Microsoft-Windows-Kernel-PnP-Rundown

Event	Title	Channel	Sample	Rule
1	ConnectionResourceConsumer	Operational	N	N
2	ParentPdo	Operational	N	N
3	ParentDevNode_V1	Operational	N	N
4	InterruptResourceConsumer	Operational	N	N

Event ID 1: ConnectionResourceConsumer

Channel: Operational
Task: ConnectionResourceConsumer

Fields #

Name	Description
`ResourceConsumerPdo` Pointer
`ConnectionId` HexInt64
`ResourceConsumerInstancePathLength` UInt32
`ResourceConsumerInstancePath` UnicodeString

Event ID 2: ParentPdo

Channel: Operational
Task: ParentPdo

Fields #

Name	Description
`Pdo` Pointer
`ParentPdo` Pointer

Event ID 3: ParentDevNode_V1

Channel: Operational
Task: ParentDevNode

Fields #

Name	Description
`DevNode` Pointer
`ParentDevNode` Pointer
`InstancePathLength` UInt32
`InstancePath` UnicodeString

Event ID 4: InterruptResourceConsumer

Channel: Operational
Task: InterruptResourceConsumer

Fields #

Name	Description
`ResourceConsumerPdo` Pointer
`Flags` UInt16
`Group` UInt16
`Vector` UInt16
`Affinity` HexInt64
`InterruptResourceConsumerInstancePathLength` UInt32
`InterruptResourceConsumerInstancePath` UnicodeString

Provenance

ETW provider GUID b3a0c2c8-83bb-4ddf-9f8d-4b22d3c38ad7

Defined in microsoft-windows-kernel-pnp-events.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB