detection.wiki

Microsoft-Windows-Hyper-V-UiDevices

EventTitleChannelSampleRule
1500[Virtual machine VmId]OperationalNN
1500[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1510[Virtual machine VmId]OperationalNN
1510[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1520[Virtual machine VmId]OperationalNN
1520[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
1530[Virtual machine VmId]OperationalNN
1530[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-AnalyticNN
12460'VmName' could not initialize machine remoting systemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12461Could not initialize machine remoting systemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12480'VmName' failure in machine remoting systemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12481Failure in machine remoting systemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12530'VmName' device Device could not allocate guest physical address spaceOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12531Device Device could not allocate guest physical address spaceOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12540'VmName' device Device experienced a protocol error indicative of a deep system …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12541Device Device experienced a protocol error indicative of a deep system problemOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12550'VmName' device Device found bad data on restoringOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
12551Device Device found bad data on restoringOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32700The Device device on VmName virtual machine experienced an error ErrorCode when …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32701The Device device on VmName virtual machine experienced an error ErrorCode when …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32702The Device device on VmName virtual machine experienced an error ErrorCode when …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32703The Device device on VmName virtual machine experienced a VMBus pipe errorOperationalNN
32703The Device device on VmName virtual machine experienced a VMBus pipe error …Microsoft-Windows-Hyper-V-Worker-AdminNN
32704The Device device on VmName virtual machine experienced an error ErrorCode when …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32705The Device device on VmName virtual machine experienced an error ErrorCode when …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32706The horizontal resolution is below the minimum value of 100Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32707The horizontal resolution is above the maximum value of 7680Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32708The horizontal resolution must be an even numberOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32709The vertical resolution is below the minimum value of 100Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32710The vertical resolution is above the maximum value of 7680Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32711The vertical resolution must be an even numberOperational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32712At least one of horizontal and vertical resolutions must be equal to or larger …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32713At least one of horizontal and vertical resolutions must be equal to or smaller …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32714The resolution type must be Maximum (2), Single (3) or Default (4)Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32715The VmName virtual machine must be turned off when setting resolution type, …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32716The configuration version of VmName virtual machine does not support setting …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32717The configuration version of the virtual machine does not support setting the …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32718HorizontalResolution or VerticalResolution cannot be set when ResolutionType is …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32719The virtual machine VmName cannot load device Device because there are no …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN
32720The device Device cannot be loaded because there are no mutually support …Operational, Microsoft-Windows-Hyper-V-Worker-AdminNN

Event ID 1500: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1500: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530: [Virtual machine VmId]

#
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530: [Virtual machine VmId] TraceData.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 12460: 'VmName' could not initialize machine remoting system

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' could not initialize machine remoting system. Error: 'ErrorCodeString'(ErrorCode). (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString

Event ID 12461: Could not initialize machine remoting system

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Could not initialize machine remoting system. Error: 'ErrorCodeString' (ErrorCode).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString

Event ID 12480: 'VmName' failure in machine remoting system

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failure in machine remoting system. Error: 'ErrorCodeString' (ErrorCode). (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString

Event ID 12481: Failure in machine remoting system

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failure in machine remoting system. Error: 'ErrorCodeString' (ErrorCode).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString

Event ID 12530: 'VmName' device Device could not allocate guest physical address space

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device could not allocate guest physical address space. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12531: Device Device could not allocate guest physical address space

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device could not allocate guest physical address space.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12540: 'VmName' device Device experienced a protocol error indicative of a deep system problem

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device experienced a protocol error indicative of a deep system problem. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12541: Device Device experienced a protocol error indicative of a deep system problem

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device experienced a protocol error indicative of a deep system problem.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12550: 'VmName' device Device found bad data on restoring

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device found bad data on restoring. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12551: Device Device found bad data on restoring

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device found bad data on restoring.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 32700: The Device device on VmName virtual machine experienced an error ErrorCode when sending a VMBus message

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device on virtual machine experienced an error when sending a VMBus message. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32701: The Device device on VmName virtual machine experienced an error ErrorCode when processing an incoming message

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device on virtual machine experienced an error when processing an incoming message. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32702: The Device device on VmName virtual machine experienced an error ErrorCode when completing an outgoing message

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device on virtual machine experienced an error when completing an outgoing message. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32703: The Device device on VmName virtual machine experienced a VMBus pipe error

#
Channel
Operational

Description

The device on virtual machine experienced a VMBus pipe error . (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32703: The Device device on VmName virtual machine experienced a VMBus pipe error ErrorCode.

#
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The Device device on VmName virtual machine experienced a VMBus pipe error ErrorCode. (Virtual machine ID VmId).

Message #

The %3 device on %1 virtual machine experienced a VMBus pipe error %5. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32704: The Device device on VmName virtual machine experienced an error ErrorCode when processing a cursor shape update message

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device on virtual machine experienced an error when processing a cursor shape update message. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32705: The Device device on VmName virtual machine experienced an error ErrorCode when processing a dirty region message

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device on virtual machine experienced an error when processing a dirty region message. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
ContextParam1 UInt32
ContextParam2 UInt32
ContextParam3 UInt32

Event ID 32706: The horizontal resolution is below the minimum value of 100

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32707: The horizontal resolution is above the maximum value of 7680

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32708: The horizontal resolution must be an even number

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32709: The vertical resolution is below the minimum value of 100

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32710: The vertical resolution is above the maximum value of 7680

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32711: The vertical resolution must be an even number

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32712: At least one of horizontal and vertical resolutions must be equal to or larger than 640

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32713: At least one of horizontal and vertical resolutions must be equal to or smaller than 4320

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32714: The resolution type must be Maximum (2), Single (3) or Default (4)

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The resolution type must be Maximum (2), Single (3) or Default (4). Please run 'Get-Help Set-VMVideo -Detailed' for details.

Event ID 32715: The VmName virtual machine must be turned off when setting resolution type, horizontal resolution or vertical resolution

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine must be turned off when setting resolution type, horizontal resolution or vertical resolution. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 32716: The configuration version of VmName virtual machine does not support setting resolution type, horizontal resolution or vertical resolution

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The configuration version of virtual machine does not support setting resolution type, horizontal resolution or vertical resolution. (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 32717: The configuration version of the virtual machine does not support setting the property LockOnDisconnect to non-default value

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32718: HorizontalResolution or VerticalResolution cannot be set when ResolutionType is Default

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 32719: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 32720: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client

#
Channel
Operational, Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Provenance

ETW provider GUID 339aad0a-4124-4968-8147-4cbbb1f8b3d5

Defined in VmUiDevices.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB