Microsoft-Windows-Hyper-V-VmbusVdev
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1500 | [Virtual machine VmId] | Operational | N | N |
| 1500 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1510 | [Virtual machine VmId] | Operational | N | N |
| 1510 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1520 | [Virtual machine VmId] | Operational | N | N |
| 1520 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 1530 | [Virtual machine VmId] | Operational | N | N |
| 1530 | [Virtual machine VmId] TraceData. | Microsoft-Windows-Hyper-V-Worker-Analytic | N | N |
| 23012 | The virtual machine VmName cannot load device Device because there are no … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
| 23013 | The device Device cannot be loaded because there are no mutually support … | Operational, Microsoft-Windows-Hyper-V-Worker-Admin | N | N |
Event ID 1500: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module UInt16 |
Event ID 1500: [Virtual machine VmId] TraceData.
#Event ID 1510: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module UInt16 |
Event ID 1510: [Virtual machine VmId] TraceData.
#Event ID 1520: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module UInt16 |
Event ID 1520: [Virtual machine VmId] TraceData.
#Event ID 1530: [Virtual machine VmId]
#Description
[Virtual machine ].
Fields #
| Name | Description |
|---|---|
TraceData UnicodeString | |
VmId UnicodeString | |
StackFrameCount UInt32 | |
StackFrame Pointer | |
ModuleCount UInt32 | |
Module UInt16 |
Event ID 1530: [Virtual machine VmId] TraceData.
#Event ID 23012: The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions
#Description
The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Event ID 23013: The device Device cannot be loaded because there are no mutually support protocol versions between the server and client
#Description
The device cannot be loaded because there are no mutually support protocol versions between the server and client.
Fields #
| Name | Description |
|---|---|
VmName UnicodeString | |
VmId UnicodeString | |
Device UnicodeString | |
ServerVersion UnicodeString | |
ClientVersion UnicodeString |
Provenance
ETW provider GUID 177d1599-9764-4e3a-bf9a-c86887aaddce
Defined in VmbusVdev.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB