Microsoft-Windows-Hyper-V-VMSP

Event	Title	Channel	Sample	Rule
1	[.	Microsoft-Windows-Hyper-V-VMSP-Debug	N	N
1	[VmId] FunctionName -	Operational	N	N
2	[.	Microsoft-Windows-Hyper-V-VMSP-Debug	N	N
2	[VmId] FunctionName -	Operational	N	N
3	[.	Microsoft-Windows-Hyper-V-VMSP-Debug	N	N
3	[VmId] FunctionName -	Operational	N	N
4	VMSP accepted the cached key protector for VM [VmId] because the policy last …	Microsoft-Windows-Hyper-V-VMSP-Admin, Operational	N	N
5	VMSP rejected the cached key protector for VM [VmId] because the policy last …	Microsoft-Windows-Hyper-V-VMSP-Admin, Operational	N	N

Event ID 1: [.

Channel: Microsoft-Windows-Hyper-V-VMSP-Debug

Message #

[%1] %2 - %3

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 1: [VmId] FunctionName -

Channel: Operational

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 2: [.

Channel: Microsoft-Windows-Hyper-V-VMSP-Debug

Message #

[%1] %2 - %3

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 2: [VmId] FunctionName -

Channel: Operational

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 3: [.

Channel: Microsoft-Windows-Hyper-V-VMSP-Debug

Message #

[%1] %2 - %3

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 3: [VmId] FunctionName -

Channel: Operational

Fields #

Name	Description
`VmId` UnicodeString
`FunctionName` UnicodeString
`EventData` UnicodeString

Event ID 4: VMSP accepted the cached key protector for VM [VmId] because the policy last returned by the Host Guardian Service (HGS) permits offline mode

Channel: Microsoft-Windows-Hyper-V-VMSP-Admin, Operational

Message #

VMSP accepted the cached key protector for VM [%1] because the policy last returned by the Host Guardian Service (HGS) permits offline mode.

Fields #

Name	Description
`VmId` UnicodeString

Event ID 5: VMSP rejected the cached key protector for VM [VmId] because the policy last returned by the Host Guardian Service (HGS) does not permit offline mode

Channel: Microsoft-Windows-Hyper-V-VMSP-Admin, Operational

Description

VMSP rejected the cached key protector for VM [] because the policy last returned by the Host Guardian Service (HGS) does not permit offline mode. VM [] cannot be started unless HGS can be reached.

Message #

VMSP rejected the cached key protector for VM [%1] because the policy last returned by the Host Guardian Service (HGS) does not permit offline mode.  VM [%1] cannot be started unless HGS can be reached.

Fields #

Name	Description
`VmId` UnicodeString

Provenance

ETW provider GUID 1ceb22b1-97ff-4703-beb2-333eb89b522a

Defined in vmsp.exe, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB