Microsoft.Windows.HyperV.VmIcCore

Event	Title	Channel	Sample	Rule
3584	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
3584	Event ID 3584	Unknown	N	N
3585	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
3585	Event ID 3585	Unknown	N	N
3586	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
3586	Event ID 3586	Unknown	N	N
3587	[Virtual machine VmId] TraceData.	Microsoft-Windows-Hyper-V-Worker-Analytic	N	N
3587	Event ID 3587	Unknown	N	N
4000	Failed to connect to virtual machine 'VmName' because there is no mutually …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
4000	Event ID 4000	Unknown	N	N
4090	'VmName': The 'Guest Service Interface' integration service is either not …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
4090	Event ID 4090	Unknown	N	N
4091	The 'Guest Service Interface' integration service is either not enabled, not …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
4091	Event ID 4091	Unknown	N	N
4094	'VmName': The 'Guest Shutdown' integration service is either not enabled, not …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
4094	Event ID 4094	Unknown	N	N
4095	The 'Guest Shutdown' integration service is either not enabled, not running or …	Microsoft-Windows-Hyper-V-Worker-Admin	N	N
4095	Event ID 4095	Unknown	N	N

Event ID 3584: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3584

Channel: Unknown

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3585: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3585

Channel: Unknown

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3586: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3586

Channel: Unknown

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3587: [Virtual machine VmId] TraceData.

Channel: Microsoft-Windows-Hyper-V-Worker-Analytic

Message #

[Virtual machine %3] %1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 3587

Channel: Unknown

Description

[Virtual machine ].

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 4000: Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId).

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId). Framework version: Param1; Message version: Param2.

Message #

Failed to connect to virtual machine '%1' because there is no mutually supported protocol for VM: (Virtual machine ID %2). Framework version: %3; Message version: %4.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4000

Channel: Unknown

Description

Failed to connect to virtual machine 'VmName' because there is no mutually supported protocol for VM: (Virtual machine ID VmId). Framework version: Param1; Message version: Param2.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4090: 'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Message #

'%1': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4090

Channel: Unknown

Description

'VmName': The 'Guest Service Interface' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4091: The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4091

Channel: Unknown

Description

The 'Guest Service Interface' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4094: 'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Message #

'%1': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID %2)

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4094

Channel: Unknown

Description

'VmName': The 'Guest Shutdown' integration service is either not enabled, not running or not initialized. (Virtual machine ID VmId).

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4095: The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Channel: Microsoft-Windows-Hyper-V-Worker-Admin

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Event ID 4095

Channel: Unknown

Description

The 'Guest Shutdown' integration service is either not enabled, not running or not initialized.

Fields #

Name	Description
`VmName` UnicodeString
`VmId` UnicodeString
`Param1` UnicodeString
`Param2` UnicodeString
`Param3` UnicodeString

Provenance

ETW provider GUID e5ea3ca6-5eb0-597d-504a-2fd09ccdefda

Defined in vmiccore.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB