Microsoft-Windows-Hyper-V-Integration

42 events across 3 channels

Event	Title	Channel	Sample
3584	[Virtual machine VmId]	Operational	N
3584	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
3585	[Virtual machine VmId]	Operational	N
3585	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
3586	[Virtual machine VmId]	Operational	N
3586	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
3587	[Virtual machine VmId]	Operational	N
3587	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N
4000	Failed to connect to virtual machine 'VmName' because there is no mutually …	Operational	N
4000	Failed to connect to virtual machine 'VmName' because there is no mutually …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4090	'VmName': The 'Guest Service Interface' integration service is either not …	Operational	N
4090	'VmName': The 'Guest Service Interface' integration service is either not …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4091	The 'Guest Service Interface' integration service is either not enabled, not …	Operational	N
4091	The 'Guest Service Interface' integration service is either not enabled, not …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4092	'VmName': The Data Exchange integration service is either not enabled, not …	Operational	N
4092	'VmName': The Data Exchange integration service is either not enabled, not …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4093	'VmName': The Volume Shadow Copy integration service is not enabled	Operational	N
4093	'VmName': The Volume Shadow Copy integration service is not enabled.	Microsoft-Windows-Hyper-V-Worker-Admin	N
4094	'VmName': The 'Guest Shutdown' integration service is either not enabled, not …	Operational	N
4094	'VmName': The 'Guest Shutdown' integration service is either not enabled, not …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4095	The 'Guest Shutdown' integration service is either not enabled, not running or …	Operational	N
4095	The 'Guest Shutdown' integration service is either not enabled, not running or …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4097	'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic …	Operational	N
4097	'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4098	'VmName': The Virtual machine VmId cannot be hot backed up since it has one or …	Operational	N
4098	'VmName': The Virtual machine VmId cannot be hot backed up since it has one or …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4099	'VmName': The Virtual machine VmId cannot be hot backed up since it has …	Operational	N
4099	'VmName': The Virtual machine VmId cannot be hot backed up since it has …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4100	'VmName': The Volume Shadow Copy integration service is either not running or …	Operational	N
4100	'VmName': The Volume Shadow Copy integration service is either not running or …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4101	'VmName': The Virtual machine VmId cannot be hot backed up since it has storage …	Operational	N
4101	'VmName': The Virtual machine VmId cannot be hot backed up since it has storage …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4102	'VmName': The Virtual machine VmId cannot be hot backed up since its integration …	Operational	N
4102	'VmName': The Virtual machine VmId cannot be hot backed up since its integration …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4130	'VmName' received a timeout error while applying IP settings on adapter 'Param1'	Operational	N
4130	'VmName' received a timeout error while applying IP settings on adapter …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4132	'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString …	Operational	N
4132	'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString …	Microsoft-Windows-Hyper-V-Worker-Admin	N
4133	'VmName' successfully applied IP settings on adapter 'String'	Operational	N
4133	'VmName' successfully applied IP settings on adapter 'String'.	Microsoft-Windows-Hyper-V-Worker-Admin	N
4134	'VmName': The Data Exchange integration service does not support this operation …	Operational	N
4134	'VmName': The Data Exchange integration service does not support this operation …	Microsoft-Windows-Hyper-V-Worker-Admin	N

Event ID 3584: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3584: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3585: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3585: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3586: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3586: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3587: [Virtual machine VmId]

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3587: [Virtual machine VmId] TraceData.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 4000: Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId)

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId). Framework version: Param1; Message version: Param2.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4000: Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId).

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId). Framework version: Param1; Message version: Param2.

Message #

Failed to connect to virtual machine '%1' because there is no mutually supported protocol for VM: (Virtual machine ID %2). Framework version: %3; Message version: %4.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4090: 'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4090: 'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Message #

'%1': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4091: The 'Guest Service Interface' integration service is either not enabled, not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4091: The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Message #

The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4092: 'VmName': The Data Exchange integration service is either not enabled, not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Data Exchange integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4092: 'VmName': The Data Exchange integration service is either not enabled, not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Data Exchange integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Message #

'%1': The Data Exchange integration service is either not enabled, not running or not initialized. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4093: 'VmName': The Volume Shadow Copy integration service is not enabled

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Volume Shadow Copy integration service is not enabled. (Virtual machine VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4093: 'VmName': The Volume Shadow Copy integration service is not enabled.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Volume Shadow Copy integration service is not enabled. (Virtual machine VmId).

Message #

'%1': The Volume Shadow Copy integration service is not enabled. (Virtual machine %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4094: 'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4094: 'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Message #

'%1': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4095: The 'Guest Shutdown' integration service is either not enabled, not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4095: The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Message #

The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4097: 'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic disks in it

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic disks in it.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4097: 'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic disks in it.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has dynamic disks in it.

Message #

'%1': The Virtual machine %2 cannot be hot backed up since it has dynamic disks in it

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4098: 'VmName': The Virtual machine VmId cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4098: 'VmName': The Virtual machine VmId cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes.

Message #

'%1': The Virtual machine %2 cannot be hot backed up since it has one or more volumes with differencing areas located on different volumes

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4099: 'VmName': The Virtual machine VmId cannot be hot backed up since it has non-checkpoint capable volumes in it

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has non-checkpoint capable volumes in it.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4099: 'VmName': The Virtual machine VmId cannot be hot backed up since it has non-checkpoint capable volumes in it.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has non-checkpoint capable volumes in it.

Message #

'%1': The Virtual machine %2 cannot be hot backed up since it has non-checkpoint capable volumes in it

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4100: 'VmName': The Volume Shadow Copy integration service is either not running or not initialized

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Volume Shadow Copy integration service is either not running or not initialized. (Virtual machine VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4100: 'VmName': The Volume Shadow Copy integration service is either not running or not initialized.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Volume Shadow Copy integration service is either not running or not initialized. (Virtual machine VmId).

Message #

'%1': The Volume Shadow Copy integration service is either not running or not initialized. (Virtual machine %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4101: 'VmName': The Virtual machine VmId cannot be hot backed up since it has storage space disks in it

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has storage space disks in it.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4101: 'VmName': The Virtual machine VmId cannot be hot backed up since it has storage space disks in it.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Virtual machine VmId cannot be hot backed up since it has storage space disks in it.

Message #

'%1': The Virtual machine %2 cannot be hot backed up since it has storage space disks in it

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4102: 'VmName': The Virtual machine VmId cannot be hot backed up since its integration components have not been updated

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Virtual machine VmId cannot be hot backed up since its integration components have not been updated. Please update the integration components to enable hot backup of the virtual machine.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4102: 'VmName': The Virtual machine VmId cannot be hot backed up since its integration components have not been updated.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Message #

'%1': The Virtual machine %2 cannot be hot backed up since its integration components have not been updated. Please update the integration components to enable hot backup of the virtual machine

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4130: 'VmName' received a timeout error while applying IP settings on adapter 'Param1'

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName' received a timeout error while applying IP settings on adapter 'Param1'. Check the guest network configuration to verify whether the settings were correctly applied. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4130: 'VmName' received a timeout error while applying IP settings on adapter 'Param1'.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Message #

'%1' received a timeout error while applying IP settings on adapter '%3'. Check the guest network configuration to verify whether the settings were correctly applied. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4132: 'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode)

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode). (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 4132: 'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode).

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to apply IP settings on adapter 'String': ErrorCodeString (ErrorCode). (Virtual machine ID VmId).

Message #

'%1' failed to apply IP settings on adapter '%3': %4 (%5). (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString
`ErrorCodeString` UnicodeString
`ErrorCode` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString

Event ID 4133: 'VmName' successfully applied IP settings on adapter 'String'

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName' successfully applied IP settings on adapter 'String'. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString

Event ID 4133: 'VmName' successfully applied IP settings on adapter 'String'.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' successfully applied IP settings on adapter 'String'. (Virtual machine ID VmId).

Message #

'%1' successfully applied IP settings on adapter '%3'. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`String` UnicodeString

Event ID 4134: 'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Operational

Description

'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4134: 'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context.

Provider: Microsoft-Windows-Hyper-V-Integration
Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The Data Exchange integration service does not support this operation for a VM running in a shielded context. (Virtual machine ID VmId).

Message #

'%1': The Data Exchange integration service does not support this operation for a VM running in a shielded context. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2b74a015-3873-4c56-9928-ea80c58b2787

Defined in vmicvdev.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-Integration registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)