Microsoft-Windows-Hyper-V-VmSwitch

529 events across 5 channels

Event	Title	Channel	Sample
0	Event ID 0	Microsoft-Windows-Hyper-V-VmSwitch-Operational	Y
1	Failed to open handle to configuration store root due to error	Operational	N
1	Failed to open handle to configuration store root due to error Status.	System	N
2	Failed to restore switch	Operational	N
2	Failed to restore switch.	System	N
3	Failed to register the control device object for the switch due to error	Operational	N
3	Failed to register the control device object for the switch due to error Status.	System	N
4	Failed to initialize VMSwitch driver due to error	Operational	N
4	Failed to initialize VMSwitch driver due to error Status.	System	N
5	Miniport NIC NicName (Friendly Name: NicFName) successfully enabled	Operational	N
5	Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.	System	Y
6	Failed to enable miniport NIC NicName (Friendly Name: NicFName), status =	Operational	N
6	Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = …	System	N
7	Miniport NIC NicName (Friendly Name: NicFName) successfully initialized	Operational	Y
7	Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.	System	Y
8	Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status =	Operational	N
8	Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = …	System	N
9	Switch SwitchName (Friendly Name: SwitchFName) successfully initialized	Operational	Y
9	Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.	System	Y
10	Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = …	Operational	N
10	Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = …	System	Y
11	Failed to update configuration for switch SwitchName (Friendly Name: …	Operational	N
11	Failed to update configuration for switch SwitchName (Friendly Name: …	System	N
12	Failed to update configuration for port PortName (Friendly Name: PortFName) on …	Operational	N
12	Failed to update configuration for port PortName (Friendly Name: PortFName) on …	System	N
13	Failed to update configuration for NIC NicName (Friendly Name: NicFName), status …	Operational	N
13	Failed to update configuration for NIC NicName (Friendly Name: NicFName), status …	System	N
14	Failed to restore configuration for switch SwitchName (Friendly Name: …	Operational	N
14	Failed to restore configuration for switch SwitchName (Friendly Name: …	System	N
15	Failed to restore configuration for port PortName (Friendly Name: PortFName) on …	Operational	N
15	Failed to restore configuration for port PortName (Friendly Name: PortFName) on …	System	N
16	Failed to restore configuration for NIC NicName (Friendly Name: NicFName), …	Operational	N
16	Failed to restore configuration for NIC NicName (Friendly Name: NicFName), …	System	N
17	Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port …	Operational	N
17	Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port …	System	N
18	Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName …	Operational	N
18	Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName …	System	N
19	Protocol NIC NicName (Friendly Name: NicFName) successfully unbound	Operational	N
19	Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.	System	N
20	Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status =	Operational	N
20	Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = …	System	N
21	Media connected on NIC NicName (Friendly Name: NicFName)	Operational	N
21	Media connected on NIC NicName (Friendly Name: NicFName).	System	N
22	Media disconnected on NIC NicName (Friendly Name: NicFName)	Operational	N
22	Media disconnected on NIC NicName (Friendly Name: NicFName).	System	N
23	NIC NicName (Friendly Name: NicFName) is now operational	Operational	N
23	NIC NicName (Friendly Name: NicFName) is now operational.	System	N
24	NIC NicName (Friendly Name: NicFName) is no longer operational	Operational	N
24	NIC NicName (Friendly Name: NicFName) is no longer operational.	System	N
25	The MAC address MacAddress has moved from port Port1Name (Friendly Name: …	Operational	N
25	The MAC address MacAddress has moved from port Port1Name (Friendly Name: …	System	N
26	Cannot load networking driver in VMName because there is no mutually supported …	Operational	N
26	Cannot load networking driver in VMName because there is no mutually supported …	System	N
28	Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address …	Operational	N
28	Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address …	System	N
29	Invalid mac address MacAddress configured for NIC NicName (Friendly Name: …	Operational	N
29	Invalid mac address MacAddress configured for NIC NicName (Friendly Name: …	System	N
30	NIC NicName (Friendly Name: NicFName) was prevented from using MAC address …	Operational	N
30	NIC NicName (Friendly Name: NicFName) was prevented from using MAC address …	System	N
31	The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by …	Operational	N
31	The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by …	System	N
32	Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …	Operational	N
32	Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …	System	N
33	One or more packets were dropped on port PortName (Friendly Name: PortFName) on …	Operational	N
33	One or more packets were dropped on port PortName (Friendly Name: PortFName) on …	System	N
34	Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …	Operational	N
34	Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …	System	N
35	Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …	Operational	N
35	Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName …	System	N
36	A packet was dropped on port PortName (Friendly Name: PortFName) on switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
36	A packet was dropped on port PortName (Friendly Name: PortFName) on switch …	Operational	N
37	An IPsec offload inbound packet with destination IP SwitchName and SPI …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
37	An IPsec offload inbound packet with destination IP SwitchName and SPI …	Operational	N
38	An IPsec offload inbound packet failed crypto on the NIC.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
38	An IPsec offload inbound packet failed crypto on the NIC	Operational	N
39	An IPsec offload outbound packet was dropped.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
39	An IPsec offload outbound packet was dropped	Operational	N
40	An IPsec offload attempt failed.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
40	An IPsec offload attempt failed	Operational	N
41	Failed to query for switch extensions	Operational	N
41	Failed to query for switch extensions.	System	N
42	A forwarding extension is enabled on switch SwitchName (Friendly Name: …	Operational	N
42	A forwarding extension is enabled on switch SwitchName (Friendly Name: …	System	N
43	A forwarding extension was disabled on switch SwitchName (Friendly Name: …	Operational	N
43	A forwarding extension was disabled on switch SwitchName (Friendly Name: …	System	N
44	VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
44	VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from …	Operational	N
45	An IPsec offload packet was dropped because it going to be delivered to multiple …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
45	An IPsec offload packet was dropped because it going to be delivered to multiple …	Operational	N
46	The connected NIC does not support VLAN trunk mode on switch SwitchName …	Operational	N
46	The connected NIC does not support VLAN trunk mode on switch SwitchName …	System	N
47	CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
47	CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped …	Operational	N
48	NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
48	NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= …	Operational	N
49	FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
49	FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime …	Operational	N
50	FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
50	FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= …	Operational	N
51	TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
51	TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime …	Operational	N
52	NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
52	NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested …	Operational	N
53	Qos Packet dropped, reason=DropReason.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
53	Qos Packet dropped, reason=	Operational	N
54	NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
54	NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch …	Operational	N
55	NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
55	NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch …	Operational	N
56	NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
56	NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch …	Operational	N
57	NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
57	NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic …	Operational	N
58	NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
58	NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch …	Operational	N
59	Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
59	Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName …	Operational	N
60	NBLs were dropped by extension ExtensionGuid (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
60	NBLs were dropped by extension ExtensionGuid (Friendly Name: …	Operational	N
61	Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual …	Operational	N
61	Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual …	System	N
62	Switch SwitchName (Friendly Name: SwitchFName) successfully deleted	Operational	N
62	Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.	System	Y
63	Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = …	Operational	N
63	Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = …	System	N
64	Switch SwitchName (Friendly Name: SwitchFName) info successfully set.	Operational	Y
65	Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), …	Operational	N
65	Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), …	System	N
66	Delete complete for Switch SwitchName (Friendly Name: SwitchFName).	Operational	Y
67	Port PortName (Friendly Name: PortFName) successfully created on switch …	Operational	Y
67	Port PortName (Friendly Name: PortFName) successfully created on switch …	System	Y
68	Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …	Operational	N
68	Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName …	System	N
69	Port PortName (Friendly Name: PortFName) successfully deleted - switch …	Operational	Y
69	Port PortName (Friendly Name: PortFName) successfully deleted - switch …	System	Y
70	Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName …	Operational	N
70	Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName …	System	N
71	Delete complete for port PortName (Friendly Name: PortFName).	Operational	Y
71	Delete complete for port PortName (Friendly Name: PortFName).	System	Y
72	Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch …	Operational	N
72	Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch …	System	N
73	Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch …	Operational	N
73	Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch …	System	N
74	Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on …	Operational	N
74	Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on …	System	N
75	The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …	Operational	N
75	The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …	System	N
76	The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …	Operational	N
76	The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …	System	N
77	Failed to disconnect NIC NicName (Friendly Name: NicFName), status =	Operational	N
77	Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status.	System	N
78	Failed to complete operation 'Operation' on port PortName (Friendly Name: …	Operational	N
78	Failed to complete operation 'Operation' on port PortName (Friendly Name: …	System	Y
79	Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
79	Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on …	Operational	N
80	Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …	Operational	N
80	Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …	System	Y
81	Completed operation 'Operation' on switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
81	Completed operation 'Operation' on switch SwitchName (Friendly Name: …	Operational	N
82	Failed to complete bandwidth policy operation 'Operation' on port PortName …	Operational	N
82	Failed to complete bandwidth policy operation 'Operation' on port PortName …	System	Y
83	Completed bandwidth policy operation 'Operation' on port PortName (Friendly …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
83	Completed bandwidth policy operation 'Operation' on port PortName (Friendly …	Operational	N
84	Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) …	Operational	N
84	Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) …	System	N
85	Successfully created default flow on switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
85	Successfully created default flow on switch SwitchName (Friendly Name: …	Operational	N
86	Failed to complete operation 'Operation' on port PortName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
86	Failed to complete operation 'Operation' on port PortName (Friendly Name: …	Operational	N
87	The connected Nic NicName (Friendly Name: NicFName) does not support VLAN …	Operational	N
87	The connected Nic NicName (Friendly Name: NicFName) does not support VLAN …	System	N
88	Failed to complete security policy operation on port PortName (Friendly Name: …	Operational	N
88	Failed to complete security policy operation on port PortName (Friendly Name: …	System	N
89	Completed security policy operation on port PortName (Friendly Name: PortFName) …	Operational	Y
90	Failed to complete Port ACL policy operation on port PortName (Friendly Name: …	Operational	N
90	Failed to complete Port ACL policy operation on port PortName (Friendly Name: …	System	N
91	Completed Port ACL policy operation on port PortName (Friendly Name: PortFName) …	Operational	Y
92	A switch extension blocked the operation 'Operation' on port PortName (Friendly …	Operational	N
92	A switch extension blocked the operation 'Operation' on port PortName (Friendly …	System	N
93	A switch extension blocked the operation 'Operation' on switch SwitchName …	Operational	N
93	A switch extension blocked the operation 'Operation' on switch SwitchName …	System	N
94	Failed to complete offload policy operation on port PortName (Friendly Name: …	Operational	N
94	Failed to complete offload policy operation on port PortName (Friendly Name: …	System	N
95	The VLAN configuration being set on port PortName (Friendly Name: PortFName) on …	Operational	N
95	The VLAN configuration being set on port PortName (Friendly Name: PortFName) on …	System	N
96	VLAN tagging is configured on port PortName (Friendly Name: PortFName), …	Operational	N
96	VLAN tagging is configured on port PortName (Friendly Name: PortFName), …	System	N
97	Failed to retrieve the active extension list from switch SwitchName (Friendly …	Operational	N
97	Failed to retrieve the active extension list from switch SwitchName (Friendly …	System	N
98	Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …	Operational	N
98	Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …	System	N
99	Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …	Operational	N
99	Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port …	System	N
100	Failed to complete bandwidth policy operation 'Operation' on switch SwitchName …	Operational	N
100	Failed to complete bandwidth policy operation 'Operation' on switch SwitchName …	System	Y
101	Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
101	Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly …	Operational	N
102	Networking driver in VMName is loaded and the protocol version is negotiated to …	Operational	N
102	Networking driver in VMName is loaded and the protocol version is negotiated to …	System	Y
103	Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
103	Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: …	Operational	N
104	The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
104	The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), …	Operational	N
105	The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
105	The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on …	Operational	N
106	Available processor sets of the underlying physical NICs belonging to the LBFO …	Operational	N
106	Available processor sets of the underlying physical NICs belonging to the LBFO …	System	N
107	DataOidTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
107	Event ID 107	Operational	N
108	DataOidTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
108	Event ID 108	Operational	N
109	DataOidTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
109	Event ID 109	Operational	N
110	DataOidTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
110	Event ID 110	Operational	N
111	StatusTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
111	Event ID 111	Operational	N
112	StatusTarget.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
112	Event ID 112	Operational	N
113	Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …	Operational	N
113	Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …	System	N
114	Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
114	Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch …	Operational	N
115	Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch …	Operational	N
116	Switch Team member connected.	Operational	N
117	Switch Team member disconnected.	Operational	N
118	The external NIC NicName (Friendly Name: NicFName) on switch SwitchName …	Operational	N
119	Port PortName (Friendly Name: PortFName) has security conflict with the …	Operational	N
119	Port PortName (Friendly Name: PortFName) has MAC address spoofing enabled.	System	N
120	The configured bandwidth reservation might not be applied on switch SwitchName …	Operational	N
120	The configured bandwidth reservation might not be applied on switch SwitchName …	System	N
121	An extension is attempting to revoke the VF allocated for Port PortName …	Operational	N
121	An extension is attempting to revoke the VF allocated for Port PortName …	System	N
122	VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch …	Operational	N
122	VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch …	System	N
123	VMQ capabilities received from NIC NicName (Friendly Name: NicFName): …	Operational	N
124	NIC NicName (Friendly Name: NicFName) restarted.	Operational	Y
125	Media connected on NIC NicName (Friendly Name: NicFName).	Operational	Y
126	Media disconnected on NIC NicName (Friendly Name: NicFName).	Operational	Y
127	The Isolation configuration could not be deleted from port PortName (Friendly …	Operational	N
127	The Isolation configuration could not be deleted from port PortName (Friendly …	System	N
128	The Isolation configuration set on port PortName (Friendly Name: PortFName) on …	Operational	N
128	The Isolation configuration set on port PortName (Friendly Name: PortFName) on …	System	N
129	The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: …	Operational	N
129	The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: …	System	N
130	Failed to complete Extended Port ACL policy operation on port PortName (Friendly …	Operational	N
130	Failed to complete Extended Port ACL policy operation on port PortName (Friendly …	System	N
131	A packet was dropped on port PortName (Friendly Name: PortFName) on switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
131	A packet was dropped on port PortName (Friendly Name: PortFName) on switch …	Operational	N
132	The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to …	Operational	N
132	The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to …	System	N
133	RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
133	RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: …	Operational	N
134	VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
134	VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a …	Operational	N
135	Processor ProcIndex is over ProcUtil percent.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
135	Processor ProcIndex is over ProcUtil percent	Operational	N
136	Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
136	Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …	Operational	N
137	Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
137	Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch …	Operational	N
138	Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
138	Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) …	Operational	N
139	Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
139	Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: …	Operational	N
140	Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
140	Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch …	Operational	N
141	The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
141	The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: …	Operational	N
142	Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) …	Operational	N
143	Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: …	Operational	Y
144	Driver Verifier failure in vmswitch.	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
144	Driver Verifier failure in vmswitch	Operational	N
145	Policy configuration failed.	Operational	N
146	Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: …	Operational	N
146	Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: …	System	N
147	Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: …	Operational	N
147	Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: …	System	N
148	Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf …	Operational	Y
149	Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: …	Operational	N
149	Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: …	System	N
150	Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on …	Operational	N
150	Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on …	System	N
151	Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName …	Operational	N
151	Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName …	System	N
152	Replacing Member OldMember with new Member NewMember for load balancing.	Operational	N
153	Excluding Member Member from load balancing.	Operational	N
154	Using Member Member for load balancing.	Operational	N
155	Starting ConnectTimer for Member Member.	Operational	N
156	Stopping to use Member Member for load balancing.	Operational	N
157	Priming Switch for TeamNic TeamNic using Member Member.	Operational	N
158	Failing NBL send on Member Member.	Operational	N
159	Failing NBL send on TeamNic TeamNic.	Operational	N
160	Dropping NBLs on Member Member.	Operational	N
161	DriverEntry exiting, Status = Status.	Operational	N
162	Member Member created.	Operational	N
163	Aggregator Aggregator created.	Operational	N
164	Member Member placed in Team TeamNic, Status = Status.	Operational	N
165	Indicating new link state for TeamNic TeamNic.	Operational	N
166	Default Aggregator for TeamNic TeamNic changed to Receiver.	Operational	N
167	BroadcastReceiver for TeamNic TeamNic changed to Receiver.	Operational	N
168	Initializing TeamNic TeamNic, Status = Status.	Operational	N
169	Removing Aggregator Aggregator from TeamNic TeamNic.	Operational	N
170	Removed Member Member from TeamNic TeamNic.	Operational	N
171	Removing TeamNic TeamNic.	Operational	N
172	MsLbfoProvider driver is unloading.	Operational	N
173	Changing Aggregator for Member Member from OldAggregator to NewAggregator.	Operational	N
174	LACP Initializing for Member Member, Status = Status.	Operational	N
175	LACP de-initialized for Member Member.	Operational	N
176	Received LACPDU on Member Member.	Operational	N
177	LBFO LACP Member Member; ReceiveMachine: OldState->NewState.	Operational	N
178	LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.	Operational	N
179	LBFO LACP Member Member; Mux Machine: OldState->NewState.	Operational	N
180	Sending LACPDU on Member Member.	Operational	N
181	LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.	Operational	N
182	LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: …	Operational	N
183	LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.	Operational	N
184	Member Nic Member Connected	Operational	N
184	Member Nic Member Connected.	System	N
185	Member Nic Member Disconnected	Operational	N
185	Member Nic Member Disconnected.	System	N
186	Connection Timer Started for Member Nic	Operational	N
186	Connection Timer Started for Member Nic Member.	System	N
187	LACP Churn detected on Member Nic	Operational	N
187	LACP Churn detected on Member Nic Member.	System	N
188	Use of Vlan detected on non-default Team Nic	Operational	N
188	Use of Vlan detected on non-default Team Nic Member.	System	N
189	MAC conflict: A port on the virtual switch has the same MAC as one of the …	Operational	N
189	MAC conflict: A port on the virtual switch has the same MAC as one of the …	System	N
190	Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: …	Operational	N
190	Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: …	System	N
191	Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: …	Operational	N
191	Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: …	System	N
192	Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS …	Operational	N
192	Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS …	System	N
193	Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS …	Operational	N
193	Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS …	System	N
194	Operation operation failed for NIC NicName (Friendly Name: NicFName).	Operational	N
195	Switch Extension Operation operation failed for NIC NicName (Friendly Name: …	Operational	N
196	Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: …	Operational	N
197	Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: …	Operational	N
197	Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: …	System	N
198	VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).	Operational	N
199	VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).	Operational	N
200	Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: …	Operational	N
201	VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
201	VMQ is disabled on the external NIC NicName (Friendly Name: NicFName)	Operational	N
202	Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new …	Operational	N
202	Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new …	System	N
203	Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new …	Operational	N
203	Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new …	System	N
204	Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN …	Operational	N
204	Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN …	System	N
205	Failed to move filter FilterId from vPort SrcVPortId to vPort	Operational	N
205	Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId.	System	N
206	Initialization of switch embedded team succeeded	Operational	N
206	Initialization of switch embedded team succeeded.	System	N
207	Initialization of switch embedded team failed	Operational	N
207	Initialization of switch embedded team failed.	System	N
208	Pause of switch embedded team succeeded	Operational	N
208	Pause of switch embedded team succeeded.	System	N
209	Initialization of switch embedded team failed	Operational	N
209	Initialization of switch embedded team failed.	System	N
210	Switch embedded team is pre-detached	Operational	N
210	Switch embedded team is pre-detached.	System	N
211	Switch embedded team is completely detached	Operational	N
211	Switch embedded team is completely detached.	System	N
212	NIC was successfully added to the switch embedded team	Operational	N
212	NIC was successfully added to the switch embedded team.	System	N
213	NIC failed to be addeded to the switch embedded team	Operational	N
213	NIC failed to be addeded to the switch embedded team.	System	N
214	NIC was removed from the switch embedded team	Operational	N
214	NIC was removed from the switch embedded team.	System	N
215	Failed to clear filter FilterId on vPort	Operational	N
215	Failed to clear filter FilterId on vPort vPortId.	System	N
216	Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on …	Operational	N
216	Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on …	System	N
217	External NIC sent NDK PnP event but it failed to reach all miniports.	Operational	N
218	NIC NicName (Friendly Name: NicFName) queried isolation information on port …	Operational	N
219	NIC NicName (Friendly Name: NicFName) queried isolation information on port …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
219	NIC NicName (Friendly Name: NicFName) queried isolation information on port …	Operational	N
220	Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port …	Operational	Y
221	Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
221	Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port …	Operational	N
222	Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	N
222	Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port …	Operational	N
223	Rundown: Switch SwitchName (Friendly Name: SwitchFName).	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	Y
223	Rundown: Switch SwitchName (Friendly Name: SwitchFName)	Operational	N
224	Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic	Y
224	Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly …	Operational	N
225	Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: …	Operational	N
226	Virtual RSS configuration initialization succeeded on NIC NicName (Friendly …	Operational	N
227	Failed to complete offload policy operation 'Operation' on switch SwitchName …	Operational	N
227	Failed to complete offload policy operation 'Operation' on switch SwitchName …	System	N
228	Completed offload policy operation 'Operation' on switch SwitchName (Friendly …	Operational	N
229	Syncing TCP offloads for switch embedded teaming failed	Operational	N
229	Syncing TCP offloads for switch embedded teaming failed.	System	N
230	Syncing TCP offloads for switch embedded teaming succeeded	Operational	N
230	Syncing TCP offloads for switch embedded teaming succeeded.	System	N
231	A potentially looped back packet with MAC MacAddress was indicated to physical …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
231	A potentially looped back packet with MAC MacAddress was indicated to physical …	Operational	N
232	NIC NicName (Friendly Name: NicFName) successfully connected to port PortName …	Operational	Y
232	NIC NicName (Friendly Name: NicFName) successfully connected to port PortName …	System	Y
233	The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), …	Operational	Y
233	The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), …	System	Y
234	NIC NicName successfully disconnected from port	Operational	N
234	NIC NicName successfully disconnected from port PortName.	System	Y
235	NIC NicName disconnect from port PortName failed	Operational	N
235	NIC NicName disconnect from port PortName failed.	System	N
236	Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), …	Operational	N
236	Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), …	System	N
237	Failed to enable Packet Direct for switch	Operational	N
237	Failed to enable Packet Direct for switch SwitchFName.	System	N
238	Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: …	Operational	N
238	Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: …	System	N
239	Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: …	Operational	N
239	Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: …	System	N
240	PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
240	PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in …	Operational	N
241	PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
241	PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in …	Operational	N
242	PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) …	Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic	N
242	PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) …	Operational	N
243	Insufficient number of available MAC address filters for configuring …	Operational	N
243	Insufficient number of available MAC address filters for configuring …	System	N
244	Insufficient number of available MAC address filters for configuring …	Operational	N
244	Insufficient number of available MAC address filters for configuring …	System	N
245	Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN …	Operational	N
246	Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId.	Operational	N
247	Successfully cleared filter FilterId on vPort vPortId.	Operational	N
248	Send spreading was successfully enabled on NIC NicName (Friendly Name: …	Operational	N
249	The system is not ready to enable send spreading on NIC NicName (Friendly Name: …	Operational	N
250	Send spreading on NIC NicName (Friendly Name: NicFName) is not supported.	Operational	N
251	Failed to enable send spreading on NIC NicName (Friendly Name: NicFName).	Operational	N
252	Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch …	System	N
253	Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch …	System	N
254	Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: …	Operational	N
254	Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: …	System	N
255	Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) …	Operational	N
256	Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) …	Operational	N
256	Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) …	System	N
257	Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) …	Operational	N
257	Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) …	System	N
258	Failed to get stored VlanID for Physical NIC	Operational	N
258	Failed to get stored VlanID for Physical NIC NicName.	System	N
259	Underlying network adapter failed to execute critical OID request	Operational	N
259	Underlying network adapter failed to execute critical OID request.	System	N
260	Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …	Operational	N
260	Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName …	System	N
261	Failed to complete performance policy operation 'Operation' on switch SwitchName …	Operational	N
261	Failed to complete performance policy operation 'Operation' on switch SwitchName …	System	N
262	Completed performance policy operation 'Operation' on switch SwitchName …	Operational	N
263	Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC …	Operational	N
263	Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC …	System	N
264	Internal or External Port PortName (Friendly Name: PortFName) successfully …	Operational	Y
264	Internal or External Port PortName (Friendly Name: PortFName) successfully …	System	Y
265	Traffic flow has been paused on external NIC NicFName of switch	Operational	N
265	Traffic flow has been paused on external NIC NicFName of switch SwitchFName.	System	N
266	Traffic flow has been restarted on external NIC NicFName of switch	Operational	N
266	Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.	System	N
267	IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms	Operational	N
267	IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.	System	N
268	Connectivity state changed to	Operational	N
268	Connectivity state changed to ConnectivityState.	System	N
269	Failed to get Device VlanID Regkey for Physical NIC	Operational	N
269	Failed to get Device VlanID Regkey for Physical NIC NicName.	System	N
270	Traffic flow is pausing on external NIC NicFName of switch	Operational	N
270	Traffic flow is pausing on external NIC NicFName of switch SwitchFName.	System	N
275	Failed to handle status from extension stack sent to Nic NicName (Friendly Name: …	Operational	N
276	Could not allocate virtual function for NIC NicName (Friendly Name: NicFName)	Operational	N
276	Could not allocate virtual function for NIC NicName (Friendly Name: NicFName).	System	N
277	vmswitch	Operational	Y
277	vmswitch.	System	Y
278	NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled …	Operational	N
278	NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled …	System	N
279	NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled …	Operational	N
279	NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled …	System	N
280	VMS Utilization Plan Vport QueuePairs adjusted from requested number …	Operational	N
280	VMS Utilization Plan Vport QueuePairs adjusted from requested number …	System	N
281	VMS Utilization Plan Vport QueuePairs failure	Operational	N
281	VMS Utilization Plan Vport QueuePairs failure.	System	N
282	Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName)	Operational	N
282	Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName).	System	N
283	Failed to complete extension policy operation 'FailReason' on switch SwitchName …	Operational	N
283	Failed to complete extension policy operation 'FailReason' on switch SwitchName …	System	N
284	Completed extension policy operation 'RequiredExtensionCount' on switch …	Operational	N
285	V-Switch operation OperationName (OperationId) took too long to complete.	Microsoft-Windows-Hyper-V-VmSwitch-Operational	Y
286	Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName …	Operational	N
286	Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName …	System	N
287	Extending disable logging for event(s) LogRateLimitEventId of NIC NicName …	Operational	N
287	Extending disable logging for event(s) LogRateLimitEventId of NIC NicName …	System	N
288	Virtual function for NIC NicName (Friendly Name: NicFName) successfully …	Operational	N
288	Virtual function for NIC NicName (Friendly Name: NicFName) successfully …	System	N
289	Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status …	Operational	N
289	Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status …	System	N
290	Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded	Operational	N
290	Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded.	System	N
291	RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: …	Operational	Y
291	RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: …	System	Y
292	RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: …	Operational	Y
292	RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: …	System	Y
293	VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName)	Operational	N
293	VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName).	System	N
294	Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port …	Operational	N
294	Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port …	System	N
295	No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName …	Operational	N
295	No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName …	System	N
296	NIC Switch creation failed on the first member adapter SwitchName (Friendly …	Operational	N
296	NIC Switch creation failed on the first member adapter SwitchName (Friendly …	System	N
297	NIC Switch creation failed on the member adapter SwitchName (Friendly Name: …	Operational	N
297	NIC Switch creation failed on the member adapter SwitchName (Friendly Name: …	System	N
298	NIC Switch appears to be not supported on the first member adapter SwitchName …	Operational	N
298	NIC Switch appears to be not supported on the first member adapter SwitchName …	System	N
299	NIC Switch appears to be not supported on this member adapter SwitchName …	Operational	N
299	NIC Switch appears to be not supported on this member adapter SwitchName …	System	N
300	Nic Switch assymetric capabilities or configuration detected between the first …	Operational	N
300	Nic Switch assymetric capabilities or configuration detected between the first …	System	N
301	Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new …	Operational	N
301	Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new …	System	N
302	Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: …	Operational	N
302	Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: …	System	N
303	Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch …	Operational	N
303	Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch …	System	N
304	Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = …	Operational	N
304	Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = …	System	N
305	Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, …	Operational	N
305	Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, …	System	N
306	WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, …	Operational	N
306	WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, …	System	N

Event ID 0

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Operational
Level: Informational

Fields #

Name	Description
`Name`
`netPnpEvent`
`switchName_Length`
`switchName`
`switchFriendlyName_Length`
`switchFriendlyName`
`delta (100 ns)`
`Status`	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 0,
    "time_created": "2023-11-06T06:25:41.500585+00:00",
    "event_record_id": 31,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 228
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "ExtProtocol NetPnpEvent End",
    "netPnpEvent": "NetEventBindsComplete",
    "switchName_Length": 0,
    "switchName": "",
    "switchFriendlyName_Length": 0,
    "switchFriendlyName": "",
    "delta (100 ns)": 40,
    "Status": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1: Failed to open handle to configuration store root due to error

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: ConfigStoreInitialize

Description

Failed to open handle to configuration store root due to error.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 1: Failed to open handle to configuration store root due to error Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: ConfigStoreInitialize

Description

Failed to open handle to configuration store root due to error Status.

Message #

Failed to open handle to configuration store root due to error %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 2: Failed to restore switch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: ConfigStoreInitialize

Description

Failed to restore switch. The switch name in the configuration store is corrupted.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 2: Failed to restore switch.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: ConfigStoreInitialize

Description

Failed to restore switch. The switch name in the configuration store is corrupted.

Message #

Failed to restore switch. The switch name in the configuration store is corrupted.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: Failed to register the control device object for the switch due to error

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: DriverInit

Description

Failed to register the control device object for the switch due to error .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: Failed to register the control device object for the switch due to error Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: DriverInit

Description

Failed to register the control device object for the switch due to error Status.

Message #

Failed to register the control device object for the switch due to error %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4: Failed to initialize VMSwitch driver due to error

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: DriverInit

Description

Failed to initialize VMSwitch driver due to error .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 4: Failed to initialize VMSwitch driver due to error Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: DriverInit

Description

Failed to initialize VMSwitch driver due to error Status.

Message #

Failed to initialize VMSwitch driver due to error %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 5: Miniport NIC NicName (Friendly Name: NicFName) successfully enabled

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: EnableNIC

Description

Miniport NIC (Friendly Name: ) successfully enabled.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 5: Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Task: EnableNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) successfully enabled.

Message #

Miniport NIC %2 (Friendly Name: %4) successfully enabled

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 5,
    "version": 0,
    "level": 4,
    "task": 1003,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-13T20:24:29.667692+00:00",
    "event_record_id": 2176,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 408
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFNameLen": 1,
    "NicFName": ""
  },
  "message": ""
}

Event ID 6: Failed to enable miniport NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: EnableNIC

Description

Failed to enable miniport NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 6: Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: EnableNIC

Description

Failed to enable miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to enable miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 7: Miniport NIC NicName (Friendly Name: NicFName) successfully initialized

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4
Task: InitializeNIC

Description

Miniport NIC (Friendly Name: ) successfully initialized.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 7,
    "level": 4,
    "task": 1004,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.4303156+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "NicFNameLen": "14",
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicNameLen": "36",
    "NicFName": "Default Switch"
  }
}

Event ID 7: Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Task: InitializeNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) successfully initialized.

Message #

Miniport NIC %2 (Friendly Name: %4) successfully initialized.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 7,
    "version": 0,
    "level": 4,
    "task": 1004,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.198098+00:00",
    "event_record_id": 2813,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 8: Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeNIC

Description

Failed to initialize miniport NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 8: Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializeNIC

Description

Failed to initialize miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to initialize miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 9: Switch SwitchName (Friendly Name: SwitchFName) successfully initialized

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4
Task: InitializeSwitch

Description

Switch (Friendly Name: ) successfully initialized.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 9,
    "level": 4,
    "task": 1005,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.1199253+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "SwitchFName": "Default Switch",
    "SwitchNameLen": "36",
    "SwitchFNameLen": "14",
    "Flags": "32",
    "OwnerService": "1",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444"
  }
}

Event ID 9: Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Task: InitializeSwitch

Description

Switch SwitchName (Friendly Name: SwitchFName) successfully initialized.

Message #

Switch %2 (Friendly Name: %4) successfully initialized.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 1005,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:01.748463+00:00",
    "event_record_id": 2810,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 32,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 10: Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeSwitch

Description

Failed to initialize switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 10: Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Error
Task: InitializeSwitch

Description

Failed to initialize switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to initialize switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 2,
    "task": 1005,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-14T01:40:09.154839+00:00",
    "event_record_id": 2491,
    "correlation": {},
    "execution": {
      "process_id": 2476,
      "thread_id": 2776
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": 3221225525,
    "SwitchNameLen": 36,
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFNameLen": 14,
    "SwitchFName": "Default Switch",
    "UniqueEvent": 50
  },
  "message": ""
}

Event ID 11: Failed to update configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: StoreSwitch

Description

Failed to update configuration for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 11: Failed to update configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: StoreSwitch

Description

Failed to update configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 12: Failed to update configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: StorePort

Description

Failed to update configuration for port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 12: Failed to update configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: StorePort

Description

Failed to update configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9), status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 13: Failed to update configuration for NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: StoreNic

Description

Failed to update configuration for NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 13: Failed to update configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: StoreNic

Description

Failed to update configuration for NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update configuration for NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 14: Failed to restore configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: RestoreSwitch

Description

Failed to restore configuration for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 14: Failed to restore configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: RestoreSwitch

Description

Failed to restore configuration for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to restore configuration for switch %3 (Friendly Name: %5),  status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 15: Failed to restore configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: RestorePort

Description

Failed to restore configuration for port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 15: Failed to restore configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: RestorePort

Description

Failed to restore configuration for port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to restore configuration for port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9), status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 16: Failed to restore configuration for NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: RestoreNic

Description

Failed to restore configuration for NIC (Friendly Name: ), status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 16: Failed to restore configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: RestoreNic

Description

Failed to restore configuration for NIC NicName (Friendly Name: NicFName), status = Status.

Message #

Failed to restore configuration for NIC %3 (Friendly Name: %5), status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 17: Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: BindProtocolNic

Description

Protocol NIC (Friendly Name: ) successfully bound to port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 17: Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: BindProtocolNic

Description

Protocol NIC NicName (Friendly Name: NicFName) successfully bound to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Message #

Protocol NIC %2 (Friendly Name: %4) successfully bound to port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 18: Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: BindProtocolNic

Description

Failed to bind protocol NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 18: Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: BindProtocolNic

Description

Failed to bind protocol NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to bind protocol NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13), status = %1. UniqueEvent = %14.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 19: Protocol NIC NicName (Friendly Name: NicFName) successfully unbound

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: UnbindProtocolNic

Description

Protocol NIC (Friendly Name: ) successfully unbound.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 19: Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: UnbindProtocolNic

Description

Protocol NIC NicName (Friendly Name: NicFName) successfully unbound.

Message #

Protocol NIC %2 (Friendly Name: %4) successfully unbound.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 20: Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: UnbindProtocolNic

Description

Failed to unbind protocol NIC (Friendly Name: ), status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 20: Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: UnbindProtocolNic

Description

Failed to unbind protocol NIC NicName (Friendly Name: NicFName), status = Status.

Message #

Failed to unbind protocol NIC %3 (Friendly Name: %5), status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 21: Media connected on NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: ConnectMedia

Description

Media connected on NIC (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 21: Media connected on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: ConnectMedia

Description

Media connected on NIC NicName (Friendly Name: NicFName).

Message #

Media connected on NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 22: Media disconnected on NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: DisconnectMedia

Description

Media disconnected on NIC (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 22: Media disconnected on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: DisconnectMedia

Description

Media disconnected on NIC NicName (Friendly Name: NicFName).

Message #

Media disconnected on NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 23: NIC NicName (Friendly Name: NicFName) is now operational

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: NicOperational

Description

NIC (Friendly Name: ) is now operational.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 23: NIC NicName (Friendly Name: NicFName) is now operational.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: NicOperational

Description

NIC NicName (Friendly Name: NicFName) is now operational.

Message #

NIC %2 (Friendly Name: %4) is now operational.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 24: NIC NicName (Friendly Name: NicFName) is no longer operational

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: NicNonOperational

Description

NIC (Friendly Name: ) is no longer operational.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 24: NIC NicName (Friendly Name: NicFName) is no longer operational.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: NicNonOperational

Description

NIC NicName (Friendly Name: NicFName) is no longer operational.

Message #

NIC %2 (Friendly Name: %4) is no longer operational.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 25: The MAC address MacAddress has moved from port Port1Name (Friendly Name: Port1FName) to port Port2Name (Friendly Name: Port2FName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: MacChange

Description

The MAC address has moved from port (Friendly Name: ) to port (Friendly Name: ).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`Port1NameLen` UInt32
`Port1Name` UnicodeString
`Port1FNameLen` UInt32
`Port1FName` UnicodeString
`Port2NameLen` UInt32
`Port2Name` UnicodeString
`Port2FNameLen` UInt32
`Port2FName` UnicodeString

Event ID 25: The MAC address MacAddress has moved from port Port1Name (Friendly Name: Port1FName) to port Port2Name (Friendly Name: Port2FName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: MacChange

Description

The MAC address MacAddress has moved from port Port1Name (Friendly Name: Port1FName) to port Port2Name (Friendly Name: Port2FName).

Message #

The MAC address %2 has moved from port %4 (Friendly Name: %6) to port %8 (Friendly Name: %10).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`Port1NameLen` UInt32
`Port1Name` UnicodeString
`Port1FNameLen` UInt32
`Port1FName` UnicodeString
`Port2NameLen` UInt32
`Port2Name` UnicodeString
`Port2FNameLen` UInt32
`Port2FName` UnicodeString

Event ID 26: Cannot load networking driver in VMName because there is no mutually supported protocol

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: ProtocolVersionNegotiate

Description

Cannot load networking driver in because there is no mutually supported protocol. Server version Client version (Virtual machine ID ).

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString
`ServerVersionLen` UInt32
`ServerVersion` UnicodeString
`ClientVersionLen` UInt32
`ClientVersion` UnicodeString

Event ID 26: Cannot load networking driver in VMName because there is no mutually supported protocol.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: ProtocolVersionNegotiate

Description

Cannot load networking driver in VMName because there is no mutually supported protocol. Server version ServerVersion Client version ClientVersion (Virtual machine ID VMId).

Message #

Cannot load networking driver in %2 because there is no mutually supported protocol.  Server version %6  Client version %8 (Virtual machine ID %4).

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString
`ServerVersionLen` UInt32
`ServerVersion` UnicodeString
`ClientVersionLen` UInt32
`ClientVersion` UnicodeString

Event ID 28: Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address MacAddress because it is pinned to port Port1Name (Friendly Name: Port1FName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: MacRelearn

Description

Port (Friendly Name: ) was prevented from using MAC address because it is pinned to port (Friendly Name: ).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`Port1NameLen` UInt32
`Port1Name` UnicodeString
`Port1FNameLen` UInt32
`Port1FName` UnicodeString
`Port2NameLen` UInt32
`Port2Name` UnicodeString
`Port2FNameLen` UInt32
`Port2FName` UnicodeString

Event ID 28: Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address MacAddress because it is pinned to port Port1Name (Friendly Name: Port1FName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: MacRelearn

Description

Port Port2Name (Friendly Name: Port2FName) was prevented from using MAC address MacAddress because it is pinned to port Port1Name (Friendly Name: Port1FName).

Message #

Port %8 (Friendly Name: %10) was prevented from using MAC address %2 because it is pinned to port %4 (Friendly Name: %6).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`Port1NameLen` UInt32
`Port1Name` UnicodeString
`Port1FNameLen` UInt32
`Port1FName` UnicodeString
`Port2NameLen` UInt32
`Port2Name` UnicodeString
`Port2FNameLen` UInt32
`Port2FName` UnicodeString

Event ID 29: Invalid mac address MacAddress configured for NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: MacConfig

Description

Invalid mac address configured for NIC (Friendly Name: ).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 29: Invalid mac address MacAddress configured for NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: MacConfig

Description

Invalid mac address MacAddress configured for NIC NicName (Friendly Name: NicFName).

Message #

Invalid mac address %2 configured for NIC %4 (Friendly Name: %6).

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 30: NIC NicName (Friendly Name: NicFName) was prevented from using MAC address MacAddress because it is connected to a port that does not allow mac spoofing

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: MacConfig

Description

NIC (Friendly Name: ) was prevented from using MAC address because it is connected to a port that does not allow mac spoofing.

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 30: NIC NicName (Friendly Name: NicFName) was prevented from using MAC address MacAddress because it is connected to a port that does not allow mac spoofing.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: MacConfig

Description

NIC NicName (Friendly Name: NicFName) was prevented from using MAC address MacAddress because it is connected to a port that does not allow mac spoofing.

Message #

NIC %4 (Friendly Name: %6) was prevented from using MAC address %2 because it is connected to a port that does not allow mac spoofing.

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 31: The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by the VM to

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: MacConfig

Description

The mac address for NIC (Friendly Name: ) has been overridden by the VM to .

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 31: The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by the VM to MacAddress.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: MacConfig

Description

The mac address for NIC NicName (Friendly Name: NicFName) has been overridden by the VM to MacAddress.

Message #

The mac address for NIC %4 (Friendly Name: %6) has been overridden by the VM to %2.

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 32: Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 32: Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: NicConnect

Description

Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to connect NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13), status = %1. UniqueEvent = %14.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 33: One or more packets were dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet contained spoofed IP address

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

One or more packets were dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet contained spoofed IP address. Connected NIC is (Friendly Name: )on VM .

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 33: One or more packets were dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet contained spoofed IP address.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: PktDrop

Description

One or more packets were dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet contained spoofed IP address. Connected NIC is NicName (Friendly Name: NicFName)on VM VMName.

Message #

One or more packets were dropped on port %8 (Friendly Name: %10) on switch %12 (Friendly Name: %14) because the packet contained spoofed IP address. Connected NIC is %4  (Friendly Name: %6)on VM %2.

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 34: Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: CreatePort

Description

Failed to create port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 34: Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: CreatePort

Description

Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to create port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 35: Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 35: Failed to connect NIC NicName (Friendly Name: NicFName) to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: NicConnect

Description

Failed to connect NIC (Friendly Name: ) to port (Friendly Name: ) on switch (Friendly Name: ). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = .

Message #

Failed to connect NIC %3 (Friendly Name: %5) to port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13). The task was vetoed by a switch extension, or the switch extension stack is corrupted. Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 36: A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Port ACL entry AclName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Port ACL entry AclName.

Message #

A packet was dropped on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) because the packet is filtered by Port ACL entry %10.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`AclNameLen` UInt32
`AclName` UnicodeString

Event ID 36: A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Port ACL entry

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

A packet was dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet is filtered by Port ACL entry .

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`AclNameLen` UInt32
`AclName` UnicodeString

Event ID 37: An IPsec offload inbound packet with destination IP SwitchName and SPI SwitchFNameLen destined to port PortName (Friendly Name: PortFName);on switch PortFName (Friendly Name: SwitchName) was drop...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

An IPsec offload inbound packet with destination IP SwitchName and SPI SwitchFNameLen destined to port PortName (Friendly Name: PortFName);on switch PortFName (Friendly Name: SwitchName) was dropped. Reason: IpsecOffloadInboundDropReason.

Message #

An IPsec offload inbound packet with destination IP %7 and SPI %8 destined to port %3 (Friendly Name: %5);on switch %5 (Friendly Name: %7) was dropped. Reason: %1

Fields #

Name	Description
`IpsecOffloadInboundDropReason` UInt32
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DestAddressLen` UInt32
`DestAddress` UnicodeString
`SPI` UInt32

Event ID 37: An IPsec offload inbound packet with destination IP SwitchName and SPI SwitchFNameLen destined to port PortName (Friendly Name: PortFName);on switch PortFName (Friendly Name: SwitchName) was dropped

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

An IPsec offload inbound packet with destination IP and SPI destined to port (Friendly Name: );on switch (Friendly Name: ) was dropped. Reason.

Fields #

Name	Description
`IpsecOffloadInboundDropReason` UInt32
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DestAddressLen` UInt32
`DestAddress` UnicodeString
`SPI` UInt32

Event ID 38: An IPsec offload inbound packet failed crypto on the NIC.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Message #

An IPsec offload inbound packet failed crypto on the NIC. Destination IP address: %10, SPI: %11, port %2 (Friendly Name: %4), switch %6 (Friendly Name: %8) This may be a DoS attack since the IP and SPI switch lookup succeeded but the SA packet port did not match. Ignoring the crypto failure and letting the packet through.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DestAddressLen` UInt32
`DestAddress` UnicodeString
`SPI` UInt32

Event ID 38: An IPsec offload inbound packet failed crypto on the NIC

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DestAddressLen` UInt32
`DestAddress` UnicodeString
`SPI` UInt32

Event ID 39: An IPsec offload outbound packet was dropped.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Message #

An IPsec offload outbound packet was dropped. Offload handle: %9, from port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8)  The packet did not match any existing offload handle on that port. This may be network attack.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`OffloadHandle` UInt64

Event ID 39: An IPsec offload outbound packet was dropped

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`OffloadHandle` UInt64

Event ID 40: An IPsec offload attempt failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

An IPsec offload attempt failed. Originating from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Reason: IpsecSaOffloadFailureReason. NDIS Status: Status.

Message #

An IPsec offload attempt failed. Originating from port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason: %1. NDIS Status: %10

Fields #

Name	Description
`IpsecSaOffloadFailureReason` UInt32
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 40: An IPsec offload attempt failed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

An IPsec offload attempt failed. Originating from port (Friendly Name: ) on switch (Friendly Name: ). Reason: . NDIS Status.

Fields #

Name	Description
`IpsecSaOffloadFailureReason` UInt32
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 41: Failed to query for switch extensions

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeSwitch

Description

Failed to query for switch extensions. The switch data path cannot start. Switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 41: Failed to query for switch extensions.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializeSwitch

Description

Failed to query for switch extensions. The switch data path cannot start. Switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to query for switch extensions. The switch data path cannot start. Switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 42: A forwarding extension is enabled on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeSwitch

Description

A forwarding extension is enabled on switch (Friendly Name: ). Built-in forwarding capability is disabled.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Event ID 42: A forwarding extension is enabled on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializeSwitch

Description

A forwarding extension is enabled on switch SwitchName (Friendly Name: SwitchFName). Built-in forwarding capability is disabled.

Message #

A forwarding extension is enabled on switch %2 (Friendly Name: %4). Built-in forwarding capability is disabled

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Event ID 43: A forwarding extension was disabled on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeSwitch

Description

A forwarding extension was disabled on switch (Friendly Name: ). Built-in forwarding capability is enabled.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Event ID 43: A forwarding extension was disabled on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializeSwitch

Description

A forwarding extension was disabled on switch SwitchName (Friendly Name: SwitchFName). Built-in forwarding capability is enabled.

Message #

A forwarding extension was disabled on switch %2 (Friendly Name: %4). Built-in forwarding capability is enabled

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Event ID 44: VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from Processor SourceProcIndex to Processor DestinationProcIndex.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from Processor SourceProcIndex to Processor DestinationProcIndex.

Message #

VMQ %5 on switch %2 (Friendly Name: %4) was moved from Processor %6 to Processor %7.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`SourceProcIndex` UInt32
`DestinationProcIndex` UInt32

Event ID 44: VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was moved from Processor SourceProcIndex to Processor

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

VMQ on switch (Friendly Name: ) was moved from Processor to Processor .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`SourceProcIndex` UInt32
`DestinationProcIndex` UInt32

Event ID 45: An IPsec offload packet was dropped because it going to be delivered to multiple destinations.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Message #

An IPsec offload packet was dropped because it going to be delivered to multiple destinations. From port %2 (Friendly Name: %4) on switch %6  (Friendly Name: %8). The multiple destinations could be because of Port monitoring, Layer 2 Multicast or switch flooding.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 45: An IPsec offload packet was dropped because it going to be delivered to multiple destinations

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 46: The connected NIC does not support VLAN trunk mode on switch SwitchName (Friendly Name: SwitchFName) port PortName (Friendly Name: PortFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: TrunkModeNotSupported

Description

The connected NIC does not support VLAN trunk mode on switch (Friendly Name: ) port (Friendly Name: ).

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString

Event ID 46: The connected NIC does not support VLAN trunk mode on switch SwitchName (Friendly Name: SwitchFName) port PortName (Friendly Name: PortFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: TrunkModeNotSupported

Description

The connected NIC does not support VLAN trunk mode on switch SwitchName (Friendly Name: SwitchFName) port PortName (Friendly Name: PortFName).

Message #

The connected NIC does not support VLAN trunk mode on switch %2 (Friendly Name: %4) port %6 (Friendly Name: %8).

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString

Event ID 47: CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped NewSendWindow= NewSendWindow MinSendWindow= MinSendWindow.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped NewSendWindow= NewSendWindow MinSendWindow= MinSendWindow.

Message #

CurrentTime= %1 BytesSent= %2 BytesDropped= %3 NewSendWindow= %4 MinSendWindow= %5

Fields #

Name	Description
`CurrentTime` UInt64
`BytesSent` UInt32
`BytesDropped` UInt32
`NewSendWindow` UInt32
`MinSendWindow` UInt32
`Weight` UInt32
`SBytesRequested` Int64
`DropRate` UInt32
`IdleIntervals` UInt64
`RcSendWindow` UInt32
`RcEpisodeLength` UInt32
`RcStatMuxFactor` UInt32
`RcExitThreshold` UInt32
`AverageMaxBytesRequested` UInt32

Event ID 47: CurrentTime= CurrentTime BytesSent= BytesSent BytesDropped= BytesDropped NewSendWindow= NewSendWindow MinSendWindow=

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

CurrentTime= BytesSent= BytesDropped= NewSendWindow= MinSendWindow=.

Fields #

Name	Description
`CurrentTime` UInt64
`BytesSent` UInt32
`BytesDropped` UInt32
`NewSendWindow` UInt32
`MinSendWindow` UInt32
`Weight` UInt32
`SBytesRequested` Int64
`DropRate` UInt32
`IdleIntervals` UInt64
`RcSendWindow` UInt32
`RcEpisodeLength` UInt32
`RcStatMuxFactor` UInt32
`RcExitThreshold` UInt32
`AverageMaxBytesRequested` UInt32

Event ID 48: NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= ActiveWeight NewSendWindow= NewSendWindow.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= ActiveWeight NewSendWindow= NewSendWindow.

Message #

NetLuid= %1 CurrentTime= %2 ActiveFlows= %3 ActiveWeight= %4 NewSendWindow= %5

Fields #

Name	Description
`NetLuid` Binary
`CurrentTime` UInt64
`ActiveFlows` UInt32
`ActiveWeight` UInt32
`NewSendWindow` UInt32

Event ID 48: NetLuid= NetLuid CurrentTime= CurrentTime ActiveFlows= ActiveFlows ActiveWeight= ActiveWeight NewSendWindow=

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NetLuid= CurrentTime= ActiveFlows= ActiveWeight= NewSendWindow=.

Fields #

Name	Description
`NetLuid` Binary
`CurrentTime` UInt64
`ActiveFlows` UInt32
`ActiveWeight` UInt32
`NewSendWindow` UInt32

Event ID 49: FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime LastConformanceTime= LastConformanceTime PeakConformanceTime= PeakConformanceTime Tokens= Tokens MaxTokens= MaxTokens Rate= Rat...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime LastConformanceTime= LastConformanceTime PeakConformanceTime= PeakConformanceTime Tokens= Tokens MaxTokens= MaxTokens Rate= Rate LastConformanceCredits= LastConformanceCredits.

Message #

FlowConformanceEventId= %1 CurrentTime= %2 LastConformanceTime= %3 PeakConformanceTime= %4 Tokens= %5 MaxTokens= %6 Rate= %7 LastConformanceCredits= %8

Fields #

Name	Description
`FlowConformanceEvent` UInt32
`CurrentTime` UInt64
`LastConformanceTime` UInt64
`PeakConformanceTime` UInt64
`Tokens` UInt64
`MaxTokens` UInt64
`Rate` UInt64
`LastConformanceCredits` UInt32

Event ID 49: FlowConformanceEventId= FlowConformanceEvent CurrentTime= CurrentTime LastConformanceTime= LastConformanceTime PeakConformanceTime= PeakConformanceTime Tokens= Tokens MaxTokens= MaxTokens Rate= Rat...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

FlowConformanceEventId= CurrentTime= LastConformanceTime= PeakConformanceTime= Tokens= MaxTokens= Rate= LastConformanceCredits=.

Fields #

Name	Description
`FlowConformanceEvent` UInt32
`CurrentTime` UInt64
`LastConformanceTime` UInt64
`PeakConformanceTime` UInt64
`Tokens` UInt64
`MaxTokens` UInt64
`Rate` UInt64
`LastConformanceCredits` UInt32

Event ID 50: FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= IdleTime DelayTime= DelayTime BytesRequested= BytesRequested BytesSent= BytesSent BytesQueued= BytesQueued.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= IdleTime DelayTime= DelayTime BytesRequested= BytesRequested BytesSent= BytesSent BytesQueued= BytesQueued.

Message #

FlowSendQueueEventId= %1 CurrentTime= %2 IdleTime= %3 DelayTime= %4 BytesRequested= %5 BytesSent= %6 BytesQueued= %7

Fields #

Name	Description
`FlowSendQueueEvent` UInt32
`CurrentTime` UInt64
`IdleTime` UInt64
`DelayTime` UInt64
`BytesRequested` UInt32
`BytesSent` UInt32
`BytesQueued` UInt32

Event ID 50: FlowSendQueueEventId= FlowSendQueueEvent CurrentTime= CurrentTime IdleTime= IdleTime DelayTime= DelayTime BytesRequested= BytesRequested BytesSent= BytesSent BytesQueued=

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

FlowSendQueueEventId= CurrentTime= IdleTime= DelayTime= BytesRequested= BytesSent= BytesQueued=.

Fields #

Name	Description
`FlowSendQueueEvent` UInt32
`CurrentTime` UInt64
`IdleTime` UInt64
`DelayTime` UInt64
`BytesRequested` UInt32
`BytesSent` UInt32
`BytesQueued` UInt32

Event ID 51: TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime RunTime= RunTime FlowsProcessed= FlowsProcessed NblsSent= NblsSent NblsDropped= NblsDropped Flags= Flags.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime RunTime= RunTime FlowsProcessed= FlowsProcessed NblsSent= NblsSent NblsDropped= NblsDropped Flags= Flags.

Message #

TimerId= %1 EventId= %2 CurrentTime= %3 SetTime= %4 RunTime= %5 FlowsProcessed= %6 NblsSent= %7 NblsDropped= %8 Flags= %9

Fields #

Name	Description
`TimerEvent` UInt32
`TimerId` UInt32
`CurrentTime` UInt64
`SetTime` UInt64
`RunTime` UInt64
`FlowsProcessed` UInt32
`NblsSent` UInt32
`NblsDropped` UInt32
`Flags` UInt32

Event ID 51: TimerId= TimerEvent EventId= TimerId CurrentTime= CurrentTime SetTime= SetTime RunTime= RunTime FlowsProcessed= FlowsProcessed NblsSent= NblsSent NblsDropped= NblsDropped Flags=

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

TimerId= EventId= CurrentTime= SetTime= RunTime= FlowsProcessed= NblsSent= NblsDropped= Flags=.

Fields #

Name	Description
`TimerEvent` UInt32
`TimerId` UInt32
`CurrentTime` UInt64
`SetTime` UInt64
`RunTime` UInt64
`FlowsProcessed` UInt32
`NblsSent` UInt32
`NblsDropped` UInt32
`Flags` UInt32

Event ID 52: NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested BytesCompleted= BytesCompleted BytesInQueue= BytesInQueue BufferAvailable= BufferAvailable AlphaTerm= AlphaTerm BetaTerm= Be...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested BytesCompleted= BytesCompleted BytesInQueue= BytesInQueue BufferAvailable= BufferAvailable AlphaTerm= AlphaTerm BetaTerm= BetaTerm DeltaSendWindow= DeltaSendWindow NewSendWindow= NewSendWindow.

Message #

NetLuid= %1 CurrentTime= %2 BytesRequested= %3 BytesCompleted= %4 BytesInQueue= %5 BufferAvailable= %6 AlphaTerm= %8 BetaTerm= %7 DeltaSendWindow= %9 NewSendWindow= %10

Fields #

Name	Description
`NetLuid` Binary
`CurrentTime` UInt64
`BytesRequested` UInt32
`BytesCompleted` UInt32
`BytesInQueue` UInt32
`BufferAvailable` Int64
`BetaTerm` Int64
`AlphaTerm` Int64
`DeltaSendWindow` Int64
`NewSendWindow` Int64

Event ID 52: NetLuid= NetLuid CurrentTime= CurrentTime BytesRequested= BytesRequested BytesCompleted= BytesCompleted BytesInQueue= BytesInQueue BufferAvailable= BufferAvailable AlphaTerm= AlphaTerm BetaTerm= Be...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NetLuid= CurrentTime= BytesRequested= BytesCompleted= BytesInQueue= BufferAvailable= AlphaTerm= BetaTerm= DeltaSendWindow= NewSendWindow=.

Fields #

Name	Description
`NetLuid` Binary
`CurrentTime` UInt64
`BytesRequested` UInt32
`BytesCompleted` UInt32
`BytesInQueue` UInt32
`BufferAvailable` Int64
`BetaTerm` Int64
`AlphaTerm` Int64
`DeltaSendWindow` Int64
`NewSendWindow` Int64

Event ID 53: Qos Packet dropped, reason=DropReason.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

Qos Packet dropped, reason=DropReason.

Message #

Qos Packet dropped, reason=%1

Fields #

Name	Description
`DropReason` UInt32

Event ID 53: Qos Packet dropped, reason=

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Qos Packet dropped, reason=.

Fields #

Name	Description
`DropReason` UInt32

Event ID 54: NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Message #

NBL originating from Nic %2 (Friendly Name: %4) was dropped in switch %6 (Friendly Name: %8), Reason %9 (Status:%10)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropReason` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 54: NBL originating from Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

NBL originating from Nic (Friendly Name: ) was dropped in switch (Friendly Name: ), Reason (Status:).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropReason` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 55: NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status).

Message #

NBL destined to Nic %2 (Friendly Name: %4) was dropped in switch %6 (Friendly Name: %8), Reason %9 (Status:%10)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropReason` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 55: NBL destined to Nic NicName (Friendly Name: NicFName) was dropped in switch SwitchName (Friendly Name: SwitchFName), Reason DropReason (Status:Status)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

NBL destined to Nic (Friendly Name: ) was dropped in switch (Friendly Name: ), Reason (Status:).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropReason` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 56: NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %9 received from Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 56: NBL BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NBL received from Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 57: NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %13 routed from Nic %2 (Friendly Name: %4) to Nic %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12)

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 57: NBL BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NBL routed from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 58: NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

NBL %9 delivered to Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 58: NBL BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NBL delivered to Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 59: Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: Swit...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Switch extension %2 has vetoed delivery of NBL from Nic %4 (Friendly Name: %6) to Nic %8 (Friendly Name: %10) on switch %12 (Friendly Name: %14)

Fields #

Name	Description
`ExtensionNameLen` UInt32
`ExtensionName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 59: Switch extension ExtensionName has vetoed delivery of NBL from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: Swit...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch extension has vetoed delivery of NBL from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`ExtensionNameLen` UInt32
`ExtensionName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 60: NBLs were dropped by extension ExtensionGuid (Friendly Name: ExtensionFriendlyName) in switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

NBLs were dropped by extension ExtensionGuid (Friendly Name: ExtensionFriendlyName) in switch SwitchName (Friendly Name: SwitchFName). Source Nic SrcNicName (Friendly Name: SrcNicFName), Reason Reason.

Message #

NBLs were dropped by extension %10 (Friendly Name: %12) in switch %6 (Friendly Name: %8). Source Nic %2 (Friendly Name: %4), Reason %14

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ExtensionGuidLen` UInt32
`ExtensionGuid` UnicodeString
`ExtensionFriendlyNameLen` UInt32
`ExtensionFriendlyName` UnicodeString
`ReasonLen` UInt32
`Reason` UnicodeString

Event ID 60: NBLs were dropped by extension ExtensionGuid (Friendly Name: ExtensionFriendlyName) in switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NBLs were dropped by extension (Friendly Name: ) in switch (Friendly Name: ). Source Nic (Friendly Name: ), Reason.

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ExtensionGuidLen` UInt32
`ExtensionGuid` UnicodeString
`ExtensionFriendlyNameLen` UInt32
`ExtensionFriendlyName` UnicodeString
`ReasonLen` UInt32
`Reason` UnicodeString

Event ID 61: Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual Machine ID VMId (Friendly Name: VMName) was not processed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: NicRestore

Description

Saved state restored for NIC (Friendly Name: ) on Virtual Machine ID (Friendly Name: ) was not processed. The state was originally saved by Extension (Friendly Name: ). Restore will continue.

Fields #

Name	Description
`ExtensionNameLength` UInt32
`ExtensionName` UnicodeString
`ExtensionId` GUID
`FeatureClassId` GUID
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString

Event ID 61: Saved state restored for NIC NicName (Friendly Name: NicFName) on Virtual Machine ID VMId (Friendly Name: VMName) was not processed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: NicRestore

Description

Saved state restored for NIC (Friendly Name: ) on Virtual Machine ID (Friendly Name: ) was not processed. The state was originally saved by Extension (Friendly Name: ). Restore will continue.

Message #

Saved state restored for NIC %6 (Friendly Name: %8) on Virtual Machine ID %12 (Friendly Name: %10) was not processed. The state %4 was originally saved by Extension %3 (Friendly Name: %2). Restore will continue.

Fields #

Name	Description
`ExtensionNameLength` UInt32
`ExtensionName` UnicodeString
`ExtensionId` GUID
`FeatureClassId` GUID
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString

Event ID 62: Switch SwitchName (Friendly Name: SwitchFName) successfully deleted

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch (Friendly Name: ) successfully deleted.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Event ID 62: Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

Switch SwitchName (Friendly Name: SwitchFName) successfully deleted.

Message #

Switch %2 (Friendly Name: %4) successfully deleted.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 62,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775937,
    "time_created": "2026-03-13T20:26:51.622353+00:00",
    "event_record_id": 2209,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 9,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 63: Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to delete switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 63: Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to delete switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to delete switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 64: Switch SwitchName (Friendly Name: SwitchFName) info successfully set.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Switch SwitchName (Friendly Name: SwitchFName) info successfully set.

Message #

Switch %2 (Friendly Name: %4) info successfully set.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 64,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:24:28.297213+00:00",
    "event_record_id": 53,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 7796
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 10,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 65: Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set switch info for switch (Friendly Name: ), status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 65: Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set switch info for switch SwitchName (Friendly Name: SwitchFName), status = Status, UniqueEvent = UniqueEvent.

Message #

Failed to set switch info for switch %3 (Friendly Name: %5), status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 66: Delete complete for Switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Delete complete for Switch SwitchName (Friendly Name: SwitchFName).

Message #

Delete complete for Switch %2 (Friendly Name: %4).

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 66,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:51.623598+00:00",
    "event_record_id": 342,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 9,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 67: Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 67,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.414624+00:00",
    "event_record_id": 22,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 2384
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 0,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 67: Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 67,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.1195606+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFName": "Default Switch",
    "SwitchNameLen": "36",
    "SwitchFNameLen": "14",
    "Flags": "0",
    "PortFNameLen": "14",
    "OwnerService": "1",
    "PortNameLen": "36",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortFName": "Default Switch"
  }
}

Event ID 68: Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to create port (Friendly Name: ) on switch (Friendly Name: ). Status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 68: Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to create port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to create port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 69: Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully deleted - switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 69,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:25:06.632116+00:00",
    "event_record_id": 79,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "7BAE5890-FC5D-4166-B557-FEF82659BCD4",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 0,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 69: Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

Port PortName (Friendly Name: PortFName) successfully deleted - switch SwitchName (Friendly Name: SwitchFName).

Message #

Port %2 (Friendly Name: %4) successfully deleted - switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 69,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-04-17T20:04:52.6036005+00:00",
    "event_record_id": 1591,
    "correlation": {},
    "execution": {
      "process_id": 3180,
      "thread_id": 4408
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": "36",
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortFNameLen": "14",
    "PortFName": "Default Switch",
    "SwitchNameLen": "36",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFNameLen": "14",
    "SwitchFName": "Default Switch",
    "Flags": "0",
    "OwnerService": "1"
  },
  "message": "Port C08CB7B8-9B3C-408E-8E30-5E16A3AEB444 (Friendly Name: Default Switch) successfully deleted - switch C08CB7B8-9B3C-408E-8E30-5E16A3AEB444 (Friendly Name: Default Switch)."
}

Event ID 70: Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to delete port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 70: Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to delete port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to delete port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 71: Delete complete for port PortName (Friendly Name: PortFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Delete complete for port PortName (Friendly Name: PortFName).

Message #

Delete complete for port %2 (Friendly Name: %4).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:25:06.633725+00:00",
    "event_record_id": 80,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "7BAE5890-FC5D-4166-B557-FEF82659BCD4",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Flags": 0,
    "OwnerService": 0
  },
  "message": ""
}

Event ID 71: Delete complete for port PortName (Friendly Name: PortFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

Delete complete for port PortName (Friendly Name: PortFName).

Message #

Delete complete for port %2 (Friendly Name: %4).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-04-17T20:04:52.6052002+00:00",
    "event_record_id": 1592,
    "correlation": {},
    "execution": {
      "process_id": 3180,
      "thread_id": 4408
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": "36",
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortFNameLen": "14",
    "PortFName": "Default Switch",
    "SwitchNameLen": "36",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFNameLen": "14",
    "SwitchFName": "Default Switch",
    "Flags": "0",
    "OwnerService": "1"
  },
  "message": "Delete complete for port C08CB7B8-9B3C-408E-8E30-5E16A3AEB444 (Friendly Name: Default Switch)."
}

Event ID 72: Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set monitor mode on port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 72: Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set monitor mode on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to set monitor mode on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 73: Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set VLAN info on port (Friendly Name: ) on switch (Friendly Name: ). Status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 73: Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set VLAN info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Failed to set VLAN info on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 74: Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set IP spoofing info on port (Friendly Name: ) on switch (Friendly Name: ). Status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 74: Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set IP spoofing info on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to set IP spoofing info on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 75: The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 75: The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%11' failed on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 76: The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`UniqueEvent` UInt32
`NicInstanceId` GUID

Event ID 76: The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%6' failed on nic %3 (Friendly Name: %5), Instance Id %8. Status = %1. UniqueEvent = %7.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`UniqueEvent` UInt32
`NicInstanceId` GUID

Event ID 77: Failed to disconnect NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to disconnect NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 77: Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to disconnect NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to disconnect NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 78: Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 78: Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Error
Opcode: Info

Description

Message #

Failed to complete operation '%13' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Property Id %10 Instance Id %11. Status = %1. UniqueEvent = %12.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 78,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T15:45:54.5791083+00:00",
    "event_record_id": 3108,
    "correlation": {},
    "execution": {
      "process_id": 2504,
      "thread_id": 4116
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": "3221226021",
    "PortNameLen": "36",
    "PortName": "097CD8D0-32E8-48B7-95C5-5B85B575BFAA",
    "PortFNameLen": "0",
    "PortFName": "",
    "SwitchNameLen": "36",
    "SwitchName": "F0204EA5-7FED-422E-92EE-1B4EEC2D01D6",
    "SwitchFNameLen": "19",
    "SwitchFName": "evtgen-hvlinux-priv",
    "PropertyId": "{cd168ff0-a16d-4514-b7b5-8bbba791a928}",
    "InstanceId": "{18eae645-efcb-47ed-ba07-3e2f247cb5c9}",
    "UniqueEvent": "60",
    "Operation": "3"
  },
  "message": "Failed to complete operation 'Policy Delete' on port 097CD8D0-32E8-48B7-95C5-5B85B575BFAA (Friendly Name: ) on switch F0204EA5-7FED-422E-92EE-1B4EEC2D01D6 (Friendly Name: evtgen-hvlinux-priv) Property Id {cd168ff0-a16d-4514-b7b5-8bbba791a928} Instance Id {18eae645-efcb-47ed-ba07-3e2f247cb5c9}. Status = The object was not found.. UniqueEvent = 60."
}

Event ID 79: Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

Completed operation '%11' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Property Id %9 Instance Id %10.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 79: Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 80: Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 80: Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Warning
Opcode: Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%9' on switch %3 (Friendly Name: %5) Property Id %6 Instance Id %7. Status = %1. UniqueEvent = %8.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 80,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T15:45:40.7579657+00:00",
    "event_record_id": 3064,
    "correlation": {},
    "execution": {
      "process_id": 2504,
      "thread_id": 10032
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": "3221225659",
    "SwitchNameLen": "36",
    "SwitchName": "8EE728F3-6AA7-4BA7-B6F0-60A749B695CE",
    "SwitchFNameLen": "18",
    "SwitchFName": "evtgen-hvlinux-int",
    "PropertyId": "{3eb2b8e8-4abf-4dbf-9071-16dd47481fbe}",
    "InstanceId": "{0d2d1eb3-16c2-49d1-8a3b-a81a1686d9fd}",
    "UniqueEvent": "6",
    "Operation": "0"
  },
  "message": "Failed to complete operation 'Policy Add' on switch 8EE728F3-6AA7-4BA7-B6F0-60A749B695CE (Friendly Name: evtgen-hvlinux-int) Property Id {3eb2b8e8-4abf-4dbf-9071-16dd47481fbe} Instance Id {0d2d1eb3-16c2-49d1-8a3b-a81a1686d9fd}. Status = The request is not supported.. UniqueEvent = 6."
}

Event ID 81: Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

Completed operation '%7' on switch %2 (Friendly Name: %4) Property Id %5 Instance Id %6.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 81: Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 82: Failed to complete bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, L...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete bandwidth policy operation '' on port (Friendly Name: ) on switch (Friendly Name: ) Reservation - , Weight - , Limit - , BurstLimit - , BurstSize - , Reason - , Status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Limit` Int64
`BurstLimit` Int64
`BurstSize` Int64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 82: Failed to complete bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Error
Opcode: Info

Description

Failed to complete bandwidth policy operation '' on port (Friendly Name: ) on switch (Friendly Name: ) Reservation - , Weight - , Limit - , BurstLimit - , BurstSize - , Reason - , Status = .

Message #

Failed to complete bandwidth policy operation '%16' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Reservation - %10, Weight - %11, Limit - %12, BurstLimit - %13, BurstSize - %14, Reason - %15, Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Limit` Int64
`BurstLimit` Int64
`BurstSize` Int64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 82,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T15:45:26.7476017+00:00",
    "event_record_id": 3027,
    "correlation": {},
    "execution": {
      "process_id": 2504,
      "thread_id": 4116
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": "3221225485",
    "PortNameLen": "36",
    "PortName": "4208505D-7DB2-4ED1-AB83-B7B6338111CC",
    "PortFNameLen": "0",
    "PortFName": "",
    "SwitchNameLen": "36",
    "SwitchName": "F0204EA5-7FED-422E-92EE-1B4EEC2D01D6",
    "SwitchFNameLen": "19",
    "SwitchFName": "evtgen-hvlinux-priv",
    "Reservation": "1000000",
    "Weight": "0",
    "Limit": "0",
    "BurstLimit": "0",
    "BurstSize": "0",
    "FailReason": "49",
    "Operation": "1"
  },
  "message": "Failed to complete bandwidth policy operation 'Policy Set' on port 4208505D-7DB2-4ED1-AB83-B7B6338111CC (Friendly Name: ) on switch F0204EA5-7FED-422E-92EE-1B4EEC2D01D6 (Friendly Name: evtgen-hvlinux-priv) Reservation - 1000000, Weight - 0, Limit - 0, BurstLimit - 0, BurstSize - 0, Reason - Bandwidth reservation value is less than the supported minimum, Status = An invalid parameter was passed to a service or function.."
}

Event ID 83: Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - ...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - Limit, BurstLimit - BurstLimit, BurstSize - BurstSize.

Message #

Completed bandwidth policy operation '%14' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Reservation - %9, Weight - %10, Limit - %11, BurstLimit - %12, BurstSize - %13.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Limit` Int64
`BurstLimit` Int64
`BurstSize` Int64
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 83: Completed bandwidth policy operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Limit - Li...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Limit` Int64
`BurstLimit` Int64
`BurstSize` Int64
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 84: Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight ,Status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to create default flow on switch (Friendly Name: ) Reservation - , Weight - ,Status = .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`Reservation` Int64
`Weight` Int64

Event ID 84: Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight ,Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to create default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight ,Status = Status.

Message #

Failed to create default flow on switch %2 (Friendly Name: %4) Reservation - %6, Weight - %7 ,Status = %5.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`Reservation` Int64
`Weight` Int64

Event ID 85: Successfully created default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Successfully created default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Message #

Successfully created default flow on switch %2 (Friendly Name: %4) Reservation - %6, Weight - %7.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`Reservation` Int64
`Weight` Int64

Event ID 85: Successfully created default flow on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight -

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Successfully created default flow on switch (Friendly Name: ) Reservation - , Weight - .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`Reservation` Int64
`Weight` Int64

Event ID 86: Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Message #

Failed to complete operation '%13' on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9) Property Id %10 Instance Id %11. Status = %1. UniqueEvent = %12.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 86: Failed to complete operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 87: The connected Nic NicName (Friendly Name: NicFName) does not support VLAN configuration as it is external

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VlanPtNicNotSupported

Description

The connected Nic (Friendly Name: ) does not support VLAN configuration as it is external. The VLAN configuration on port (Friendly Name: ) will be ignored.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 87: The connected Nic NicName (Friendly Name: NicFName) does not support VLAN configuration as it is external.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: VlanPtNicNotSupported

Description

The connected Nic NicName (Friendly Name: NicFName) does not support VLAN configuration as it is external. The VLAN configuration on port PortName (Friendly Name: PortFName) will be ignored.

Message #

The connected Nic %6 (Friendly Name: %8) does not support VLAN configuration as it is external. The VLAN configuration on port %2 (Friendly Name: %4) will be ignored.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 88: Failed to complete security policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - AllowMacSpoofing: AllowMacSpoofing, EnableDhcpGuard: Ena...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`AllowMacSpoofing` Boolean
`EnableDhcpGuard` Boolean
`EnableRouterGuard` Boolean
`MonitorMode` UInt32
`MonitorSession` UInt32
`AllowIeeePriorityTag` Boolean
`VirtualSubnetId` UInt32
`AllowTeaming` Boolean
`StormLimit` UInt32
`DynamicIPAddressLimit` UInt32
`EnableFixSpeed10G` Boolean
`FailReason` UInt32

Event ID 88: Failed to complete security policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - AllowMacSpoofing: AllowMacSpoofing, EnableDhcpGuar...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Failed to complete security policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - AllowMacSpoofing: %9, EnableDhcpGuard: %10, EnableRouterGuard: %11, MonitorMode: %12, AllowIeeePriorityTag: %14, VirtualSubnetId: %15, AllowTeaming: %16, StormLimit: %17, DynamicIPAddressLimit: %18, EnableFixSpeed10G: %19, Reason: %20.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`AllowMacSpoofing` Boolean
`EnableDhcpGuard` Boolean
`EnableRouterGuard` Boolean
`MonitorMode` UInt32
`MonitorSession` UInt32
`AllowIeeePriorityTag` Boolean
`VirtualSubnetId` UInt32
`AllowTeaming` Boolean
`StormLimit` UInt32
`DynamicIPAddressLimit` UInt32
`EnableFixSpeed10G` Boolean
`FailReason` UInt32

Event ID 89: Completed security policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - AllowMacSpoofing: AllowMacSpoofing, EnableDhcpGuard: EnableDhcpGu...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Message #

Completed security policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - AllowMacSpoofing: %9, EnableDhcpGuard: %10, EnableRouterGuard: %11, MonitorMode: %12, AllowIeeePriorityTag: %14, VirtualSubnetId: %15, AllowTeaming %16, StormLimit: %17, DynamicIPAddressLimit: %18, EnableFixSpeed10G: %19.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`AllowMacSpoofing` Boolean
`EnableDhcpGuard` Boolean
`EnableRouterGuard` Boolean
`MonitorMode` UInt32
`MonitorSession` UInt32
`AllowIeeePriorityTag` Boolean
`VirtualSubnetId` UInt32
`AllowTeaming` Boolean
`StormLimit` UInt32
`DynamicIPAddressLimit` UInt32
`EnableFixSpeed10G` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 89,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:32.435528+00:00",
    "event_record_id": 233,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 7796
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "E6BB997F-D0DA-483C-8647-FE1681B7D63D",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "AllowMacSpoofing": true,
    "EnableDhcpGuard": false,
    "EnableRouterGuard": false,
    "MonitorMode": 0,
    "MonitorSession": 0,
    "AllowIeeePriorityTag": false,
    "VirtualSubnetId": 0,
    "AllowTeaming": false,
    "StormLimit": 0,
    "DynamicIPAddressLimit": 0,
    "EnableFixSpeed10G": false
  },
  "message": ""
}

Event ID 90: Failed to complete Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Applicability: Applicability, AclT...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Applicability` UInt32
`Type` UInt32
`Action` UInt32
`LocalAddrLen` UInt32
`LocalAddr` UnicodeString
`LocalPrefix` UInt32
`RemoteAddrLen` UInt32
`RemoteAddr` UnicodeString
`RemotePrefix` UInt32
`FailReason` UInt32

Event ID 90: Failed to complete Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Applicability: Applicability, A...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Failed to complete Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Applicability: %10, AclType: %11, Action: %12, LocalAddress: '%14', LocalPrefixLength: %15, RemoteAddress: '%17', RemotePrefixLength: %18. Reason: %19

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Applicability` UInt32
`Type` UInt32
`Action` UInt32
`LocalAddrLen` UInt32
`LocalAddr` UnicodeString
`LocalPrefix` UInt32
`RemoteAddrLen` UInt32
`RemoteAddr` UnicodeString
`RemotePrefix` UInt32
`FailReason` UInt32

Event ID 91: Completed Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Applicability: Applicability, AclType: %...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Message #

Completed Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Applicability: %10, AclType: %11, Action: %12, LocalAddress: '%14', LocalPrefixLength: %15, RemoteAddress: '%17', RemotePrefixLength: %18.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Applicability` UInt32
`Type` UInt32
`Action` UInt32
`LocalAddrLen` UInt32
`LocalAddr` UnicodeString
`LocalPrefix` UInt32
`RemoteAddrLen` UInt32
`RemoteAddr` UnicodeString
`RemotePrefix` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 91,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:28.669856+00:00",
    "event_record_id": 219,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 10904
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "AB7BE073-914D-47D9-8244-65F75F65968B",
    "PortFNameLen": 0,
    "PortFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "A9ECB2E2-B00E-4B11-AD4A-914F814BDAE8",
    "SwitchFNameLen": 12,
    "SwitchFName": "TestInternal",
    "Direction": 2,
    "Applicability": 2,
    "Type": 3,
    "Action": 3,
    "LocalAddrLen": 1,
    "LocalAddr": "",
    "LocalPrefix": 0,
    "RemoteAddrLen": 1,
    "RemoteAddr": "",
    "RemotePrefix": 0
  },
  "message": ""
}

Event ID 92: A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 92: A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

A switch extension blocked the operation 'Operation' on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

A switch extension blocked the operation '%11' on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) Property Id %9 Instance Id %10.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 93: A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 93: A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

A switch extension blocked the operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Message #

A switch extension blocked the operation '%7' on switch %2 (Friendly Name: %4) Property Id %5 Instance Id %6.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 94: Failed to complete offload policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - IPSecOffloadLimit: IPSecOffloadLimit, VMQOffloadWeight: V...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`IPSecOffloadLimit` UInt32
`VMQOffloadWeight` UInt32
`IovOffloadWeight` UInt32
`QueuePairs` UInt32
`InterruptModeration` UInt32
`FailReason` UInt32

Event ID 94: Failed to complete offload policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - IPSecOffloadLimit: IPSecOffloadLimit, VMQOffloadWeig...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Failed to complete offload policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - IPSecOffloadLimit: %9, VMQOffloadWeight: %10, IovOffloadWeight: %11, QueuePairs: %12, InterruptModeration: %13. Reason: %14

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`IPSecOffloadLimit` UInt32
`VMQOffloadWeight` UInt32
`IovOffloadWeight` UInt32
`QueuePairs` UInt32
`InterruptModeration` UInt32
`FailReason` UInt32

Event ID 95: The VLAN configuration being set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The VLAN configuration being set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 95: The VLAN configuration being set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The VLAN configuration being set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason.

Message #

The VLAN configuration being set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 96: VLAN tagging is configured on port PortName (Friendly Name: PortFName), connected Nic NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 96: VLAN tagging is configured on port PortName (Friendly Name: PortFName), connected Nic NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

VLAN tagging is configured on port %2 (Friendly Name: %4), connected Nic %6 (Friendly Name: %8). However, the external NIC connected to this switch does not support VLAN or VLAN is disabled. This might lead to external network connectivity issues.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 97: Failed to retrieve the active extension list from switch SwitchName (Friendly Name: SwitchFName), status = Status, Reason =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to retrieve the active extension list from switch (Friendly Name: ), status = , Reason = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 97: Failed to retrieve the active extension list from switch SwitchName (Friendly Name: SwitchFName), status = Status, Reason = FailReason.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to retrieve the active extension list from switch SwitchName (Friendly Name: SwitchFName), status = Status, Reason = FailReason.

Message #

Failed to retrieve the active extension list from switch %3 (Friendly Name: %5), status = %1, Reason = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 98: Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ). Extension is required on the port, but it is not active on switch (Friendly Name: ).

Fields #

Name	Description
`ExtensionId` GUID
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 98: Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName). Extension ExtensionId is required on the port, but it is not active on switch SwitchName (Friendly Name: SwitchFName).

Message #

Connectivity has been blocked for NIC %3 (Friendly Name: %5) on port %7 (Friendly Name: %9). Extension %1 is required on the port, but it is not active on switch %11 (Friendly Name: %13).

Fields #

Name	Description
`ExtensionId` GUID
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 99: Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). An extension feature is required on the port, but it is not registered on the system.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 99: Connectivity has been blocked for NIC NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Connectivity has been blocked for NIC (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). An extension feature is required on the port, but it is not registered on the system.

Message #

Connectivity has been blocked for NIC %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12). An extension feature is required on the port, but it is not registered on the system.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 100: Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 100: Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Error
Opcode: Info

Description

Failed to complete bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight, Reason - FailReason, Status = Status.

Message #

Failed to complete bandwidth policy operation '%9' on switch %3 (Friendly Name: %5) Reservation - %6, Weight - %7, Reason - %8, Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T15:45:40.7579471+00:00",
    "event_record_id": 3063,
    "correlation": {},
    "execution": {
      "process_id": 2504,
      "thread_id": 10032
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": "3221225659",
    "SwitchNameLen": "36",
    "SwitchName": "8EE728F3-6AA7-4BA7-B6F0-60A749B695CE",
    "SwitchFNameLen": "18",
    "SwitchFName": "evtgen-hvlinux-int",
    "Reservation": "0",
    "Weight": "20",
    "FailReason": "48",
    "Operation": "1"
  },
  "message": "Failed to complete bandwidth policy operation 'Policy Set' on switch 8EE728F3-6AA7-4BA7-B6F0-60A749B695CE (Friendly Name: evtgen-hvlinux-int) Reservation - 0, Weight - 20, Reason - The switch's bandwidth reservation mode does not support this bandwidth configuration, Status = The request is not supported.."
}

Event ID 101: Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Message #

Completed bandwidth policy operation '%7' on switch %2 (Friendly Name: %4) Reservation - %5, Weight - %6.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 101: Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight -

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed bandwidth policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Reservation - Reservation, Weight - Weight.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reservation` Int64
`Weight` Int64
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 102: Networking driver in VMName is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID VMId)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: ProtocolVersionNegotiate

Description

Networking driver in is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID ).

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString

Event ID 102: Networking driver in VMName is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID VMId).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Task: ProtocolVersionNegotiate

Description

Networking driver in VMName is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID VMId).

Message #

Networking driver in %2 is loaded and the protocol version is negotiated to the most recent version (Virtual machine ID %4).

Fields #

Name	Description
`VMNameLen` UInt32
`VMName` UnicodeString
`VMIdLen` UInt32
`VMId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 1019,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.483803+00:00",
    "event_record_id": 2817,
    "correlation": {},
    "execution": {
      "process_id": 9472,
      "thread_id": 9664
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "VMNameLen": 36,
    "VMName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4",
    "VMIdLen": 36,
    "VMId": "29A7892D-8743-4A3F-85E3-06FE9D7977B4"
  },
  "message": ""
}

Event ID 103: Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to complete operation '%9' on switch %3 (Friendly Name: %5) Property Id %6 Instance Id %7. Status = %1. UniqueEvent = %8.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 103: Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) Property Id PropertyId Instance Id InstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`PropertyId` GUID
`InstanceId` GUID
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 104: The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%6' failed on nic %3 (Friendly Name: %5), Instance Id %8. Status = %1. UniqueEvent = %7.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`UniqueEvent` UInt32
`NicInstanceId` GUID

Event ID 104: The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The operation 'Operation' failed on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId. Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`UniqueEvent` UInt32
`NicInstanceId` GUID

Event ID 105: The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Message #

The operation '%11' failed on port %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Status = %1. UniqueEvent = %10.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 105: The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The operation 'Operation' failed on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Status = Status. UniqueEvent = UniqueEvent.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 106: Available processor sets of the underlying physical NICs belonging to the LBFO team NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) are not configured correctly

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC (Friendly Name: ) on switch (Friendly Name: ) are not configured correctly. Reason.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`QueueMode` UInt32

Event ID 106: Available processor sets of the underlying physical NICs belonging to the LBFO team NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) are...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) are not configured correctly. Reason: QueueMode.

Message #

Available processor sets of the underlying physical NICs belonging to the LBFO team NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) are not configured correctly. Reason: %9

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`QueueMode` UInt32

Event ID 107: DataOidTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

DataOidTarget. OID (Oid) on switch SwitchName (Friendly Name: SwitchFName).

Message #

%1. OID (%2) on switch %4 (Friendly Name: %6).

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 107

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. OID () on switch (Friendly Name: ).

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 108: DataOidTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

DataOidTarget. OID (Oid) on switch SwitchName (Friendly Name: SwitchFName), Result: Status.

Message #

%1. OID (%2) on switch %4 (Friendly Name: %6), Result: %7.

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 108

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. OID () on switch (Friendly Name: ), Result: .

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 109: DataOidTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

DataOidTarget. NIC_REQUEST OID (Oid) on switch SwitchName (Friendly Name: SwitchFName) on behalf of NIC SrcNicName (Friendly Name: SrcNicFName) (Index: SrcNicIndex) to NIC DstNicName (Friendly Name: DstNicFName) (Index: DstNicIndex).

Message #

%1. NIC_REQUEST OID (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16)

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32

Event ID 109

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. NIC_REQUEST OID () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ).

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32

Event ID 110: DataOidTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Message #

%1. NIC_REQUEST OID (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16), Result: %17

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 110

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. NIC_REQUEST OID () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ), Result.

Fields #

Name	Description
`DataOidTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 111: StatusTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

StatusTarget. Status (Oid) on switch SwitchName (Friendly Name: SwitchFName).

Message #

%1. Status (%2) on switch %4 (Friendly Name: %6).

Fields #

Name	Description
`StatusTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 111

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. Status () on switch (Friendly Name: ).

Fields #

Name	Description
`StatusTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 112: StatusTarget.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

StatusTarget. NIC_STATUS Status (Oid) on switch SwitchName (Friendly Name: SwitchFName) on behalf of NIC SrcNicName (Friendly Name: SrcNicFName) (Index: SrcNicIndex) to NIC DstNicName (Friendly Name: DstNicFName) (Index: DstNicIndex).

Message #

%1. NIC_STATUS Status (%2) on switch %4 (Friendly Name: %6) on behalf of NIC %8 (Friendly Name: %10) (Index: %11) to  NIC %13 (Friendly Name: %15) (Index: %16)

Fields #

Name	Description
`StatusTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32

Event ID 112

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

. NIC_STATUS Status () on switch (Friendly Name: ) on behalf of NIC (Friendly Name: ) (Index: ) to NIC (Friendly Name: ) (Index: ).

Fields #

Name	Description
`StatusTarget` UInt32
`Oid` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`SrcNicIndex` UInt32
`DstNicNameLen` UInt32
`DstNicName` UnicodeString
`DstNicFNameLen` UInt32
`DstNicFName` UnicodeString
`DstNicIndex` UInt32

Event ID 113: Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to allocate VMQ for NIC (Friendly Name: ) on switch (Friendly Name: ). Reason - . Status =.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 113: Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName). Reason - FailReason. Status = Status.

Message #

Failed to allocate VMQ for NIC %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason - %10. Status = %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 114: Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName). Reason - FailReason. Status = Status.

Message #

Failed to allocate VMQ for NIC %3 (Friendly Name: %5) on switch %7 (Friendly Name: %9). Reason - %10. Status = %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 114: Failed to allocate VMQ for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to allocate VMQ for NIC (Friendly Name: ) on switch (Friendly Name: ). Reason - . Status =.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 115: Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed VMQ allocation for NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Completed VMQ allocation for NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 116: Switch Team member connected.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch Team member connected. NIC NicName (Friendly Name: NicFName) with NicIndex NicIndex (NetCfgInstanceId: NetCfgInstanceId) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Switch Team member connected. NIC %6 (Friendly Name: %8) with NicIndex %9 (NetCfgInstanceId: %10) on switch %2 (Friendly Name: %4). Status = %11

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`NicIndex` UInt32
`NetCfgInstanceId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 117: Switch Team member disconnected.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch Team member disconnected. NIC NicName (Friendly Name: NicFName) with NicIndex NicIndex (NetCfgInstanceId: NetCfgInstanceId) on switch SwitchName (Friendly Name: SwitchFName). Status = Status.

Message #

Switch Team member disconnected. NIC %6 (Friendly Name: %8) with NicIndex %9 (NetCfgInstanceId: %10) on switch %2 (Friendly Name: %4). Status = %11

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`NicIndex` UInt32
`NetCfgInstanceId` GUID
`Status` UInt32	NTSTATUS reference

Event ID 118: The external NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) is connected to ConfigurationType.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The external NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) is connected to ConfigurationType.

Message #

The external NIC %6 (Friendly Name: %8) on switch %2 (Friendly Name: %4) is connected to %9.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`ConfigurationType` UInt32

Event ID 119: Port PortName (Friendly Name: PortFName) has security conflict with the associated switch SwitchName (Friendly Name: SwitchFName) because IOV is enabled

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SecurityConflict` UInt32

Event ID 119: Port PortName (Friendly Name: PortFName) has MAC address spoofing enabled.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Port %2 (Friendly Name: %4) has MAC address spoofing enabled. This is not supported on the associated switch %6 (Friendly Name: %8) because IOV is enabled. Traffic with a spoofed MAC address will not function properly.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`SecurityConflict` UInt32

Event ID 120: The configured bandwidth reservation might not be applied on switch SwitchName (Friendly Name: SwitchFName) as the external NIC NicName (Friendly Name: NicFName)'s link speed is less than the total...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The configured bandwidth reservation might not be applied on switch (Friendly Name: ) as the external NIC (Friendly Name: )'s link speed is less than the total reservation configured.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 120: The configured bandwidth reservation might not be applied on switch SwitchName (Friendly Name: SwitchFName) as the external NIC NicName (Friendly Name: NicFName)'s link speed ...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The configured bandwidth reservation might not be applied on switch SwitchName (Friendly Name: SwitchFName) as the external NIC NicName (Friendly Name: NicFName)'s link speed is less than the total reservation configured.

Message #

The configured bandwidth reservation might not be applied on switch %2 (Friendly Name: %4) as the external NIC %6 (Friendly Name: %8)'s link speed is less than the total reservation configured.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 121: An extension is attempting to revoke the VF allocated for Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

An extension is attempting to revoke the VF allocated for Port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 121: An extension is attempting to revoke the VF allocated for Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

An extension is attempting to revoke the VF allocated for Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

An extension is attempting to revoke the VF allocated for Port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 122: VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) with status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMQ group creation failed with NIC (Friendly Name: ) on switch (Friendly Name: ) with status = . Reason: .

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`QueueMode` UInt32
`Status` UInt32	NTSTATUS reference
`FailReason` UInt32

Event ID 122: VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) with status = QueueMode.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

VMQ group creation failed with NIC NicName (Friendly Name: NicFName) on switch SwitchName (Friendly Name: SwitchFName) with status = QueueMode. Reason: Status.

Message #

VMQ group creation failed with NIC %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) with status = %9. Reason: %10.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`QueueMode` UInt32
`Status` UInt32	NTSTATUS reference
`FailReason` UInt32

Event ID 123: VMQ capabilities received from NIC NicName (Friendly Name: NicFName): VmqSupported - VmqSupported, DynamicVmqSupported - dynamicVmqSupported.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMQ capabilities received from NIC NicName (Friendly Name: NicFName): VmqSupported - VmqSupported, DynamicVmqSupported - dynamicVmqSupported.

Message #

VMQ capabilities received from NIC %2 (Friendly Name: %4): VmqSupported - %6, DynamicVmqSupported - %7.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`LinkSpeed` UInt64
`VmqSupported` Boolean
`dynamicVmqSupported` Boolean
`QueueMode` UInt32
`EnabledFilterTypes` UInt32
`EnabledQueueTypes` UInt32
`SupportedQueueProperties` UInt32
`SupportedFilterTests` UInt32
`SupportedHeaders` UInt32
`SupportedMacHeaderFields` UInt32

Event ID 124: NIC NicName (Friendly Name: NicFName) restarted.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

NIC NicName (Friendly Name: NicFName) restarted.

Message #

NIC %2 (Friendly Name: %4) restarted.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 124,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.210346+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3728
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 125: Media connected on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Media connected on NIC NicName (Friendly Name: NicFName).

Message #

Media connected on NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 125,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-11T06:32:02.266923+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL"
  },
  "message": ""
}

Event ID 126: Media disconnected on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Media disconnected on NIC NicName (Friendly Name: NicFName).

Message #

Media disconnected on NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388033,
    "time_created": "2026-03-13T20:26:50.947776+00:00",
    "event_record_id": 329,
    "correlation": {},
    "execution": {
      "process_id": 1840,
      "thread_id": 4820
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 36,
    "NicName": "95F9FAC4-A05B-4500-8332-94A3FFD233C2",
    "NicFNameLen": 12,
    "NicFName": "TestInternal"
  },
  "message": ""
}

Event ID 127: The Isolation configuration could not be deleted from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The Isolation configuration could not be deleted from port (Friendly Name: ) on switch (Friendly Name: ). Reason.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 127: The Isolation configuration could not be deleted from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The Isolation configuration could not be deleted from port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). Reason: FailReason.

Message #

The Isolation configuration could not be deleted from port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8). Reason: %9

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32

Event ID 128: The Isolation configuration set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The Isolation configuration set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason: , Ext1: , Ext2.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`Ext1` UInt32
`Ext2` UInt32

Event ID 128: The Isolation configuration set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The Isolation configuration set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason, Ext1: Ext1, Ext2: Ext2.

Message #

The Isolation configuration set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9, Ext1: %10, Ext2: %11

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`Ext1` UInt32
`Ext2` UInt32

Event ID 129: The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: RoutingDomainGuid) set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is in...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The Routing Domain configuration (Routing Domain: , GUID: ) set on port (Friendly Name: ) on switch (Friendly Name: ) is invalid. Reason: , Ext1: , Ext2.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`RoutingDomainGuidLen` UInt32
`RoutingDomainGuid` UnicodeString
`RoutingDomainNameLen` UInt32
`RoutingDomainName` UnicodeString
`Ext1` UInt32
`Ext2` UInt32

Event ID 129: The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: RoutingDomainGuid) set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is in...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The Routing Domain configuration (Routing Domain: RoutingDomainName, GUID: RoutingDomainGuid) set on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) is invalid. Reason: FailReason, Ext1: Ext1, Ext2: Ext2.

Message #

The Routing Domain configuration (Routing Domain: %13, GUID: %11) set on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) is invalid. Reason: %9, Ext1: %14, Ext2: %15

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`RoutingDomainGuidLen` UInt32
`RoutingDomainGuid` UnicodeString
`RoutingDomainNameLen` UInt32
`RoutingDomainName` UnicodeString
`Ext1` UInt32
`Ext2` UInt32

Event ID 130: Failed to complete Extended Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Action: Action, LocalIPAd...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Action` UInt32
`LocalIPAddrLen` UInt32
`LocalIPAddr` UnicodeString
`RemoteIPAddrLen` UInt32
`RemoteIPAddr` UnicodeString
`LocalPortLen` UInt32
`LocalPort` UnicodeString
`RemotePortLen` UInt32
`RemotePort` UnicodeString
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`Weight` UInt32
`Stateful` Boolean
`IdleSessionTimeout` UInt32
`VirtualSubnetId` UInt32
`FailReason` UInt32

Event ID 130: Failed to complete Extended Port ACL policy operation on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) - Direction: Direction, Action: Action,...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Failed to complete Extended Port ACL policy operation on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) - Direction: %9, Action: %10, LocalIPAddress: '%12', RemoteIPAddress: '%14', LocalPort: '%16', RemotePort: '%18', Protocol: %19, Weight: %20, Stateful: %21, IdleSessionTimeout: %22, VirtualSubnetId: %23. Reason: %24

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Action` UInt32
`LocalIPAddrLen` UInt32
`LocalIPAddr` UnicodeString
`RemoteIPAddrLen` UInt32
`RemoteIPAddr` UnicodeString
`LocalPortLen` UInt32
`LocalPort` UnicodeString
`RemotePortLen` UInt32
`RemotePort` UnicodeString
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`Weight` UInt32
`Stateful` Boolean
`IdleSessionTimeout` UInt32
`VirtualSubnetId` UInt32
`FailReason` UInt32

Event ID 131: A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Direction extended port ACL entry w...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Task: PktDrop

Description

A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Direction extended port ACL entry with weight Weight.

Message #

A packet was dropped on port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8) because the packet is filtered by %9 extended port ACL entry with weight %10.

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Weight` UInt32

Event ID 131: A packet was dropped on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName) because the packet is filtered by Direction extended port ACL entry with weight

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: PktDrop

Description

A packet was dropped on port (Friendly Name: ) on switch (Friendly Name: ) because the packet is filtered by extended port ACL entry with weight .

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Direction` UInt32	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Weight` UInt32

Event ID 132: The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to start because an extension failed to Activate

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The extension stack for Switch (Friendly Name: ) failed to start because an extension failed to Activate.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 132: The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to start because an extension failed to Activate.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

The extension stack for Switch SwitchName (Friendly Name: SwitchFName) failed to start because an extension failed to Activate.

Message #

The extension stack for Switch %3 (Friendly Name: %5) failed to start because an extension failed to Activate.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 133: RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Message #

RSS queue %7 from VMQ %6 of switch %2 (Friendly Name: %4) is marked as a moving candidate of processor %5.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ProcIndex` UInt32
`VmqIndex` UInt32
`RssQueueIndex` UInt32

Event ID 133: RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

RSS queue from VMQ of switch (Friendly Name: ) is marked as a moving candidate of processor .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ProcIndex` UInt32
`VmqIndex` UInt32
`RssQueueIndex` UInt32

Event ID 134: VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor ProcIndex.

Message #

VMQ %6 of switch %2 (Friendly Name: %4) is marked as a moving candidate of processor %5.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ProcIndex` UInt32
`VmqIndex` UInt32

Event ID 134: VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) is marked as a moving candidate of processor

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

VMQ of switch (Friendly Name: ) is marked as a moving candidate of processor .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ProcIndex` UInt32
`VmqIndex` UInt32

Event ID 135: Processor ProcIndex is over ProcUtil percent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Processor ProcIndex is over ProcUtil percent.

Message #

Processor %1 is over %2 percent.

Fields #

Name	Description
`ProcIndex` UInt32
`ProcUtil` UInt32

Event ID 135: Processor ProcIndex is over ProcUtil percent

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Processor is over percent.

Fields #

Name	Description
`ProcIndex` UInt32
`ProcUtil` UInt32

Event ID 136: Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Adjusted load of RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4) on processor %7 is %8 percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32

Event ID 136: Adjusted load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Adjusted load of RSS queue from VMQ of switch (Friendly Name: ) on processor is percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32

Event ID 137: Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Perspective load of RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4) on processor %7 is %8 percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32
`SafeThreshold` UInt32

Event ID 137: Perspective load of RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Perspective load of RSS queue from VMQ of switch (Friendly Name: ) on processor is percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32
`SafeThreshold` UInt32

Event ID 138: Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Adjusted load of VMQ %5 on switch %2 (Friendly Name: %4) on processor %6 is %7 percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32

Event ID 138: Adjusted load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Adjusted load of VMQ on switch (Friendly Name: ) on processor is percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32

Event ID 139: Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent.

Message #

Perspective load of VMQ %5 on switch %2 (Friendly Name: %4) on processor %6 is %7 percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32
`SafeThreshold` UInt32

Event ID 139: Perspective load of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) on processor ProcIndex is QueueLoad percent

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Perspective load of VMQ on switch (Friendly Name: ) on processor is percent.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`ProcIndex` UInt32
`QueueLoad` UInt32
`SafeThreshold` UInt32

Event ID 140: Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was updated.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was updated. The assigned processor for receives was ReceiveProcIndex, now DestinationReceiveProcIndex. The assigned channel for sends was SendProcIndex, now DestinationSendProcIndex.

Message #

Assigned processor of RSS queue %6 of VMQ %5 on switch %2 (Friendly Name: %4) was updated. The assigned processor for receives was %7, now %9. The assigned channel for sends was %8, now %10.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ReceiveProcIndex` UInt32
`SendProcIndex` UInt32
`DestinationReceiveProcIndex` UInt32
`DestinationSendProcIndex` UInt32

Event ID 140: Assigned processor of RSS queue RssQueueIndex of VMQ VmqIndex on switch SwitchName (Friendly Name: SwitchFName) was updated

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Assigned processor of RSS queue of VMQ on switch (Friendly Name: ) was updated. The assigned processor for receives was , now . The assigned channel for sends was , now .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` UInt32
`ReceiveProcIndex` UInt32
`SendProcIndex` UInt32
`DestinationReceiveProcIndex` UInt32
`DestinationSendProcIndex` UInt32

Event ID 141: The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: SwitchFName) has been IsActivate on processor ProcIndex.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Task: VmqMove

Description

The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: SwitchFName) has been IsActivate on processor ProcIndex.

Message #

The RSS queue group of VMQ %6 from switch %2 (Friendly Name: %4) has been %5 on processor %7.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`IsActivate` UInt32
`VmqIndex` UInt32
`ProcIndex` UInt32

Event ID 141: The RSS queue group of VMQ VmqIndex from switch SwitchName (Friendly Name: SwitchFName) has been IsActivate on processor

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

The RSS queue group of VMQ from switch (Friendly Name: ) has been on processor .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`IsActivate` UInt32
`VmqIndex` UInt32
`ProcIndex` UInt32

Event ID 142: Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Virtual RSS configuration update failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status. Reason: FailReason.

Message #

Virtual RSS configuration update failed on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8) with status %10. Reason: %9.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`Status` UInt32	NTSTATUS reference
`Flags` UInt32
`BaseCpuNumber` UInt32
`HashInformation` UInt32
`IndirectionTableSize` UInt32
`IndirectionTableOffset` UInt32
`HashSecretKeySize` UInt32
`HashSecretKeyOffset` UInt32

Event ID 143: Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Verbose
Opcode: Info

Description

Virtual RSS configuration update succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Message #

Virtual RSS configuration update succeeded on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`BaseCpuNumber` UInt32
`HashInformation` UInt32
`IndirectionTableSize` UInt32
`IndirectionTableOffset` UInt32
`HashSecretKeySize` UInt32
`HashSecretKeyOffset` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 143,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388064,
    "time_created": "2026-03-11T06:32:02.612643+00:00",
    "event_record_id": 41,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1672
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 0,
    "BaseCpuNumber": 0,
    "HashInformation": 5889,
    "IndirectionTableSize": 512,
    "IndirectionTableOffset": 40,
    "HashSecretKeySize": 40,
    "HashSecretKeyOffset": 552
  },
  "message": ""
}

Event ID 144: Driver Verifier failure in vmswitch.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Driver Verifier failure in vmswitch. Reason: FailReason.

Message #

Driver Verifier failure in vmswitch. Reason: %1.

Fields #

Name	Description
`FailReason` UInt32

Event ID 144: Driver Verifier failure in vmswitch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Driver Verifier failure in vmswitch. Reason: .

Fields #

Name	Description
`FailReason` UInt32

Event ID 145: Policy configuration failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Policy configuration failed. Reason: FailReason.

Message #

Policy configuration failed. Reason: %1

Fields #

Name	Description
`FailReason` UInt32

Event ID 146: Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Ndk adapter failed to open on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 146: Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Ndk adapter failed to open on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Ndk adapter failed to open on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 147: Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Ndk adapter failed to close on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 147: Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Ndk adapter failed to close on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Ndk adapter failed to close on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 148: Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf of virtual NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Warning
Opcode: Info

Description

Ndk Oid NdisOid for external NIC PtNicName (Friendly Name: PtNicFName) on behalf of virtual NIC NicName (Friendly Name: NicFName). Status: Status. Reason: FailReason.

Message #

Ndk Oid %2 for external NIC %9 (Friendly Name: %11) on behalf of virtual NIC %5 (Friendly Name: %7). Status: %3. Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NdisOid` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 148,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2026-03-12T00:55:57.772989+00:00",
    "event_record_id": 718,
    "correlation": {},
    "execution": {
      "process_id": 10544,
      "thread_id": 11416
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "FailReason": 2,
    "NdisOid": 4228121090,
    "Status": 3221225485,
    "NicNameLen": 36,
    "NicName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "NicFNameLen": 3,
    "NicFName": "WSL",
    "PtNicNameLen": 1,
    "PtNicName": "",
    "PtNicFNameLen": 1,
    "PtNicFName": ""
  },
  "message": ""
}

Event ID 149: Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Ndk PnP event successfully sent for virtual NIC (Friendly Name: ).

Fields #

Name	Description
`FailReason` UInt32
`NetEvent` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 149: Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Ndk PnP event NetEvent successfully sent for virtual NIC NicName (Friendly Name: NicFName).

Message #

Ndk PnP event %2 successfully sent for virtual NIC %5 (Friendly Name: %7).

Fields #

Name	Description
`FailReason` UInt32
`NetEvent` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 150: Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Request RDMA failed for host virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 150: Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Request RDMA failed for host virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Request RDMA failed for host virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 151: Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 151: Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Nic Switch VPort update failed (for RDMA) on behalf of virtual NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 152: Replacing Member OldMember with new Member NewMember for load balancing.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Replacing Member OldMember with new Member NewMember for load balancing.

Message #

Replacing Member %1 with new Member %2 for load balancing

Fields #

Name	Description
`OldMember` GUID
`NewMember` GUID

Event ID 153: Excluding Member Member from load balancing.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Excluding Member Member from load balancing.

Message #

Excluding Member %1 from load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 154: Using Member Member for load balancing.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Using Member Member for load balancing.

Message #

Using Member %1 for load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 155: Starting ConnectTimer for Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Starting ConnectTimer for Member Member.

Message #

Starting ConnectTimer for Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 156: Stopping to use Member Member for load balancing.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Stopping to use Member Member for load balancing.

Message #

Stopping to use Member %1 for load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 157: Priming Switch for TeamNic TeamNic using Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Priming Switch for TeamNic TeamNic using Member Member.

Message #

Priming Switch for TeamNic %1 using Member %2

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID

Event ID 158: Failing NBL send on Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failing NBL send on Member Member.

Message #

Failing NBL send on Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 159: Failing NBL send on TeamNic TeamNic.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failing NBL send on TeamNic TeamNic.

Message #

Failing NBL send on TeamNic %1

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 160: Dropping NBLs on Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Dropping NBLs on Member Member.

Message #

Dropping NBLs on Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 161: DriverEntry exiting, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

DriverEntry exiting, Status = Status.

Message #

DriverEntry exiting, Status = %1

Fields #

Name	Description
`Status` Int32	NTSTATUS reference

Event ID 162: Member Member created.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Member Member created.

Message #

Member %1 created.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 163: Aggregator Aggregator created.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Aggregator Aggregator created.

Message #

Aggregator %1 created.

Fields #

Name	Description
`Aggregator` Pointer

Event ID 164: Member Member placed in Team TeamNic, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Member Member placed in Team TeamNic, Status = Status.

Message #

Member %2 placed in Team %1, Status = %3.

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 165: Indicating new link state for TeamNic TeamNic.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Indicating new link state for TeamNic TeamNic. StatusBuffer = StatusBuffer.

Message #

Indicating new link state for TeamNic %1. StatusBuffer = %3.

Fields #

Name	Description
`TeamNic` Pointer
`StatusBufferLen` UInt32
`StatusBuffer` Binary

Event ID 166: Default Aggregator for TeamNic TeamNic changed to Receiver.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Default Aggregator for TeamNic TeamNic changed to Receiver.

Message #

Default Aggregator for TeamNic %1 changed to %2.

Fields #

Name	Description
`TeamNic` Pointer
`Receiver` Pointer

Event ID 167: BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Message #

BroadcastReceiver for TeamNic %1 changed to %2.

Fields #

Name	Description
`TeamNic` Pointer
`Receiver` Pointer

Event ID 168: Initializing TeamNic TeamNic, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Initializing TeamNic TeamNic, Status = Status.

Message #

Initializing TeamNic %1, Status = %2.

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 169: Removing Aggregator Aggregator from TeamNic TeamNic.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Removing Aggregator Aggregator from TeamNic TeamNic.

Message #

Removing Aggregator %2 from TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Aggregator` Pointer

Event ID 170: Removed Member Member from TeamNic TeamNic.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Removed Member Member from TeamNic TeamNic.

Message #

Removed Member %2 from TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 171: Removing TeamNic TeamNic.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Removing TeamNic TeamNic.

Message #

Removing TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 172: MsLbfoProvider driver is unloading.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

MsLbfoProvider driver is unloading.

Message #

MsLbfoProvider driver is unloading.

Event ID 173: Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Message #

Changing Aggregator for Member %1 from %2 to %3.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer

Event ID 174: LACP Initializing for Member Member, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LACP Initializing for Member Member, Status = Status.

Message #

LACP Initializing for Member %1, Status = %2.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 175: LACP de-initialized for Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LACP de-initialized for Member Member.

Message #

LACP de-initialized for Member %1.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 176: Received LACPDU on Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Received LACPDU on Member Member. Buffer= Buffer.

Message #

Received LACPDU on Member %1. Buffer= %3.

Fields #

Name	Description
`Member` GUID
`BufferLen` UInt32
`Buffer` Binary

Event ID 177: LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Message #

LBFO LACP Member %1; ReceiveMachine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 178: LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Periodic Transmission Machine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 179: LBFO LACP Member Member; Mux Machine: OldState->NewState.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; Mux Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Mux Machine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 180: Sending LACPDU on Member Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Sending LACPDU on Member Member. Buffer= Buffer.

Message #

Sending LACPDU on Member %1. Buffer= %3.

Fields #

Name	Description
`Member` GUID
`BufferLen` UInt32
`Buffer` Binary

Event ID 181: LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Message #

LBFO LACP Member %1; Selected NewAgg: %3, Ready:%4.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer
`Ready` Boolean

Event ID 182: LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Message #

LBFO LACP Member %1; UnSelected, OldAgg: %2 NewAgg: %3.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer
`Ready` Boolean

Event ID 183: LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Message #

LBFO LACP Member %1; Churn Type (%2): %3->%4.

Fields #

Name	Description
`Member` GUID
`ChurnType` Int32
`OldState` Int32
`NewState` Int32

Event ID 184: Member Nic Member Connected

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Member Nic Connected.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 184: Member Nic Member Connected.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Member Nic Member Connected.

Message #

Member Nic %2 Connected.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 185: Member Nic Member Disconnected

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Member Nic Disconnected.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 185: Member Nic Member Disconnected.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Member Nic Member Disconnected.

Message #

Member Nic %2 Disconnected.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 186: Connection Timer Started for Member Nic

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Connection Timer Started for Member Nic . It will be in use shortly.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 186: Connection Timer Started for Member Nic Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Connection Timer Started for Member Nic Member. It will be in use shortly.

Message #

Connection Timer Started for Member Nic %2. It will be in use shortly.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 187: LACP Churn detected on Member Nic

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

LACP Churn detected on Member Nic .

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 187: LACP Churn detected on Member Nic Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

LACP Churn detected on Member Nic Member.

Message #

LACP Churn detected on Member Nic %2.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 188: Use of Vlan detected on non-default Team Nic

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Use of Vlan detected on non-default Team Nic.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 188: Use of Vlan detected on non-default Team Nic Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Use of Vlan detected on non-default Team Nic Member.

Message #

Use of Vlan detected on non-default Team Nic %2

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 189: MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic.

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 189: MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic Member.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic Member.

Message #

MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic %2

Fields #

Name	Description
`DriverObject` UnicodeString
`Member` UnicodeString

Event ID 190: Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to update NIC NDIS QoS with miniport NIC (Friendly Name: ), status = . UniqueEvent =.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 190: Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to update NIC NDIS QoS with miniport NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to update NIC NDIS QoS with miniport NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 191: Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Successfully updated NIC NDIS QoS with Miniport NIC (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 191: Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Successfully updated NIC NDIS QoS with Miniport NIC NicName (Friendly Name: NicFName).

Message #

Successfully updated NIC NDIS QoS with Miniport NIC %2 (Friendly Name: %4)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 192: Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS QoS settings

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 192: Team NIC NicName (Friendly Name: NicFName) has inconsistent consolidated NDIS QoS settings.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Team NIC %2 (Friendly Name: %4) has inconsistent consolidated NDIS QoS settings. This is normally be due to a transient state where the member adapters are updating their settings. This message can safely ignored if it is soon followed by a message specifying that the team now has consistent consolidated NDIS QoS settings.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 193: Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS settings

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Team NIC (Friendly Name: ) has consistent consolidated NDIS QoS settings.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 193: Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS settings.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Team NIC NicName (Friendly Name: NicFName) has consistent consolidated NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) has consistent consolidated NDIS QoS settings.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 194: Operation operation failed for NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Operation operation failed for NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: FailureCode.

Message #

%5 operation failed for NIC %2 (Friendly Name: %4). Reason: %7, Error Code: %6

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`FailureCode` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`Ext1` UInt32
`Ext2` UInt32

Event ID 195: Switch Extension Operation operation failed for NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch Extension Operation operation failed for NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: FailureCode.

Message #

Switch Extension %5 operation failed for NIC %2 (Friendly Name: %4). Reason: %7, Error Code: %6

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`FailureCode` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`Ext1` UInt32
`HeaderType` UInt32
`HeaderRevision` UInt32
`HeaderSize` UInt32
`ExtensionId` GUID
`FeatureId` GUID
`SaveDataSize` UInt32
`SaveDataSizeOverflow` UInt32

Event ID 196: Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch Extension Operation operation succeeded for NIC NicName (Friendly Name: NicFName).

Message #

Switch Extension %5 operation succeeded for NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`FailureCode` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`Ext1` UInt32
`HeaderType` UInt32
`HeaderRevision` UInt32
`HeaderSize` UInt32
`ExtensionId` GUID
`FeatureId` GUID
`SaveDataSize` UInt32
`SaveDataSizeOverflow` UInt32

Event ID 197: Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: NicName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set filter for VLAN Id on NIC (Friendly Name: ). Reason -.

Fields #

Name	Description
`VlanID` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`FailReason` UInt32

Event ID 197: Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: NicName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set filter for VLAN Id VlanID on NIC NicNameLen (Friendly Name: NicName). Reason - NicFNameLen.

Message #

Failed to set filter for VLAN Id %1 on NIC %2 (Friendly Name: %3). Reason - %4

Fields #

Name	Description
`VlanID` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`FailReason` UInt32

Event ID 198: VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). RSS was succesfully enabled.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). RSS was succesfully enabled.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 199: VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). RSS could not be enabled. Reason: FailureReason, Error Code: Status.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). RSS could not be enabled. Reason: %6, Error Code: %5

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 200: Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Neither VMQ nor RSS are supported on the external NIC NicName (Friendly Name: NicFName).

Message #

Neither VMQ nor RSS are supported on the external NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 201: VMQ is disabled on the external NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

VMQ is disabled on the external NIC NicName (Friendly Name: NicFName). The RSS could not be updated to be synchronized with the host. Reason: FailureReason, Error Code: Status.

Message #

VMQ is disabled on the external NIC %2 (Friendly Name: %4). The RSS could not be updated to be synchronized with the host. Reason: %6, Error Code: %5

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 201: VMQ is disabled on the external NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMQ is disabled on the external NIC (Friendly Name: ). The RSS could not be updated to be synchronized with the host. Reason: , Error Code.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 202: Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new NDIS QoS settings

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Team NIC (Friendly Name: ) failed to indicate status for new NDIS QoS settings.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 202: Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new NDIS QoS settings.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Team NIC NicName (Friendly Name: NicFName) failed to indicate status for new NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) failed to indicate status for new NDIS QoS settings

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 203: Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new NDIS QoS settings

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Team NIC (Friendly Name: ) successfully indicate status for new NDIS QoS settings.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 203: Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new NDIS QoS settings.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Team NIC NicName (Friendly Name: NicFName) successfully indicate status for new NDIS QoS settings.

Message #

Team NIC %2 (Friendly Name: %4) successfully indicate status for new NDIS QoS settings

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 204: Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set filter on vPort (MAC address=, VLAN Id=). Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32
`VlanId` UInt32
`MacLength` UInt32
`MacAddress` UnicodeString

Event ID 204: Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId). Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to set filter %1 on vPort %2 (MAC address=%10, VLAN Id=%8). Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32
`VlanId` UInt32
`MacLength` UInt32
`MacAddress` UnicodeString

Event ID 205: Failed to move filter FilterId from vPort SrcVPortId to vPort

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to move filter from vPort to vPort . Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

Name	Description
`FilterId` UInt32
`SrcVPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32

Event ID 205: Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to move filter FilterId from vPort SrcVPortId to vPort DstVPortId. Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to move filter %1 from vPort %2 to vPort %7. Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`SrcVPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32

Event ID 206: Initialization of switch embedded team succeeded

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Initialization of switch embedded team succeeded. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 206: Initialization of switch embedded team succeeded.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Initialization of switch embedded team succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Initialization of switch embedded team succeeded. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 207: Initialization of switch embedded team failed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Initialization of switch embedded team failed. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues: . Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 207: Initialization of switch embedded team failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Initialization of switch embedded team failed. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues. Status: Status.

Message #

Initialization of switch embedded team failed. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8. Status: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 208: Pause of switch embedded team succeeded

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Pause of switch embedded team succeeded. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 208: Pause of switch embedded team succeeded.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Pause of switch embedded team succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Pause of switch embedded team succeeded. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 209: Initialization of switch embedded team failed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Initialization of switch embedded team failed. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues: . Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 209: Initialization of switch embedded team failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Message #

Initialization of switch embedded team failed. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8. Status: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 210: Switch embedded team is pre-detached

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch embedded team is pre-detached. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 210: Switch embedded team is pre-detached.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Switch embedded team is pre-detached. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Switch embedded team is pre-detached. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 211: Switch embedded team is completely detached

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch embedded team is completely detached. SwitchName (Friendly Name: ). Teaming Mode: . Load Balancing Algorithm: . VmqSumOfQueues.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 211: Switch embedded team is completely detached.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Switch embedded team is completely detached. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). Teaming Mode: TeamingMode. Load Balancing Algorithm: LoadBalancingAlgorithm. VmqSumOfQueues: VmqSumOfQueues.

Message #

Switch embedded team is completely detached. SwitchName %3 (Friendly Name: %5). Teaming Mode: %6. Load Balancing Algorithm: %7. VmqSumOfQueues: %8

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`TeamingMode` UInt32
`LoadBalancingAlgorithm` UInt32
`VmqSumOfQueues` Boolean

Event ID 212: NIC was successfully added to the switch embedded team

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC was successfully added to the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 212: NIC was successfully added to the switch embedded team.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NIC was successfully added to the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex.

Message #

NIC was successfully added to the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 213: NIC failed to be addeded to the switch embedded team

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC failed to be addeded to the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex: . Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 213: NIC failed to be addeded to the switch embedded team.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NIC failed to be addeded to the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex. Status: Status.

Message #

NIC failed to be addeded to the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10. Status: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 214: NIC was removed from the switch embedded team

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC was removed from the switch embedded team. SwitchName (Friendly Name: ). NIC Name: (Friendly Name: ). NicIndex.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 214: NIC was removed from the switch embedded team.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NIC was removed from the switch embedded team. SwitchName SwitchName (Friendly Name: SwitchFriendlyName). NIC Name: NicName (Friendly Name: NicFriendlyName). NicIndex: NicIndex.

Message #

NIC was removed from the switch embedded team. SwitchName %3 (Friendly Name: %5). NIC Name: %7 (Friendly Name: %9). NicIndex: %10

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFriendlyNameLen` UInt32
`NicFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 215: Failed to clear filter FilterId on vPort

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to clear filter on vPort . Status=. Parameters: VportsEnabled=, team=, NicIndex=.

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32

Event ID 215: Failed to clear filter FilterId on vPort vPortId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to clear filter FilterId on vPort vPortId. Status=Status. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Failed to clear filter %1 on vPort %2. Status=%3. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32

Event ID 216: Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Request RDMA failed for virtual machine NIC (Friendly Name: ) on external NIC (Friendly Name: ). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 216: Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Request RDMA failed for virtual machine NIC NicName (Friendly Name: NicFName) on external NIC PtNicName (Friendly Name: PtNicFName). Reason: FailReason.

Message #

Request RDMA failed for virtual machine NIC %3 (Friendly Name: %5) on external NIC %7 (Friendly Name: %9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicNameLen` UInt32
`PtNicName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 217: External NIC sent NDK PnP event but it failed to reach all miniports.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

External NIC sent NDK PnP event but it failed to reach all miniports. Ndk PnP event NetEvent from physical NIC NicNameLen (Friendly Name: NicFNameLen). Status: Status. Reason: FailReason.

Message #

External NIC sent NDK PnP event but it failed to reach all miniports. Ndk PnP event %2 from physical NIC %4 (Friendly Name: %6). Status: %3. Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NetEvent` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 218: NIC NicName (Friendly Name: NicFName) queried isolation information on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Message #

NIC %2 (Friendly Name: %4) queried isolation information on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). RoutingDomainCount: %13, MultiTenantStackEnabled: %14, Status: %15, Ext1: %16, Ext2: %17

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`RoutingDomainCount` UInt32
`MultiTenantStackEnabled` Boolean
`Status` UInt32	NTSTATUS reference
`Ext1` UInt32
`Ext2` UInt32

Event ID 219: NIC NicName (Friendly Name: NicFName) queried isolation information on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Message #

NIC %2 (Friendly Name: %4) queried isolation information on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). RoutingDomainCount: %13, MultiTenantStackEnabled: %14, Status: %15, Ext1: %16, Ext2: %17

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`RoutingDomainCount` UInt32
`MultiTenantStackEnabled` Boolean
`Status` UInt32	NTSTATUS reference
`Ext1` UInt32
`Ext2` UInt32

Event ID 219: NIC NicName (Friendly Name: NicFName) queried isolation information on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC (Friendly Name: ) queried isolation information on port (Friendly Name: ) on switch (Friendly Name: ). RoutingDomainCount: , MultiTenantStackEnabled: , Status: , Ext1: , Ext2.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`RoutingDomainCount` UInt32
`MultiTenantStackEnabled` Boolean
`Status` UInt32	NTSTATUS reference
`Ext1` UInt32
`Ext2` UInt32

Event ID 220: Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: Informational
Opcode: Info

Description

Status change (NicStatus) sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). NicStatus: NicStatus, Status: Status.

Message #

Status change (%13) sent to Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). NicStatus: %13, Status: %14

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicStatus` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 220,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2026-03-11T06:32:02.568678+00:00",
    "event_record_id": 39,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 1672
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "NicStatus": 8,
    "Status": 0
  },
  "message": ""
}

Event ID 221: Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). ObjectState: ObjectState, NicState: NicState, NicPaused: NicPaused, BuffersNotReady: BuffersNotReady.

Message #

Data path usage blocked for Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). ObjectState: %13, NicState: %14, NicPaused: %15, BuffersNotReady: %16

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ObjectState` UInt32
`NicState` UInt32
`NicPaused` Boolean
`BuffersNotReady` Boolean

Event ID 221: Data path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Data path usage blocked for Nic (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). ObjectState: , NicState: , NicPaused: , BuffersNotReady.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ObjectState` UInt32
`NicState` UInt32
`NicPaused` Boolean
`BuffersNotReady` Boolean

Event ID 222: Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Opcode: Info

Description

Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). ObjectState: ObjectState, NicState: NicState, NicPaused: NicPaused, BuffersNotReady: BuffersNotReady.

Message #

Control path usage blocked for Nic %2 (Friendly Name: %4) on port %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12). ObjectState: %13, NicState: %14, NicPaused: %15, BuffersNotReady: %16

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ObjectState` UInt32
`NicState` UInt32
`NicPaused` Boolean
`BuffersNotReady` Boolean

Event ID 222: Control path usage blocked for Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Control path usage blocked for Nic (Friendly Name: ) on port (Friendly Name: ) on switch (Friendly Name: ). ObjectState: , NicState: , NicPaused: , BuffersNotReady.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ObjectState` UInt32
`NicState` UInt32
`NicPaused` Boolean
`BuffersNotReady` Boolean

Event ID 223: Rundown: Switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Rundown: Switch SwitchName (Friendly Name: SwitchFName).

Message #

Rundown: Switch %2 (Friendly Name: %4).

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 223,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x2000000000000080",
    "time_created": "2026-06-02T05:52:50.480+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 13576,
      "thread_id": 6192
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "SwitchFName": "Default Switch",
    "SwitchFNameLen": 14,
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchNameLen": 36
  },
  "message": ""
}

Event ID 223: Rundown: Switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Rundown: Switch (Friendly Name: ).

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 224: Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

Rundown: Port %2 (Friendly Name: %4) on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 224,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x2000000000000080",
    "time_created": "2026-06-02T05:52:50.480+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 13576,
      "thread_id": 6192
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PortFName": "Default Switch",
    "PortFNameLen": 14,
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortNameLen": 36,
    "SwitchFName": "Default Switch",
    "SwitchFNameLen": 14,
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchNameLen": 36
  },
  "message": ""
}

Event ID 224: Rundown: Port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Rundown: Port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Event ID 225: Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Virtual RSS configuration initialization failed on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName) with status Status. Reason: FailReason.

Message #

Virtual RSS configuration initialization failed on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8) with status %10. Reason: %9.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`FailReason` UInt32
`Status` UInt32	NTSTATUS reference
`Flags` UInt32
`BaseCpuNumber` UInt32
`HashInformation` UInt32
`IndirectionTableSize` UInt32
`IndirectionTableOffset` UInt32
`HashSecretKeySize` UInt32
`HashSecretKeyOffset` UInt32

Event ID 226: Virtual RSS configuration initialization succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Virtual RSS configuration initialization succeeded on NIC NicName (Friendly Name: NicFName) of switch SwitchName (Friendly Name: SwitchFName).

Message #

Virtual RSS configuration initialization succeeded on NIC %2 (Friendly Name: %4) of switch %6 (Friendly Name: %8).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`BaseCpuNumber` UInt32
`HashInformation` UInt32
`IndirectionTableSize` UInt32
`IndirectionTableOffset` UInt32
`HashSecretKeySize` UInt32
`HashSecretKeyOffset` UInt32

Event ID 227: Failed to complete offload policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DefaultQueueVrssEnabledRequested - DefaultQueueVrssEnabled, DefaultQueueVmmqEnabledRequeste...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DefaultQueueVrssEnabled` Boolean
`DefaultQueueVmmqEnabled` Boolean
`DefaultQueueVrssMaxQueuePairs` Int32
`DefaultQueueVrssMinQueuePairs` Int32
`DefaultQueueVrssQueueSchedulingMode` UInt32
`DefaultQueueVrssExcludePrimaryProcessor` Boolean
`DefaultQueueVrssIndependentHostSpreading` Boolean
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 227: Failed to complete offload policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DefaultQueueVrssEnabledRequested - DefaultQueueVrssEnabled, DefaultQueueVmmqEnabledRe...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Failed to complete offload policy operation '%14' on switch %3 (Friendly Name: %5) DefaultQueueVrssEnabledRequested - %6, DefaultQueueVmmqEnabledRequested - %7, DefaultQueueVrssMaxQueuePairsRequested - %8, DefaultQueueVrssMinQueuePairs - %9, DefaultQueueVrssQueueSchedulingMode - %10, DefaultQueueVrssExcludePrimaryProcessor - %11, DefaultQueueVrssIndependentHostSpreading - %12 Reason - %13, Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DefaultQueueVrssEnabled` Boolean
`DefaultQueueVmmqEnabled` Boolean
`DefaultQueueVrssMaxQueuePairs` Int32
`DefaultQueueVrssMinQueuePairs` Int32
`DefaultQueueVrssQueueSchedulingMode` UInt32
`DefaultQueueVrssExcludePrimaryProcessor` Boolean
`DefaultQueueVrssIndependentHostSpreading` Boolean
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 228: Completed offload policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DefaultQueueVrssEnabledRequested - DefaultQueueVrssEnabled, DefaultQueueVmmqEnabledRequested -...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Message #

Completed offload policy operation '%12' on switch %2 (Friendly Name: %4) DefaultQueueVrssEnabledRequested - %5, DefaultQueueVmmqEnabledRequested - %6, DefaultQueueVrssMaxQueuePairsRequested - %7, DefaultQueueVrssMinQueuePairs - %8, DefaultQueueVrssQueueSchedulingMode - %9, DefaultQueueVrssExcludePrimaryProcessor - %10, DefaultQueueVrssIndependentHostSpreading %11

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DefaultQueueVrssEnabled` Boolean
`DefaultQueueVmmqEnabled` Boolean
`DefaultQueueVrssMaxQueuePairs` Int32
`DefaultQueueVrssMinQueuePairs` Int32
`DefaultQueueVrssQueueSchedulingMode` UInt32
`DefaultQueueVrssExcludePrimaryProcessor` Boolean
`DefaultQueueVrssIndependentHostSpreading` Boolean
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 229: Syncing TCP offloads for switch embedded teaming failed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName (Friendly Name: ), Physical Adapter (Friendly Name: ), NicIndex , Failure reason: .

Fields #

Name	Description
`FailReason` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`MemberAdapterNameLen` UInt32
`MemberAdapterName` UnicodeString
`MemberAdapterFriendlyNameLen` UInt32
`MemberAdapterFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 229: Syncing TCP offloads for switch embedded teaming failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName SwitchName (Friendly Name: SwitchFriendlyName), Physical Adapter MemberAdapterName (Friendly Name: MemberAdapterFriendlyName), NicIndex NicIndex, Failure reason: FailReason.

Message #

Syncing TCP offloads for switch embedded teaming failed. HNV might not work correctly. SwitchName %3 (Friendly Name: %5), Physical Adapter %7 (Friendly Name: %9), NicIndex %10, Failure reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`MemberAdapterNameLen` UInt32
`MemberAdapterName` UnicodeString
`MemberAdapterFriendlyNameLen` UInt32
`MemberAdapterFriendlyName` UnicodeString
`NicIndex` UInt32

Event ID 230: Syncing TCP offloads for switch embedded teaming succeeded

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName (Friendly Name: ) NvgreEnabled - VxLanEnabled - .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NvgreEnabled` Boolean
`VxLanEnabled` Boolean

Event ID 230: Syncing TCP offloads for switch embedded teaming succeeded.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName SwitchName (Friendly Name: SwitchFriendlyName) NvgreEnabled - NvgreEnabled VxLanEnabled - VxLanEnabled.

Message #

Syncing TCP offloads for switch embedded teaming succeeded. SwitchName %2 (Friendly Name: %4) NvgreEnabled - %5 VxLanEnabled - %6.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFriendlyNameLen` UInt32
`SwitchFriendlyName` UnicodeString
`NvgreEnabled` Boolean
`VxLanEnabled` Boolean

Event ID 231: A potentially looped back packet with MAC MacAddress was indicated to physical adapter MemberAdapterName (Friendly Name: MemberAdapterFriendlyName) since TimeDiff ms passed since it was last seen a...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

A potentially looped back packet with MAC was indicated to physical adapter (Friendly Name: ) since ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Message #

A potentially looped back packet with MAC %2 was indicated to physical adapter %4 (Friendly Name: %6) since %7 ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`MemberAdapterNameLen` UInt32
`MemberAdapterName` UnicodeString
`MemberAdapterFriendlyNameLen` UInt32
`MemberAdapterFriendlyName` UnicodeString
`TimeDiff` Int64

Event ID 231: A potentially looped back packet with MAC MacAddress was indicated to physical adapter MemberAdapterName (Friendly Name: MemberAdapterFriendlyName) since TimeDiff ms passed since it was last seen a...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

A potentially looped back packet with MAC was indicated to physical adapter (Friendly Name: ) since ms passed since it was last seen as the source MAC for a virtual NIC connected to the vSwitch.

Fields #

Name	Description
`MacAddressLen` UInt32
`MacAddress` UnicodeString
`MemberAdapterNameLen` UInt32
`MemberAdapterName` UnicodeString
`MemberAdapterFriendlyNameLen` UInt32
`MemberAdapterFriendlyName` UnicodeString
`TimeDiff` Int64

Event ID 232: NIC NicName (Friendly Name: NicFName) successfully connected to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4
Opcode: Info

Description

NIC (Friendly Name: ) successfully connected to port (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 232,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.5192158+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "PortNameLen": "36",
    "NicFNameLen": "14",
    "SwitchNameLen": "36",
    "SwitchFNameLen": "14",
    "PortFNameLen": "46",
    "PortFName": "Host Vnic C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "SwitchFName": "Default Switch",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFName": "Default Switch",
    "NicNameLen": "36"
  }
}

Event ID 232: NIC NicName (Friendly Name: NicFName) successfully connected to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

NIC NicName (Friendly Name: NicFName) successfully connected to port PortName (Friendly Name: PortFName) on switch SwitchName(Friendly Name: SwitchFName).

Message #

NIC %2 (Friendly Name: %4) successfully connected to port %6 (Friendly Name: %8) on switch %10(Friendly Name: %12).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 232,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.479516+00:00",
    "event_record_id": 2816,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10020
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 0,
    "NicFName": "",
    "PortNameLen": 36,
    "PortName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "PortFNameLen": 36,
    "PortFName": "AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL"
  },
  "message": ""
}

Event ID 233: The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4
Opcode: Info

Description

The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`NicInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 233,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.4273223+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "NicFNameLen": "14",
    "Operation": "7",
    "NicInstanceId": "{00000000-0000-0000-0000-000000000000}",
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFName": "Default Switch",
    "NicNameLen": "36"
  }
}

Event ID 233: The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

The operation 'Operation' succeeded on nic NicName (Friendly Name: NicFName), Instance Id NicInstanceId.

Message #

The operation '%5' succeeded on nic %2 (Friendly Name: %4), Instance Id %6.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`NicInstanceId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 233,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.465348+00:00",
    "event_record_id": 2815,
    "correlation": {},
    "execution": {
      "process_id": 9436,
      "thread_id": 10020
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-83-1-698845485-1245677379-4261864325-3027728797"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "29A7892D-8743-4A3F-85E3-06FE9D7977B4--AD2366C4-0BE2-4636-8124-F3BDDFD27E15",
    "NicFNameLen": 1,
    "NicFName": "",
    "Operation": 7,
    "NicInstanceId": "00000000-0000-0000-0000-000000000000"
  },
  "message": ""
}

Event ID 234: NIC NicName successfully disconnected from port

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC successfully disconnected from port .

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString

Event ID 234: NIC NicName successfully disconnected from port PortName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

NIC NicName successfully disconnected from port PortName.

Message #

NIC %2 successfully disconnected from port %4.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-13T20:25:35.577231+00:00",
    "event_record_id": 2195,
    "correlation": {},
    "execution": {
      "process_id": 8576,
      "thread_id": 3724
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-3597615443-1292995037-3776533383-3983578047"
    }
  },
  "event_data": {
    "NicNameLen": 74,
    "NicName": "D66F4153-89DD-4D11-8753-19E1BF9370ED--EA01A73B-3017-44F0-9B2D-E0B5034E70BF",
    "PortNameLen": 1,
    "PortName": ""
  },
  "message": ""
}

Event ID 235: NIC NicName disconnect from port PortName failed

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NIC disconnect from port failed. Status = , UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`UniqueEvent` UInt32

Event ID 235: NIC NicName disconnect from port PortName failed.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NIC NicName disconnect from port PortName failed. Status = Status, UniqueEvent = UniqueEvent.

Message #

NIC %3 disconnect from port %5 failed. Status = %1, UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`UniqueEvent` UInt32

Event ID 236: Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to allocate virtual function for NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 236: Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to allocate virtual function for NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to allocate virtual function for NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 237: Failed to enable Packet Direct for switch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializePD

Description

Failed to enable Packet Direct for switch .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reason` UInt32

Event ID 237: Failed to enable Packet Direct for switch SwitchFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializePD

Description

Failed to enable Packet Direct for switch SwitchFName. Reason.

Message #

Failed to enable Packet Direct for switch %4. %5

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Reason` UInt32

Event ID 238: Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: NicFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializePD

Description

Failed to setup Packet Direct access for virtual NIC (Friendly Name: ), status = . UniqueEvent = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 238: Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: NicFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializePD

Description

Failed to setup Packet Direct access for virtual NIC NicName (Friendly Name: NicFName), status = Status. UniqueEvent = UniqueEvent.

Message #

Failed to setup Packet Direct access for virtual NIC %3 (Friendly Name: %5), status = %1. UniqueEvent = %6.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 239: Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: SwitchFName), status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializePD

Description

Failed to setup Packet Direct data path on switch (Friendly Name: ), status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 239: Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializePD

Description

Failed to setup Packet Direct data path on switch SwitchName (Friendly Name: SwitchFName), status = Status.

Message #

Failed to setup Packet Direct data path on switch %3 (Friendly Name: %5), status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 240: PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %9 delivered to Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 240: PD Buffer BufferAddress delivered to Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

PD Buffer delivered to Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 241: PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %9 received from Nic %2 (Friendly Name: %4) in switch %6 (Friendly Name: %8)

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 241: PD Buffer BufferAddress received from Nic NicName (Friendly Name: NicFName) in switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

PD Buffer received from Nic (Friendly Name: ) in switch (Friendly Name: ).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 242: PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Diagnostic-Traffic
Opcode: Info

Description

PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName).

Message #

PD Buffer %13 routed from Nic %2 (Friendly Name: %4) to Nic %6 (Friendly Name: %8) on switch %10 (Friendly Name: %12)

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 242: PD Buffer BufferAddress routed from Nic SrcNicName (Friendly Name: SrcNicFName) to Nic DestNicName (Friendly Name: DestNicFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

PD Buffer routed from Nic (Friendly Name: ) to Nic (Friendly Name: ) on switch (Friendly Name: ).

Fields #

Name	Description
`SrcNicNameLen` UInt32
`SrcNicName` UnicodeString
`SrcNicFNameLen` UInt32
`SrcNicFName` UnicodeString
`DestNicNameLen` UInt32
`DestNicName` UnicodeString
`DestNicFNameLen` UInt32
`DestNicFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`BufferAddress` Pointer

Event ID 243: Insufficient number of available MAC address filters for configuring RequestedVlanIDs Trunk VLAN IDs on IOV switch SwitchFName, NIC

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Insufficient number of available MAC address filters for configuring Trunk VLAN IDs on IOV switch , NIC .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`AvailableAddressFilters` UInt32
`RequestedVlanIDs` UInt32

Event ID 243: Insufficient number of available MAC address filters for configuring RequestedVlanIDs Trunk VLAN IDs on IOV switch SwitchFName, NIC NicFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Insufficient number of available MAC address filters for configuring RequestedVlanIDs Trunk VLAN IDs on IOV switch SwitchFName, NIC NicFName.

Message #

Insufficient number of available MAC address filters for configuring %10 Trunk VLAN IDs on IOV switch %4, NIC %8.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`AvailableAddressFilters` UInt32
`RequestedVlanIDs` UInt32

Event ID 244: Insufficient number of available MAC address filters for configuring RequestedVlanIDs Routing Domain VLANs on IOV switch SwitchFName, NIC

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Insufficient number of available MAC address filters for configuring Routing Domain VLANs on IOV switch , NIC .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`AvailableAddressFilters` UInt32
`RequestedVlanIDs` UInt32

Event ID 244: Insufficient number of available MAC address filters for configuring RequestedVlanIDs Routing Domain VLANs on IOV switch SwitchFName, NIC NicFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Insufficient number of available MAC address filters for configuring RequestedVlanIDs Routing Domain VLANs on IOV switch SwitchFName, NIC NicFName.

Message #

Insufficient number of available MAC address filters for configuring %10 Routing Domain VLANs on IOV switch %4, NIC %8.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`AvailableAddressFilters` UInt32
`RequestedVlanIDs` UInt32

Event ID 245: Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Successfully set filter FilterId on vPort vPortId (MAC address=MacAddress, VLAN Id=VlanId). Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully set filter %1 on vPort %2 (MAC address=%10, VLAN Id=%8). Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32
`VlanId` UInt32
`MacLength` UInt32
`MacAddress` UnicodeString

Event ID 246: Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Successfully moved filter FilterId from vPort SrcVPortId to vPort DstVPortId. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully moved filter %1 from vPort %2 to vPort %7. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`SrcVPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`DstVPortId` UInt32

Event ID 247: Successfully cleared filter FilterId on vPort vPortId.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Successfully cleared filter FilterId on vPort vPortId. Parameters: VportsEnabled=VportsSupported, team=EmbeddedTeaming, NicIndex=NicIndex.

Message #

Successfully cleared filter %1 on vPort %2. Parameters: VportsEnabled=%4, team=%5, NicIndex=%6

Fields #

Name	Description
`FilterId` UInt32
`vPortId` UInt32
`Status` UInt32	NTSTATUS reference
`VportsSupported` Boolean
`EmbeddedTeaming` Boolean
`NicIndex` UInt32

Event ID 248: Send spreading was successfully enabled on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Send spreading was successfully enabled on NIC NicName (Friendly Name: NicFName).

Message #

Send spreading was successfully enabled on NIC %2 (Friendly Name: %4).

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 249: The system is not ready to enable send spreading on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

The system is not ready to enable send spreading on NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: Status.

Message #

The system is not ready to enable send spreading on NIC %2 (Friendly Name: %4). Reason: %6, Error Code: %5

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 250: Send spreading on NIC NicName (Friendly Name: NicFName) is not supported.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Send spreading on NIC NicName (Friendly Name: NicFName) is not supported. Reason: FailureReason, Error Code: Status.

Message #

Send spreading on NIC %2 (Friendly Name: %4) is not supported. Reason: %6, Error Code: %5

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 251: Failed to enable send spreading on NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to enable send spreading on NIC NicName (Friendly Name: NicFName). Reason: FailureReason, Error Code: Status.

Message #

Failed to enable send spreading on NIC %2 (Friendly Name: %4). Reason: %6, Error Code: %5

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureReason` UInt32	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.

Event ID 252: Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch SwitchName (Friendly Name: SwitchFName) due to low resource on the physical NIC has increased to ...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Memory allocated for packets in a vRss queue (on CPU %5) on switch %2 (Friendly Name: %4) due to low resource on the physical NIC has increased to %6MB. Packets will be dropped once queue size reaches %7MB.

Fields #

Name	Description
`SwitchNameLen` UInt32 → unsignedInt
`SwitchName` UnicodeString → string
`SwitchFNameLen` UInt32 → unsignedInt
`SwitchFName` UnicodeString → string
`ProcessorIndex` UInt32 → unsignedInt
`QueueSizeMBytes` UInt32 → unsignedInt
`QueueLimitMBytes` UInt32 → unsignedInt

Event ID 253: Memory allocated for packets in a vRss queue (on CPU ProcessorIndex) on switch SwitchName (Friendly Name: SwitchFName) due to low resource on the physical NIC has reduced to QueueSizeMBytesMB.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Message #

Memory allocated for packets in a vRss queue (on CPU %5) on switch %2 (Friendly Name: %4) due to low resource on the physical NIC has reduced to %6MB.

Fields #

Name	Description
`SwitchNameLen` UInt32 → unsignedInt
`SwitchName` UnicodeString → string
`SwitchFNameLen` UInt32 → unsignedInt
`SwitchFName` UnicodeString → string
`ProcessorIndex` UInt32 → unsignedInt
`QueueSizeMBytes` UInt32 → unsignedInt
`QueueLimitMBytes` UInt32 → unsignedInt

Event ID 254: Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Sending Ndk PnP event failed for virtual NIC (Friendly Name: ). Status: . Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NetEvent` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 254: Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Sending Ndk PnP event NetEvent failed for virtual NIC NicName (Friendly Name: NicFName). Status: Status. Reason: FailReason.

Message #

Sending Ndk PnP event %2 failed for virtual NIC %5 (Friendly Name: %7). Status: %3. Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NetEvent` UInt32
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 255: Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName) succeeded.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Setting Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName) succeeded.

Message #

Setting Rdma weight %10 on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9) succeeded.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`RdmaWeight` UInt32
`FailReason` UInt32

Event ID 256: Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to set Rdma weight on port (Friendly Name ) connected to Nic (Friendly Name ). Status = , Failure Reason.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`RdmaWeight` UInt32
`FailReason` UInt32

Event ID 256: Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to set Rdma weight RdmaWeight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName). Status = Status, Failure Reason : FailReason.

Message #

Failed to set Rdma weight %10 on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9). Status = %1, Failure Reason : %11

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`RdmaWeight` UInt32
`FailReason` UInt32

Event ID 257: Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to retrieve Rdma weight on port (Friendly Name ) connected to Nic (Friendly Name ). Status = , Failure Reason.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`RdmaWeight` UInt32
`FailReason` UInt32

Event ID 257: Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to retrieve Rdma weight on port PortName (Friendly Name PortFName) connected to Nic NicName (Friendly Name NicFName). Status = Status, Failure Reason : FailReason.

Message #

Failed to retrieve Rdma weight on port %3 (Friendly Name %5) connected to Nic %7 (Friendly Name %9). Status = %1, Failure Reason : %11

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`RdmaWeight` UInt32
`FailReason` UInt32

Event ID 258: Failed to get stored VlanID for Physical NIC

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to get stored VlanID for Physical NIC . Status =.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 258: Failed to get stored VlanID for Physical NIC NicName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to get stored VlanID for Physical NIC NicName. Status = Status.

Message #

Failed to get stored VlanID for Physical NIC %3. Status = %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 259: Underlying network adapter failed to execute critical OID request

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: , error: , adapter name: .

Fields #

Name	Description
`NdisOid` UInt32
`OidFailureStatus` UInt32
`FailureMode` UInt32
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 259: Underlying network adapter failed to execute critical OID request.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: NdisOid, error: OidFailureStatus, adapter name: PtNicFName.

Message #

Underlying network adapter failed to execute critical OID request. Such failure may cause hang in Hyper-V Switch component. Request: %1, error: %2, adapter name: %11.

Fields #

Name	Description
`NdisOid` UInt32
`OidFailureStatus` UInt32
`FailureMode` UInt32
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PtNicFNameLen` UInt32
`PtNicFName` UnicodeString

Event ID 260: Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName), ndisStatus =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: VmqMove

Description

Failed to move RSS queue from VMQ of switch (Friendly Name: ), ndisStatus = .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` Int16
`NdisStatus` Int32

Event ID 260: Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName), ndisStatus = NdisStatus .

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: VmqMove

Description

Failed to move RSS queue RssQueueIndex from VMQ VmqIndex of switch SwitchName (Friendly Name: SwitchFName), ndisStatus = NdisStatus .

Message #

Failed to move RSS queue %6 from VMQ %5 of switch %2 (Friendly Name: %4), ndisStatus = %7 .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`VmqIndex` UInt32
`RssQueueIndex` Int16
`NdisStatus` Int32

Event ID 261: Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropLowResourcesPackets` Boolean
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 261: Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to complete performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets, Reason - FailReason, Status = Status.

Message #

Failed to complete performance policy operation '%8' on switch %3 (Friendly Name: %5) DropLowResourcesPackets - %6, Reason - %7, Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropLowResourcesPackets` Boolean
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 262: Completed performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed performance policy operation 'Operation' on switch SwitchName (Friendly Name: SwitchFName) DropLowResourcesPackets - DropLowResourcesPackets.

Message #

Completed performance policy operation '%6' on switch %2 (Friendly Name: %4) DropLowResourcesPackets - %5

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`DropLowResourcesPackets` Boolean
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 263: Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC config

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: InitializeNIC

Description

Miniport NIC (Friendly Name: ) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 263: Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC config.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: InitializeNIC

Description

Miniport NIC NicName (Friendly Name: NicFName) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Message #

Miniport NIC %2 (Friendly Name: %4) is operating in sub-optimal RSC config. Please keep RSC IPv4 and IPv6 advanced properties in sync.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 264: Internal or External Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4
Opcode: Info

Description

Internal or External Port (Friendly Name: ) successfully created on switch (Friendly Name: ).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 264,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.3031594+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "SwitchFName": "Default Switch",
    "SwitchNameLen": "36",
    "SwitchFNameLen": "14",
    "Flags": "1",
    "PortFNameLen": "46",
    "OwnerService": "1",
    "PortNameLen": "36",
    "SwitchName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortFName": "Host Vnic C08CB7B8-9B3C-408E-8E30-5E16A3AEB444"
  }
}

Event ID 264: Internal or External Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

Internal or External Port PortName (Friendly Name: PortFName) successfully created on switch SwitchName (Friendly Name: SwitchFName).

Message #

Internal or External Port %2 (Friendly Name: %4) successfully created on switch %6 (Friendly Name: %8).

Fields #

Name	Description
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`Flags` UInt32
`OwnerService` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 264,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2026-03-11T06:32:02.039872+00:00",
    "event_record_id": 2811,
    "correlation": {},
    "execution": {
      "process_id": 2820,
      "thread_id": 6780
    },
    "channel": "System",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PortNameLen": 36,
    "PortName": "B95D0C5E-57D4-412B-B571-18A81A16E004",
    "PortFNameLen": 46,
    "PortFName": "Host Vnic B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchNameLen": 36,
    "SwitchName": "B95D0C5E-57D4-412B-B571-18A81A16E005",
    "SwitchFNameLen": 3,
    "SwitchFName": "WSL",
    "Flags": 1,
    "OwnerService": 1
  },
  "message": ""
}

Event ID 265: Traffic flow has been paused on external NIC NicFName of switch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Traffic flow has been paused on external NIC of switch .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 265: Traffic flow has been paused on external NIC NicFName of switch SwitchFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Traffic flow has been paused on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow has been paused on external NIC %8 of switch %4.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 266: Traffic flow has been restarted on external NIC NicFName of switch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Traffic flow has been restarted on external NIC of switch .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 266: Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Traffic flow has been restarted on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow has been restarted on external NIC %8 of switch %4.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 267: IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: Servicing

Description

IOCTL Operation completed with status in ms.

Fields #

Name	Description
`IoctlCode` UInt32
`ElapsedTime` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 267: IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: Servicing

Description

IOCTL Operation IoctlCode completed with status Status in ElapsedTime ms.

Message #

IOCTL Operation %1 completed with status %3 in %2 ms

Fields #

Name	Description
`IoctlCode` UInt32
`ElapsedTime` UInt64
`Status` UInt32	NTSTATUS reference

Event ID 268: Connectivity state changed to

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Task: Servicing

Description

Connectivity state changed to.

Fields #

Name	Description
`ConnectivityState` UInt32

Event ID 268: Connectivity state changed to ConnectivityState.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Task: Servicing

Description

Connectivity state changed to ConnectivityState.

Message #

Connectivity state changed to %1

Fields #

Name	Description
`ConnectivityState` UInt32

Event ID 269: Failed to get Device VlanID Regkey for Physical NIC

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to get Device VlanID Regkey for Physical NIC . vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status =.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 269: Failed to get Device VlanID Regkey for Physical NIC NicName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to get Device VlanID Regkey for Physical NIC NicName. vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status = Status.

Message #

Failed to get Device VlanID Regkey for Physical NIC %3. vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status = %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 270: Traffic flow is pausing on external NIC NicFName of switch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Traffic flow is pausing on external NIC of switch .

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 270: Traffic flow is pausing on external NIC NicFName of switch SwitchFName.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Traffic flow is pausing on external NIC NicFName of switch SwitchFName.

Message #

Traffic flow is pausing on external NIC %8 of switch %4.

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 275: Failed to handle status from extension stack sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to handle status from extension stack sent to Nic NicName (Friendly Name: NicFName) on port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). StatusCode: UniqueEvent, Status: Status.

Message #

Failed to handle status from extension stack sent to Nic %3 (Friendly Name: %5) on port %7 (Friendly Name: %9) on switch %11 (Friendly Name: %13). StatusCode: %14, Status: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`PortNameLen` UInt32
`PortName` UnicodeString
`PortFNameLen` UInt32
`PortFName` UnicodeString
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`UniqueEvent` UInt32

Event ID 276: Could not allocate virtual function for NIC NicName (Friendly Name: NicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Could not allocate virtual function for NIC (Friendly Name: ). Host to guest communication channel has not been established yet, status = .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 276: Could not allocate virtual function for NIC NicName (Friendly Name: NicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Could not allocate virtual function for NIC NicName (Friendly Name: NicFName). Host to guest communication channel has not been established yet, status = Status.

Message #

Could not allocate virtual function for NIC %3 (Friendly Name: %5). Host to guest communication channel has not been established yet, status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`UniqueEvent` UInt32

Event ID 277: vmswitch

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

vmswitch.sys build .., debug , official.

Fields #

Name	Description
`BuildNumber` UInt32
`BuildArch` AnsiString
`BuildBranch` AnsiString
`Debug` Boolean
`Official` Boolean
`Date` AnsiString
`Time` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 277,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000080",
    "time_created": "2026-06-02T05:52:50.480+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 13576,
      "thread_id": 6192
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BuildArch": "amd64",
    "BuildBranch": "ge_release_svc_prod1",
    "BuildNumber": 26100,
    "Date": "1",
    "Debug": false,
    "Official": true,
    "Time": "1"
  },
  "message": ""
}

Event ID 277: vmswitch.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational
Opcode: Info

Description

vmswitch.sys build BuildNumber.BuildArch.BuildBranch, debug Debug, official Official, Date Time.

Message #

vmswitch.sys build %1.%2.%3, debug %4, official %5, %6 %7

Fields #

Name	Description
`BuildNumber` UInt32
`BuildArch` AnsiString
`BuildBranch` AnsiString
`Debug` Boolean
`Official` Boolean
`Date` AnsiString
`Time` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "{67DC0D66-3695-47C0-9642-33F76F7BD7AD}",
    "event_source_name": "",
    "event_id": 277,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775680,
    "time_created": "2026-06-13T13:54:16.0668979+00:00",
    "event_record_id": 2706,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 472
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BuildNumber": "26100",
    "BuildArch": "amd64",
    "BuildBranch": "ge_release_svc_prod1",
    "Debug": "false",
    "Official": "true",
    "Date": "1",
    "Time": "1"
  },
  "message": "vmswitch.sys build 26100.amd64.ge_release_svc_prod1, debug false, official true, 1 1"
}

Event ID 278: NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled because the mapped NIC (MappedNicNicName) is not the same as the requested mapped NIC (RequestedMappeNicFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NDK request for virtual NIC (Friendly Name: ) was disabled because the mapped NIC () is not the same as the requested mapped NIC (). Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`MappedNicNameLen` UInt32
`MappedNicNicName` UnicodeString
`RequestedMappedNicFNameLen` UInt32
`RequestedMappeNicFName` UnicodeString

Event ID 278: NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled because the mapped NIC (MappedNicNicName) is not the same as the requested mapped NIC (RequestedMappeNicFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NDK request for virtual NIC NicName (Friendly Name: NicFName) was disabled because the mapped NIC (MappedNicNicName) is not the same as the requested mapped NIC (RequestedMappeNicFName). Reason: FailReason.

Message #

NDK request for virtual NIC %3 (Friendly Name: %5) was disabled because the mapped NIC (%7) is not the same as the requested mapped NIC (%9). Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`MappedNicNameLen` UInt32
`MappedNicNicName` UnicodeString
`RequestedMappedNicFNameLen` UInt32
`RequestedMappeNicFName` UnicodeString

Event ID 279: NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled after being disabled on failover

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

NDK request for virtual NIC (Friendly Name: ) was re-enabled after being disabled on failover. Reason: .

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`MappedNicNameLen` UInt32
`MappedNicNicName` UnicodeString
`RequestedMappedNicFNameLen` UInt32
`RequestedMappeNicFName` UnicodeString

Event ID 279: NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled after being disabled on failover.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

NDK request for virtual NIC NicName (Friendly Name: NicFName) was re-enabled after being disabled on failover. Reason: FailReason.

Message #

NDK request for virtual NIC %3 (Friendly Name: %5) was re-enabled after being disabled on failover. Reason: %1.

Fields #

Name	Description
`FailReason` UInt32
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`MappedNicNameLen` UInt32
`MappedNicNicName` UnicodeString
`RequestedMappedNicFNameLen` UInt32
`RequestedMappeNicFName` UnicodeString

Event ID 280: VMS Utilization Plan Vport QueuePairs adjusted from requested number (RequestedNumberOfQueue) to actual (AdjustedNumberOfQueue)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMS Utilization Plan Vport QueuePairs adjusted from requested number () to actual (). Reason: NIC Name: (Friendly Name: ).

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RequestedNumberOfQueue` UInt32
`AdjustedNumberOfQueue` UInt32
`Reason` UInt32
`NicName` UnicodeString
`NicFriendlyName` UnicodeString

Event ID 280: VMS Utilization Plan Vport QueuePairs adjusted from requested number (RequestedNumberOfQueue) to actual (AdjustedNumberOfQueue).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

VMS Utilization Plan Vport QueuePairs adjusted from requested number (RequestedNumberOfQueue) to actual (AdjustedNumberOfQueue). Reason: Reason NIC Name: NicName (Friendly Name: NicFriendlyName).

Message #

VMS Utilization Plan Vport QueuePairs adjusted from requested number (%2) to actual (%3). Reason: %4 NIC Name: %5 (Friendly Name: %6).

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RequestedNumberOfQueue` UInt32
`AdjustedNumberOfQueue` UInt32
`Reason` UInt32
`NicName` UnicodeString
`NicFriendlyName` UnicodeString

Event ID 281: VMS Utilization Plan Vport QueuePairs failure

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

VMS Utilization Plan Vport QueuePairs failure. Reason: Status: . NIC Name: (Friendly Name: ).

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RequestedNumberOfQueue` UInt32
`AdjustedNumberOfQueue` UInt32
`Reason` UInt32
`NicName` UnicodeString
`NicFriendlyName` UnicodeString

Event ID 281: VMS Utilization Plan Vport QueuePairs failure.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

VMS Utilization Plan Vport QueuePairs failure. Reason: Reason Status: Status. NIC Name: NicName (Friendly Name: NicFriendlyName).

Message #

VMS Utilization Plan Vport QueuePairs failure. Reason: %4 Status: %1. NIC Name: %5 (Friendly Name: %6).

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`RequestedNumberOfQueue` UInt32
`AdjustedNumberOfQueue` UInt32
`Reason` UInt32
`NicName` UnicodeString
`NicFriendlyName` UnicodeString

Event ID 282: Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to find a VMBus Channel in servicing state for VM Nic (Name: ). VMS Servicing State: , Channel Servicing State: . A fresh channel created.

Fields #

Name	Description
`NicName` UnicodeString
`VMSServicingState` Boolean
`ChannelServicingState` Boolean

Event ID 282: Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Failed to find a VMBus Channel in servicing state for VM Nic (Name: NicName). VMS Servicing State: VMSServicingState, Channel Servicing State: ChannelServicingState. A fresh channel created.

Message #

Failed to find a VMBus Channel in servicing state for VM Nic (Name: %1). VMS Servicing State: %2, Channel Servicing State: %3. A fresh channel created.

Fields #

Name	Description
`NicName` UnicodeString
`VMSServicingState` Boolean
`ChannelServicingState` Boolean

Event ID 283: Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtension...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtensionCount Reason - FailReason, Status = Status.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ByPassExtensionStack` Boolean
`RequiredExtensionCount` UInt64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 283: Failed to complete extension policy operation 'FailReason' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack, RequiredExtensionCount - RequiredExtensionC...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Message #

Failed to complete extension policy operation '%8' on switch %3 (Friendly Name: %5) ByPassExtensionStack - %6,  RequiredExtensionCount - %7 Reason - %8, Status = %1.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ByPassExtensionStack` Boolean
`RequiredExtensionCount` UInt64
`FailReason` UInt32
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 284: Completed extension policy operation 'RequiredExtensionCount' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack RequiredExtensionCount - RequiredExtensio...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Completed extension policy operation 'RequiredExtensionCount' on switch SwitchName (Friendly Name: SwitchFName) ByPassExtensionStack - ByPassExtensionStack RequiredExtensionCount - RequiredExtensionCount.

Message #

Completed extension policy operation '%6' on switch %2 (Friendly Name: %4) ByPassExtensionStack - %5 RequiredExtensionCount - %6

Fields #

Name	Description
`SwitchNameLen` UInt32
`SwitchName` UnicodeString
`SwitchFNameLen` UInt32
`SwitchFName` UnicodeString
`ByPassExtensionStack` Boolean
`RequiredExtensionCount` UInt64
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.

Event ID 285: V-Switch operation OperationName (OperationId) took too long to complete.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Microsoft-Windows-Hyper-V-VmSwitch-Operational
Level: Warning
Opcode: Info

Description

V-Switch operation () took too long to complete. Operation Type: . Execution time ms. Queued time ms. Expected execution time less than ms. . .

Message #

V-Switch operation %1 (%3) took too long to complete. Operation Type: %2. Execution time %4 ms. Queued time %5 ms. Expected execution time less than %6 ms. %7 %8. %9 %10. %11 %12

Fields #

Name	Description
`OperationName` UnicodeString
`OperationType` UInt32	Known values `%%1904` New registry value created `%%1905` Existing registry value modified `%%1906` Registry value deleted `%%14674` Value Added `%%14675` Value Deleted `%%14680` Value Added With Expiration Time `%%14681` Value Deleted With Expiration Time `%%14688` Value Auto Deleted With Expiration Time
`OperationId` UInt32
`ExecutionTimeMS` UInt64
`QueuedTimeMS` UInt64
`SLAThresholdMS` UInt64
`ContextType1` UInt32
`ContextInfo1` UnicodeString
`ContextType2` UInt32
`ContextInfo2` UnicodeString
`ContextType3` UInt32
`ContextInfo3` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "guid": "67DC0D66-3695-47C0-9642-33F76F7BD7AD",
    "event_source_name": "",
    "event_id": 285,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2023-11-06T06:25:41.954437+00:00",
    "event_record_id": 32,
    "correlation": {},
    "execution": {
      "process_id": 2420,
      "thread_id": 2508
    },
    "channel": "Microsoft-Windows-Hyper-V-VmSwitch-Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "OperationName": "IOCTL_ENUM_VMQ_PROC_COUNT",
    "OperationType": 1,
    "OperationId": 2236540,
    "ExecutionTimeMS": 0,
    "QueuedTimeMS": 0,
    "SLAThresholdMS": 0,
    "ContextType1": 0,
    "ContextInfo1": " ",
    "ContextType2": 0,
    "ContextInfo2": " ",
    "ContextType3": 0,
    "ContextInfo3": " "
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 286: Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past Detecti...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Temporarily disable logging for event(s) of NIC (Friendly Name: ) for the next ms due to excessive number of instances within the past ms.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`LogRateLimitEventId` UInt32
`DetectionDuration` UInt32
`ProtectionDuration` UInt32
`SkippedLogCount` UInt32

Event ID 286: Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past %...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Temporarily disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past DetectionDuration ms.

Message #

Temporarily disable logging for event(s) %5 of NIC %2 (Friendly Name: %4) for the next %7 ms due to excessive number of instances within the past %6 ms.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`LogRateLimitEventId` UInt32
`DetectionDuration` UInt32
`ProtectionDuration` UInt32
`SkippedLogCount` UInt32

Event ID 287: Extending disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past Detection...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Extending disable logging for event(s) of NIC (Friendly Name: ) for the next ms due to excessive number of instances within the past ms. logs skipped since protection was enabled.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`LogRateLimitEventId` UInt32
`DetectionDuration` UInt32
`ProtectionDuration` UInt32
`SkippedLogCount` UInt32

Event ID 287: Extending disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past Detection...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Extending disable logging for event(s) LogRateLimitEventId of NIC NicName (Friendly Name: NicFName) for the next ProtectionDuration ms due to excessive number of instances within the past DetectionDuration ms. SkippedLogCount logs skipped since protection was enabled.

Message #

Extending disable logging for event(s) %5 of NIC %2 (Friendly Name: %4) for the next %7 ms due to excessive number of instances within the past %6 ms. %8 logs skipped since protection was enabled.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`LogRateLimitEventId` UInt32
`DetectionDuration` UInt32
`ProtectionDuration` UInt32
`SkippedLogCount` UInt32

Event ID 288: Virtual function for NIC NicName (Friendly Name: NicFName) successfully allocated

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Virtual function for NIC (Friendly Name: ) successfully allocated.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 288: Virtual function for NIC NicName (Friendly Name: NicFName) successfully allocated.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Virtual function for NIC NicName (Friendly Name: NicFName) successfully allocated.

Message #

Virtual function for NIC %2 (Friendly Name: %4) successfully allocated.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString

Event ID 289: Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status = Status, UniqueEvent =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch VF data path for NIC (Friendly Name: ) failed with status = , UniqueEvent = . VFDataPathActive = .

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VFDataPathActive` Boolean
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 289: Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status = Status, UniqueEvent = UniqueEvent.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Switch VF data path for NIC NicName (Friendly Name: NicFName) failed with status = Status, UniqueEvent = UniqueEvent. VFDataPathActive = VFDataPathActive.

Message #

Switch VF data path for NIC %2 (Friendly Name: %4) failed with status = %6, UniqueEvent = %7. VFDataPathActive = %5.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VFDataPathActive` Boolean
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 290: Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Opcode: Info

Description

Switch VF data path for NIC (Friendly Name: ) succeeded. VFDataPathActive = .

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VFDataPathActive` Boolean
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 290: Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Opcode: Info

Description

Switch VF data path for NIC NicName (Friendly Name: NicFName) succeeded. VFDataPathActive = VFDataPathActive.

Message #

Switch VF data path for NIC %2 (Friendly Name: %4) succeeded. VFDataPathActive = %5.

Fields #

Name	Description
`NicNameLen` UInt32
`NicName` UnicodeString
`NicFNameLen` UInt32
`NicFName` UnicodeString
`VFDataPathActive` Boolean
`Status` UInt32	NTSTATUS reference
`UniqueEvent` UInt32

Event ID 291: RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: OldNicIPv4RscEnabled, Current IPv4: NewNicIPv4RscEnabled, Previous IPv6: OldNicIPv6RscEnabled, Current IPv6:

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4

Description

RSC offload modified for NIC (Friendly Name: ) Previous IPv4: , Current IPv4: , Previous IPv6: , Current IPv6: . Reason.

Fields #

Name	Description
`NicName` UnicodeString
`NicFName` UnicodeString
`OldNicIPv4RscEnabled` UInt32
`OldNicIPv6RscEnabled` UInt32
`NewNicIPv4RscEnabled` UInt32
`NewNicIPv6RscEnabled` UInt32
`RscStateModifiedReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 291,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.4301626+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "OldNicIPv6RscEnabled": "0",
    "NewNicIPv4RscEnabled": "0",
    "NewNicIPv6RscEnabled": "0",
    "RscStateModifiedReason": "4",
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFName": "Default Switch",
    "OldNicIPv4RscEnabled": "0"
  }
}

Event ID 291: RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: OldNicIPv4RscEnabled, Current IPv4: NewNicIPv4RscEnabled, Previous IPv6: OldNicIPv6RscEnabled, Current IPv6: NewNicIPv6...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational

Description

RSC offload modified for NIC NicName (Friendly Name: NicFName) Previous IPv4: OldNicIPv4RscEnabled, Current IPv4: NewNicIPv4RscEnabled, Previous IPv6: OldNicIPv6RscEnabled, Current IPv6: NewNicIPv6RscEnabled. Reason: RscStateModifiedReason.

Message #

RSC offload modified for NIC %1 (Friendly Name: %2) Previous IPv4: %3, Current IPv4: %5, Previous IPv6: %4, Current IPv6: %6. Reason: %7

Fields #

Name	Description
`NicName` UnicodeString
`NicFName` UnicodeString
`OldNicIPv4RscEnabled` UInt32
`OldNicIPv6RscEnabled` UInt32
`NewNicIPv4RscEnabled` UInt32
`NewNicIPv6RscEnabled` UInt32
`RscStateModifiedReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 291,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.4301626+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "OldNicIPv6RscEnabled": "0",
    "NewNicIPv4RscEnabled": "0",
    "NewNicIPv6RscEnabled": "0",
    "RscStateModifiedReason": "4",
    "NicName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445",
    "NicFName": "Default Switch",
    "OldNicIPv4RscEnabled": "0"
  }
}

Event ID 292: RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: OldPortRscEnabled, Current:

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational
Level: 4

Description

RSC offload modified for Port (Friendly Name: ) Previous: , Current: . Reason.

Fields #

Name	Description
`PortName` UnicodeString
`PortFName` UnicodeString
`OldPortRscEnabled` UInt32
`NewPortRscEnabled` UInt32
`RscStateModifiedReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 292,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.3026531+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "NewPortRscEnabled": "1",
    "OldPortRscEnabled": "0",
    "RscStateModifiedReason": "0",
    "PortFName": "Host Vnic C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445"
  }
}

Event ID 292: RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: OldPortRscEnabled, Current: NewPortRscEnabled.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System
Level: Informational

Description

RSC offload modified for Port PortName (Friendly Name: PortFName) Previous: OldPortRscEnabled, Current: NewPortRscEnabled. Reason: RscStateModifiedReason.

Message #

RSC offload modified for Port %1 (Friendly Name: %2) Previous: %3, Current: %4. Reason: %5

Fields #

Name	Description
`PortName` UnicodeString
`PortFName` UnicodeString
`OldPortRscEnabled` UInt32
`NewPortRscEnabled` UInt32
`RscStateModifiedReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-VmSwitch",
    "event_id": 292,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T19:32:24.3026531+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "System"
  },
  "event_data": {
    "NewPortRscEnabled": "1",
    "OldPortRscEnabled": "0",
    "RscStateModifiedReason": "0",
    "PortFName": "Host Vnic C08CB7B8-9B3C-408E-8E30-5E16A3AEB444",
    "PortName": "C08CB7B8-9B3C-408E-8E30-5E16A3AEB445"
  }
}

Event ID 293: VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

VF assignment for Port (Friendly Name: ). Reason.

Fields #

Name	Description
`PortName` UnicodeString
`PortFName` UnicodeString
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`ChangeStateTo` UInt32
`Reason` UInt32

Event ID 293: VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

VF assignment ChangeStateTo for Port PortName (Friendly Name: PortFName). Reason: Reason.

Message #

VF assignment %5 for Port %1 (Friendly Name: %2). Reason: %6

Fields #

Name	Description
`PortName` UnicodeString
`PortFName` UnicodeString
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`ChangeStateTo` UInt32
`Reason` UInt32

Event ID 294: Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

Found L1VH VM NIC that has matched MacAddress , connected to port (Friendly Name: ) on switch (Friendly Name: ). The VM Nic is (Friendly Name: ).

Fields #

Name	Description
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`MacAddress` UnicodeString
`PortName` UnicodeString
`PortFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString

Event ID 294: Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

Found L1VH VM NIC that has matched MacAddress MacAddress, connected to port PortName (Friendly Name: PortFName) on switch SwitchName (Friendly Name: SwitchFName). The VM Nic is NicName (Friendly Name: NicFName).

Message #

Found L1VH VM NIC that has matched MacAddress %3, connected to port %4 (Friendly Name: %5) on switch %1 (Friendly Name: %2). The VM Nic is %6 (Friendly Name: %7).

Fields #

Name	Description
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`MacAddress` UnicodeString
`PortName` UnicodeString
`PortFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString

Event ID 295: No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName (Friendly Name: SwitchFName)

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

No L1VH VM NIC found that has matched MacAddress on switch (Friendly Name: ).

Fields #

Name	Description
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`MacAddress` UnicodeString
`PortName` UnicodeString
`PortFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString

Event ID 295: No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName (Friendly Name: SwitchFName).

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

No L1VH VM NIC found that has matched MacAddress MacAddress on switch SwitchName (Friendly Name: SwitchFName).

Message #

No L1VH VM NIC found that has matched MacAddress %3 on switch %1 (Friendly Name: %2).

Fields #

Name	Description
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`MacAddress` UnicodeString
`PortName` UnicodeString
`PortFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString

Event ID 296: NIC Switch creation failed on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 296: NIC Switch creation failed on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming sta...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

NIC Switch creation failed on the first member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, NIC Switch/VMQ offloads will be entirely disabled on that Team and vSwitch. Please investigate as it can cause performance issues.

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 297: NIC Switch creation failed on the member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming status =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 297: NIC Switch creation failed on the member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming status = Sta...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

NIC Switch creation failed on the member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, this member adapter has been evicted from the Team. Please investigate as it can cause fault tolerance and performance issues.

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 298: NIC Switch appears to be not supported on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTe...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 298: NIC Switch appears to be not supported on the first member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTea...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

NIC Switch appears to be not supported on the first member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, NIC Switch/VMQ offloads will be entirely disabled on that Team and vSwitch. Please investigate as it can cause performance issues.

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 299: NIC Switch appears to be not supported on this member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming: EmbeddedTeaming...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 299: NIC Switch appears to be not supported on this member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (Friendly Name: NicFName) EmbeddedTeaming:...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

NIC Switch appears to be not supported on this member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7. Consequently, this member adapter has been evicted from the Team. Please investigate as it can cause fault tolerance and performance issues.

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 300: Nic Switch assymetric capabilities or configuration detected between the first member adapter and that member adapter SwitchName (Friendly Name: SwitchFName) NicIndex: NicIndex on switch NicName (F...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 300: Nic Switch assymetric capabilities or configuration detected between the first member adapter and that member adapter SwitchName (Friendly Name: SwitchFName) NicInd...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

Nic Switch assymetric capabilities or configuration detected between the first member adapter and that member adapter %3 (Friendly Name: %4) NicIndex: %2 on switch %5 (Friendly Name: %6) EmbeddedTeaming: %1  status = %7.

Fields #

Name	Description
`EmbeddedTeaming` Boolean
`NicIndex` UInt32
`SwitchName` UnicodeString
`SwitchFName` UnicodeString
`NicName` UnicodeString
`NicFName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 301: Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new NumTotalMacAddresses = NewNumTotalMacAddresses, previous NumTotalMacAddresses = OldNumTotalMacAddresses, new MaxNumVFs ...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Fields #

Name	Description
`NewNumTotalMacAddresses` UInt32
`OldNumTotalMacAddresses` UInt32
`NewMaxNumVFs` UInt32
`OldMaxNumVFs` UInt32
`DefaultNicSwitchCreated` Boolean
`NicObjectHeaderState` UInt32

Event ID 301: Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new NumTotalMacAddresses = NewNumTotalMacAddresses, previous NumTotalMacAddresses = OldNumTotalMacAddresses, new Ma...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Message #

Processing NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES status indication: new NumTotalMacAddresses = %1, previous NumTotalMacAddresses = %2, new MaxNumVFs = %3, previous MaxNumVFs = %4, DefaultNicSwitchCreated = %5, NicState = %6.

Fields #

Name	Description
`NewNumTotalMacAddresses` UInt32
`OldNumTotalMacAddresses` UInt32
`NewMaxNumVFs` UInt32
`OldMaxNumVFs` UInt32
`DefaultNicSwitchCreated` Boolean
`NicObjectHeaderState` UInt32

Event ID 302: Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, previous MaxNumVFs = OldMaxNumVFs, new MaxNumVFs = NewMaxNumVFs, FoundMatchedNi...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: , IovUsage: , previous MaxNumVFs = , new MaxNumVFs = , FoundMatchedNic = , VFAssignedOrRevoked = .

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`IovUsage` Boolean
`OldMaxNumVFs` Int32
`NewMaxNumVFs` Int32
`FoundMatchedNic` Boolean
`VFNeedToBeAssignedOrRevoked` Boolean

Event ID 302: Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, previous MaxNumVFs = OldMaxNumVFs, new MaxNumVFs = NewMaxNumVFs, FoundM...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, previous MaxNumVFs = OldMaxNumVFs, new MaxNumVFs = NewMaxNumVFs, FoundMatchedNic = FoundMatchedNic, VFAssignedOrRevoked = VFNeedToBeAssignedOrRevoked.

Message #

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES: SwitchFriendlyName: %1, IovUsage: %2, previous MaxNumVFs = %3, new MaxNumVFs = %4, FoundMatchedNic = %5, VFAssignedOrRevoked = %6.

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`IovUsage` Boolean
`OldMaxNumVFs` Int32
`NewMaxNumVFs` Int32
`FoundMatchedNic` Boolean
`VFNeedToBeAssignedOrRevoked` Boolean

Event ID 303: Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = NewMaxNumVFs, previous MaxNumVFs = OldMaxNumVFs, status:

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = , previous MaxNumVFs = , status: .

Fields #

Name	Description
`NewMaxNumVFs` UInt32
`OldMaxNumVFs` UInt32
`NdisStatus` Int32

Event ID 303: Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = NewMaxNumVFs, previous MaxNumVFs = OldMaxNumVFs, status: NdisStatus.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = NewMaxNumVFs, previous MaxNumVFs = OldMaxNumVFs, status: NdisStatus.

Message #

Workitem for NDIS_STATUS_NIC_SWITCH_CURRENT_CAPABILITIES on default NicSwitch creation: MaxNumVFs = %1, previous MaxNumVFs = %2, status: %3.

Fields #

Name	Description
`NewMaxNumVFs` UInt32
`OldMaxNumVFs` UInt32
`NdisStatus` Int32

Event ID 304: Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = SwitchFriendlyName, NewSriovSupport = OldSriovSupport, FoundMatchedNic = NewSriovSupport, DefaultNicSwitchCreated =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = , NewSriovSupport = , FoundMatchedNic = , DefaultNicSwitchCreated = .

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`OldSriovSupport` Boolean
`NewSriovSupport` Boolean
`FoundMatchedNic` Boolean
`DefaultNicSwitchCreated` Boolean

Event ID 304: Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = SwitchFriendlyName, NewSriovSupport = OldSriovSupport, FoundMatchedNic = NewSriovSupport, DefaultNicSwitchCreated...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = SwitchFriendlyName, NewSriovSupport = OldSriovSupport, FoundMatchedNic = NewSriovSupport, DefaultNicSwitchCreated = FoundMatchedNic.

Message #

Workitem for NDIS_STATUS_SRIOV_CURRENT_CAPABILITIES: PreviousSriovSupport = %1, NewSriovSupport = %2, FoundMatchedNic = %3, DefaultNicSwitchCreated = %4.

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`OldSriovSupport` Boolean
`NewSriovSupport` Boolean
`FoundMatchedNic` Boolean
`DefaultNicSwitchCreated` Boolean

Event ID 305: Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, NewSriovSupport:

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: , NewSriovSupport: .

Fields #

Name	Description
`OldSriovSupport` UInt32
`NewSriovSupport` UInt32

Event ID 305: Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, NewSriovSupport: NewSriovSupport.

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: OldSriovSupport, NewSriovSupport: NewSriovSupport.

Message #

Processing NDIS_STATUS_VF_STATE: PreviousSriovSupport: %1, NewSriovSupport: %2.

Fields #

Name	Description
`OldSriovSupport` UInt32
`NewSriovSupport` UInt32

Event ID 306: WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, FoundMatchedNic = FoundMatchedNic, VFDataPathReady = VFDataPathReady, VFDataPathActive =

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: Operational

Description

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: , IovUsage: , FoundMatchedNic = , VFDataPathReady = , VFDataPathActive = .

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`IovUsage` Boolean
`FoundMatchedNic` Boolean
`VFDataPathReady` Boolean
`VFDataPathActive` Boolean

Event ID 306: WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, FoundMatchedNic = FoundMatchedNic, VFDataPathReady = VFDataPathReady, VFDataPathActive = VFDataPathAct...

Provider: Microsoft-Windows-Hyper-V-VmSwitch
Channel: System

Description

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: SwitchFriendlyName, IovUsage: IovUsage, FoundMatchedNic = FoundMatchedNic, VFDataPathReady = VFDataPathReady, VFDataPathActive = VFDataPathActive.

Message #

WorkItem for NDIS_STATUS_VF_STATE: SwitchFriendlyName: %1, IovUsage: %2, FoundMatchedNic = %3, VFDataPathReady = %4, VFDataPathActive = %5.

Fields #

Name	Description
`SwitchFriendlyName` UnicodeString
`IovUsage` Boolean
`FoundMatchedNic` Boolean
`VFDataPathReady` Boolean
`VFDataPathActive` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {67DC0D66-3695-47C0-9642-33F76F7BD7AD}

Defined in vmswitch.sys , which carries the event manifest.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.4484, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

Downloads

Microsoft-Windows-Hyper-V-VmSwitch registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)