'ErrorCodeString'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12291: Param1 Account does not have sufficient privilege to open attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Param1 Account does not have sufficient privilege to open attachment 'String'. Error: 'ErrorCodeString'.

Message #

%6 Account does not have sufficient privilege to open attachment '%3'. Error: '%4'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12292: 'VmName' encountered an error while calculating the size of the disk chain for 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName' encountered an error while calculating the size of the disk chain for 'String'. The error was: 'ErrorCodeString' (ErrorCode). Maximum disk metric will not be updated for the current disk. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12292: 'VmName' encountered an error while calculating the size of the disk chain for 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Message #

'%1' encountered an error while calculating the size of the disk chain for '%3'. The error was: '%4' (%5). Maximum disk metric will not be updated for the current disk. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12293: There was an error while calculating the size of the disk chain for disk metrics

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

There was an error while calculating the size of the disk chain for disk metrics.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12293: There was an error while calculating the size of the disk chain for disk metrics.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

There was an error while calculating the size of the disk chain for disk metrics.

Message #

There was an error while calculating the size of the disk chain for disk metrics.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12300: Virtual machine='VmName', File 'String' is not a known floppy image type

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Virtual machine='VmName', File 'String' is not a known floppy image type. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12300: Virtual machine='VmName', File 'String' is not a known floppy image type.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Virtual machine='VmName', File 'String' is not a known floppy image type. (Virtual machine ID VmId).

Message #

Virtual machine='%1', File '%3' is not a known floppy image type. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12301: File 'String' is not a known floppy image type

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

File 'String' is not a known floppy image type.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12301: File 'String' is not a known floppy image type.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

File 'String' is not a known floppy image type.

Message #

File '%3' is not a known floppy image type.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12350: 'VmName': An error occurred while attempting to start the virtual machine

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12350: '.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Message #

'%1': An error occurred while attempting to start the virtual machine. Cannot open '%3'. The state of the virtual machine cannot be changed because one or more storage media are not accessible. Hyper-V does not support the use of storage media if Encrypting File System has been used to encrypt files. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12351: An error occurred while attempting to start the virtual machine

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

An error occurred while attempting to start the virtual machine. Cannot open 'String'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12351: An error occurred while attempting to start the virtual machine.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

An error occurred while attempting to start the virtual machine. Cannot open 'String'.

Message #

An error occurred while attempting to start the virtual machine. Cannot open '%3'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12352: 'VmName': An error occurred while attaching 'String' to the virtual machine

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12352: '.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Message #

'%1': An error occurred while attaching '%3' to the virtual machine. The file is encrypted. Hyper-V does not support the use of storage media if Encrypting File System has been used to encrypt files. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12353: An error occurred while attaching 'String' to the virtual machine

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

An error occurred while attaching 'String' to the virtual machine. The file is encrypted.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12353: An error occurred while attaching 'String' to the virtual machine.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

An error occurred while attaching 'String' to the virtual machine. The file is encrypted.

Message #

An error occurred while attaching '%3' to the virtual machine. The file is encrypted.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12616: Physical DVD drives are not supported on SCSI controllers

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Physical DVD drives are not supported on SCSI controllers.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12616: Physical DVD drives are not supported on SCSI controllers.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Physical DVD drives are not supported on SCSI controllers.

Message #

Physical DVD drives are not supported on SCSI controllers.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12617: Physical DVD drives are not supported on SCSI controllers

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Physical DVD drives are not supported on SCSI controllers.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12617: Physical DVD drives are not supported on SCSI controllers.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Physical DVD drives are not supported on SCSI controllers.

Message #

Physical DVD drives are not supported on SCSI controllers.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12618: DVD drives are not supported on SCSI controllers in Generation 1 virtual machines

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12618: DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Message #

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12619: DVD drives are not supported on SCSI controllers in Generation 1 virtual machines

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12619: DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Message #

DVD drives are not supported on SCSI controllers in Generation 1 virtual machines.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12620: 'VmName': Could not get information for attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Could not get information for attachment 'String'. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12620: 'VmName': Could not get information for attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Could not get information for attachment 'String'. (Virtual machine ID VmId).

Message #

'%1': Could not get information for attachment '%3'. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12621: Could not get information for attachment 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Could not get information for attachment 'String'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12621: Could not get information for attachment 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Could not get information for attachment 'String'.

Message #

Could not get information for attachment '%3'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12625: 'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' with error 'ErrorCode' ('ErrorCodeString')

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' with error 'ErrorCode' ('ErrorCodeString').

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12625: 'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' with error 'ErrorCode' ('ErrorCodeString').

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to enable virtual hard disk resiliency for the drive 'String' with error 'ErrorCode' ('ErrorCodeString').

Message #

'%1': Failed to enable virtual hard disk resiliency for the drive '%3' with error '%5' ('%4')

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12626: 'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12626: 'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to enable virtual hard disk resiliency for the drive 'String'.

Message #

'%1': Failed to enable virtual hard disk resiliency for the drive '%3'.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12628: 'VmName': Failed to get the recovery status for the drive 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to get the recovery status for the drive 'String'. Virtual hard disk resiliency will be suspended for this drive until next reboot. Error: 'ErrorCode' ('ErrorCodeString').

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12628: 'VmName': Failed to get the recovery status for the drive 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to get the recovery status for the drive 'String'. Virtual hard disk resiliency will be suspended for this drive until next reboot. Error: 'ErrorCode' ('ErrorCodeString').

Message #

'%1': Failed to get the recovery status for the drive '%3'. Virtual hard disk resiliency will be suspended for this drive until next reboot. Error: '%5' ('%4')

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12629: 'VmName': Failed to get the recovery status for the drive 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Failed to get the recovery status for the drive 'String'. Virtual hard disk resiliency will be suspended for this drive until next reboot.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12629: 'VmName': Failed to get the recovery status for the drive 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Failed to get the recovery status for the drive 'String'. Virtual hard disk resiliency will be suspended for this drive until next reboot.

Message #

'%1': Failed to get the recovery status for the drive '%3'. Virtual hard disk resiliency will be suspended for this drive until next reboot.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12630: 'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'. The virtual machine will be powered off. Current status: Status. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12630: 'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Virtual hard disk resiliency failed to recover the drive 'Path'. The virtual machine will be powered off. Current status: Status. (Virtual machine ID VmId).

Message #

'%1': Virtual hard disk resiliency failed to recover the drive '%3'. The virtual machine will be powered off. Current status: %4. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12634: 'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'. Current status: Status. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12634: 'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Virtual hard disk resiliency successfully recovered drive 'Path'. Current status: Status. (Virtual machine ID VmId).

Message #

'%1': Virtual hard disk resiliency successfully recovered drive '%3'. Current status: %4. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12635: 'VmName': Virtual hard disk 'Path' received a resiliency status notification

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Virtual hard disk 'Path' received a resiliency status notification. Current status: Status. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12635: 'VmName': Virtual hard disk 'Path' received a resiliency status notification.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Virtual hard disk 'Path' received a resiliency status notification. Current status: Status. (Virtual machine ID VmId).

Message #

'%1': Virtual hard disk '%3' received a resiliency status notification. Current status: %4. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12636: 'VmName': Virtual hard disk 'Path' has detected a critical error

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Virtual hard disk 'Path' has detected a critical error. Current status: Status. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12636: 'VmName': Virtual hard disk 'Path' has detected a critical error.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Virtual hard disk 'Path' has detected a critical error. Current status: Status. (Virtual machine ID VmId).

Message #

'%1': Virtual hard disk '%3' has detected a critical error. Current status: %4. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12637: 'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error. Current status: Status. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12637: 'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Virtual hard disk 'Path' has not yet recovered from a previous error. Current status: Status. (Virtual machine ID VmId).

Message #

'%1': Virtual hard disk '%3' has not yet recovered from a previous error. Current status: %4. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Path` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 12638: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 12638: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions. The server version is ServerVersion and the client version is ClientVersion (Virtual machine ID VmId).

Message #

The virtual machine %1 cannot load device %3 because there are no mutually supported protocol versions. The server version is %4 and the client version is %5 (Virtual machine ID %2).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 12639: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 12639: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Message #

The device %3 cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Device` UnicodeString
`ServerVersion` UnicodeString
`ClientVersion` UnicodeString

Event ID 12640: 'VmName': Unsupported attachment Path 'String' in the drive

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Unsupported attachment Path 'String' in the drive. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12640: 'VmName': Unsupported attachment Path 'String' in the drive.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Unsupported attachment Path 'String' in the drive. (Virtual machine ID VmId).

Message #

'%1': Unsupported attachment Path '%3' in the drive. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12641: Unsupported attachment Path 'String' in the drive

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Unsupported attachment Path 'String' in the drive.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12641: Unsupported attachment Path 'String' in the drive.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Unsupported attachment Path 'String' in the drive.

Message #

Unsupported attachment Path '%3' in the drive.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12667: 'VmName': Could not open file 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Could not open file 'String'. It was removed from the drive. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12667: 'VmName': Could not open file 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Could not open file 'String'. It was removed from the drive. (Virtual machine ID VmId).

Message #

'%1': Could not open file '%3'. It was removed from the drive. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12668: Could not open file 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

Could not open file 'String'. It was removed from the drive.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12668: Could not open file 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Could not open file 'String'. It was removed from the drive.

Message #

Could not open file '%3'. It was removed from the drive.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12812: 'VmName': Enabling change tracking failed for the drive 'String'

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': Enabling change tracking failed for the drive 'String'. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12812: 'VmName': Enabling change tracking failed for the drive 'String'.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': Enabling change tracking failed for the drive 'String'. (Virtual machine ID VmId).

Message #

'%1': Enabling change tracking failed for the drive '%3'. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12817: 'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Operational

Description

'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time. The virtual machine will fail to boot. Error: 'ErrorCode' ('ErrorCodeString') (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 12817: 'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time.

Provider: Microsoft-Windows-Hyper-V-EmulatedStor
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': An unrecoverable I/O error occurred on drive 'String' at boot time. The virtual machine will fail to boot. Error: 'ErrorCode' ('ErrorCodeString') (Virtual machine ID VmId).

Message #

'%1': An unrecoverable I/O error occurred on drive '%3' at boot time. The virtual machine will fail to boot. Error: '%5' ('%4') (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UInt32
`Param1` UnicodeString
`Param2` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 86e15e01-edf1-4ac7-89cf-b19563fd6894

Defined in VmEmulatedStorage.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-EmulatedStor registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)