detection.wiki

Microsoft-Windows-Hyper-V-Integration

EventTitleChannelSampleRule
3584[Virtual machine VmId]OperationalNN
3584[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
3585[Virtual machine VmId]OperationalNN
3585[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
3586[Virtual machine VmId]OperationalNN
3586[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
3587[Virtual machine VmId]OperationalNN
3587[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
4000Failed to connect to virtual machine 'VmName' because there is no mutually …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4090'VmName': The 'Guest Service Interface' integration service is either not …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4091The 'Guest Service Interface' integration service is either not enabled, not …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4092'VmName': The Data Exchange integration service is either not enabled, not …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4093'VmName': The Volume Shadow Copy integration service is not enabledOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4094'VmName': The 'Guest Shutdown' integration service is either not enabled, not …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4095The 'Guest Shutdown' integration service is either not enabled, not running or …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4097'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4098'VmName': The Virtual machine VmId cannot be hot backed up since it has one or …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4099'VmName': The Virtual machine VmId cannot be hot backed up since it has …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4100'VmName': The Volume Shadow Copy integration service is either not running or …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4101'VmName': The Virtual machine VmId cannot be hot backed up since it has storage …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4102'VmName': The Virtual machine VmId cannot be hot backed up since its integration …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4130'VmName' received a timeout error while applying IP settings on adapter 'Param1'Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4132'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4133'VmName' successfully applied IP settings on adapter 'String'Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
4134'VmName': The Data Exchange integration service does not support this operation …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN

Event ID 3584: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3584: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3585: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3585: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3586: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3586: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3587: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 3587: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 4000: Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId). Framework version: Param1; Message version: Param2.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4090: 'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4091: The 'Guest Service Interface' integration service is either not enabled, not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4092: 'VmName': The Data Exchange integration service is either not enabled, not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Data Exchange integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4093: 'VmName': The Volume Shadow Copy integration service is not enabled

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Volume Shadow Copy integration service is not enabled. (Virtual machine VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4094: 'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4095: The 'Guest Shutdown' integration service is either not enabled, not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4097: 'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic disks in it

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4098: 'VmName': The Virtual machine VmId cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4099: 'VmName': The Virtual machine VmId cannot be hot backed up since it has non-checkpoint capable volumes in it

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4100: 'VmName': The Volume Shadow Copy integration service is either not running or not initialized

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Volume Shadow Copy integration service is either not running or not initialized. (Virtual machine VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4101: 'VmName': The Virtual machine VmId cannot be hot backed up since it has storage space disks in it

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4102: 'VmName': The Virtual machine VmId cannot be hot backed up since its integration components have not been updated

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Virtual machine VmId cannot be hot backed up since its integration components have not been updated. Please update the integration components to enable hot backup of the virtual machine.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4130: 'VmName' received a timeout error while applying IP settings on adapter 'Param1'

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' received a timeout error while applying IP settings on adapter 'Param1'. Check the guest network configuration to verify whether the settings were correctly applied. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Event ID 4132: 'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode). (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 4133: 'VmName' successfully applied IP settings on adapter 'String'

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' successfully applied IP settings on adapter 'String'. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString

Event ID 4134: 'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Param1 UnicodeString
Param2 UnicodeString
Param3 UnicodeString

Provenance

ETW provider GUID 2b74a015-3873-4c56-9928-ea80c58b2787

Defined in vmicvdev.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB