Microsoft-Windows-Kernel-PnP

196 events across 9 channels

Event	Title	Channel	Sample
200	Begin boot start drivers phase	Boot Diagnostic	N
201	End boot start drivers phase	Boot Diagnostic	N
202	Begin system start drivers phase	Boot Diagnostic	N
203	End system start drivers phase	Boot Diagnostic	N
204	OS Loader Start: OS_Loader_Start.	Boot Diagnostic	N
205	EarlyLaunchAntiMalwareStart	Operational	N
206	EarlyLaunchAntiMalwareStop	Operational	N
207	EarlyLaunchAntiMalwareStart207	Operational	N
208	EarlyLaunchAntiMalwareStop208	Operational	N
209	EarlyLaunchAntiMalware	Operational	N
210	Begin initializing boot start driver DriverName.	Driver Diagnostic	N
211	End initializing boot start driver DriverName.	Driver Diagnostic	N
212	Begin loading driver DriverName.	Driver Diagnostic	N
213	End loading driver DriverName.	Driver Diagnostic	N
214	Begin unloading driver DriverName.	Driver Diagnostic	N
215	End unloading driver DriverName.	Driver Diagnostic	N
216	Begin starting device DriverName.	Device Enumeration Diagnostic	N
217	Pending start of device DriverName.	Device Enumeration Diagnostic	N
218	End starting device DriverName using driver FailureName.	Device Enumeration Diagnostic	N
219	The driver FailureName failed to load.	System	Y
220	Begin querying bus relations for device DriverName.	Device Enumeration Diagnostic	N
221	Pending querying bus relations for device DriverName.	Device Enumeration Diagnostic	N
222	End querying bus relations for device DriverName.	Device Enumeration Diagnostic	N
223	Begin attempting to eject device DriverName.	Device Enumeration Diagnostic	N
224	End attempting to eject device DriverName.	Device Enumeration Diagnostic	N
225	The application ProcessName with process id ProcessId stopped the removal or …	System	N
226	Begin calling driver initialization routine for driver DriverName.	Driver Diagnostic	N
227	End calling driver initialization routine for driver DriverName.	Driver Diagnostic	N
228	task_0	Operational	N
229	task_0229	Operational	N
230	task_0230	Operational	N
231	task_0Stop	Operational	N
232	task_0232	Operational	N
233	task_0233	Operational	N
234	task_0234	Operational	N
235	task_0235	Operational	N
236	task_0236	Operational	N
240	A partition unit replace operation has been initiated.	System	N
241	A partition unit replace operation has failed.	System	N
242	A partition unit has been successfully replaced.	System	N
250	Begin configuration of device DeviceInstance.	Configuration Diagnostic	N
251	Pending configuration of device DeviceInstance.	Configuration Diagnostic	N
252	End configuration of device DeviceInstance.	Configuration Diagnostic	N
260	Begin starting system start drivers part 1	Boot Diagnostic	N
261	End starting system start drivers part 1	Boot Diagnostic	N
262	Begin starting system start drivers part 2	Boot Diagnostic	N
263	End starting system start drivers part 2	Boot Diagnostic	N
264	Begin processing reinitialization requests for boot start drivers	Driver Diagnostic	N
265	End processing reinitialization requests for boot start drivers	Driver Diagnostic	N
266	Begin processing reinitialization requests for system start drivers	Driver Diagnostic	N
267	End processing reinitialization requests for system start drivers	Driver Diagnostic	N
270	Begin loading driver database DriverName.	Configuration Diagnostic	N
271	Pending loading driver database DriverName.	Configuration Diagnostic	N
272	End loading driver database DriverName.	Configuration Diagnostic	N
273	Begin unloading driver database DriverName.	Configuration Diagnostic	N
274	Pending unloading driver database DriverName.	Configuration Diagnostic	N
275	End unloading driver database DriverName.	Configuration Diagnostic	N
276	DriverDatabaseLoadedStart	Operational	N
277	DriverDatabaseLoadedStop	Operational	N
278	task_0278	Operational	N
300	Begin starting initialization of drivers	Boot Diagnostic	N
301	End starting initialization of drivers	Boot Diagnostic	N
400	Device DeviceInstanceId was configured.	Configuration	Y
401	Device Driver_Name failed configuration.	Configuration	N
402	Device Driver_Name had its configuration blocked by policy.	Configuration	N
403	Device DeviceInstanceId requires a system reboot to complete configuration.	Configuration	Y
410	Device DeviceInstanceId was started.	Configuration	Y
411	Device DeviceInstanceId had a problem starting.	Configuration	Y
412	Device Driver_Name requires a system reboot before it can be started.	Configuration	N
420	Device DeviceInstanceId was deleted.	Configuration	Y
421	Device Class_Guid could not be deleted.	Configuration	N
430	Device DeviceInstanceId requires further installation.	Configuration	Y
440	Device settings for Last_Device_Instance_Id were migrated from previous OS …	Configuration	N
441	Device settings for Last_Device_Instance_Id could not be migrated from previous …	Configuration	N
442	Device settings for Last_Device_Instance_Id were not migrated from previous OS …	Configuration	N
500	DevQuery_QueryProcessing	Operational	Y
501	DevQuery_QueryProcessingProcessingStart	Operational	N
502	DevQuery_QueryProcessingProcessingStop	Operational	N
503	DevQuery_QueryProcessing	Operational	Y
600	A start type override of StartType was set for driver Driver in hardware …	Driver Diagnostic	N
700	CfgMgr_DeviceList	Operational	Y
701	CfgMgr_DeviceList	Operational	Y
702	CfgMgr_DeviceInterfaceList	Operational	Y
703	CfgMgr_DeviceInterfaceList	Operational	Y
704	CfgMgr_QueryRemoveStart	Operational	N
705	CfgMgr_QueryRemoveStop	Operational	N
800	Begin processing new device (DeviceNode).	Device Enumeration Diagnostic	N
801	Processing device DeviceInstancePath (DeviceNode).	Device Enumeration Diagnostic	N
802	End processing new device (DeviceNode).	Device Enumeration Diagnostic	N
803	Begin processing phase Phase of starting device Device.	Operational	N
804	End processing phase Phase of starting device Device.	Operational	N
805	Begin processing phase Phase of restarting device Device.	Operational	N
806	End processing phase Phase of restarting device Device.	Operational	N
807	Begin device add operation for driver DriverName, device DeviceInstancePath.	Device Enumeration Diagnostic	N
808	End device add, status (Status).	Device Enumeration Diagnostic	N
809	Duplicate device instance reported by BusId and DeviceId.	Device Management	N
810	Reenumeration of device tree below Device has been queued.	Device Enumeration Diagnostic	N
811	Begin reenumeration of device tree below Device.	Device Enumeration Diagnostic	N
812	End reenumeration of device tree below Device.	Device Enumeration Diagnostic	N
813	Reenumeration of Device has been queued.	Device Enumeration Diagnostic	N
814	Begin reenumeration of Device.	Device Enumeration Diagnostic	N
815	End reenumeration of Device.	Device Enumeration Diagnostic	N
816	Configuration of device Device for configuration type RequestType has been …	Configuration Diagnostic	N
817	Begin configuration of device Device for configuration type RequestType.	Configuration Diagnostic	N
818	End configuration of device Device for configuration type RequestType.	Configuration Diagnostic	N
819	GenericDeviceAction	Operational	N
820	GenericDeviceActionStart	Operational	N
821	GenericDeviceActionStop	Operational	N
830	Removal of Device has been queued.	Device Enumeration Diagnostic	N
831	Begin removal of Device.	Device Enumeration Diagnostic	N
832	End removal of Device.	Device Enumeration Diagnostic	N
840	Begin resetting device DeviceInstance.	Device Enumeration Diagnostic	N
841	End resetting device DeviceInstance with status Status, veto type VetoType, veto …	Device Enumeration Diagnostic	N
850	Begin assigning resources to device tree below Device.	Device Enumeration Diagnostic	N
851	End assigning resources to device tree below Device.	Device Enumeration Diagnostic	N
852	Begin rebalancing resources for device DeviceInstance.	Device Enumeration Diagnostic	N
853	End rebalancing resources for device DeviceInstance.	Device Enumeration Diagnostic	N
860	Updated problem code on device DeviceInstanceId.	Operational	N
900	A long running thread for the device event queue was detected.	Driver Watchdog	Y
901	A long running thread for the device event queue has been completed.	Driver Watchdog	Y
902	A long running thread for device start processing was detected.	Driver Watchdog	Y
903	A long running thread for device start processing has been completed.	Driver Watchdog	Y
904	A long running thread for device removal was detected.	Driver Watchdog	N
905	A long running thread for device removal has been completed.	Driver Watchdog	N
906	A long running thread for device add routine was detected.	Driver Watchdog	N
907	A long running thread for device add routine has been completed.	Driver Watchdog	N
908	A long running thread for driver entry was detected.	Driver Watchdog	Y
909	A long running thread for driver entry routine has been completed.	Driver Watchdog	Y
930	Timed out waiting for response from user mode clients to synchronous …	Driver Watchdog	N
931	Responses from user mode clients to synchronous notification EventGuid took …	Driver Watchdog	N
932	Synchronous notification EventGuid to process ProcessId (ProcessImageName) was …	Driver Watchdog	N
933	Notification EventGuid to driver DriverName took ElapsedTimeMs milliseconds.	Driver Watchdog	N
1000	Device DeviceInstanceId could not be query removed as the removal was vetoed.	Device Management	Y
1010	Device DeviceInstanceId has been surprise removed as it is reported as missing …	Device Management	Y
1011	Device DeviceInstanceId has been surprise removed as it was reported to be …	Device Management	Y
1020	A resource rebalance operation has succeeded.	Device Management	N
1021	A resource rebalance operation has failed.	Device Management	N
1030	Device Device has been assigned to a guest partition.	Device Management	N
1031	Device Device is no longer assigned to a guest partition.	Device Management	N
1040	Device Flags has requested a platform-level device reset.	Device Management	N
1041	Device Veto_type has completed a platform-level device reset.	Device Management	N
1050	Failed to create driver package defined child device of Child_Instance_ID.	Device Management	N
1060	Failed to create computer device derived from firmware information.	Device Management	N
1065	Device DeviceInstanceId with problem code ProblemCode and problem status …	Device Management	N
1070	Failed to open DeviceStackLocation driver service ServiceName for device …	Device Management	N
1080	The driver FailureName failed to unload.	Device Management	N
1100	SwDevice_IrpCreateStart	Operational	N
1101	SwDevice_IrpCreateStop	Operational	N
1102	SwDevice_KernelCreateStart	Operational	N
1103	SwDevice_KernelCreateStop	Operational	N
1104	task_01104	Operational	N
1105	task_01105	Operational	N
1106	task_01106	Operational	N
1107	task_01107	Operational	N
1108	SwDevice_InstanceTable_Add	Operational	N
1109	SwDevice_InstanceTable_Remove	Operational	N
1110	SwDevice_DeviceEnumeratedStart	Operational	N
1111	SwDevice_DeviceEnumeratedStop	Operational	N
1120	SwDevice_RelationAddStart	Operational	N
1121	SwDevice_RelationAddStop	Operational	N
1122	SwDevice_RelationRemove	Operational	N
1130	SwDevice_LifetimeChangeStart	Operational	N
1131	SwDevice_LifetimeChangeStop	Operational	N
1132	SwDevice_LifetimeChange	Operational	N
1140	SwDevice_RegisterInterfaceStart	Operational	N
1141	SwDevice_RegisterInterfaceStop	Operational	N
1142	SwDevice_RegisterInterface	Operational	N
1143	SwDevice_SetInterfaceState	Operational	N
1144	SwDevice_SetInterfaceStateStart	Operational	N
1145	SwDevice_SetInterfaceStateStop	Operational	N
1150	SwDevice_SetDevicePropertyStart	Operational	N
1151	SwDevice_SetDevicePropertyStop	Operational	N
1160	SwDevice_SetInterfacePropertyStart	Operational	N
1161	SwDevice_SetInterfacePropertyStop	Operational	N
1170	SwDevice_IrpCloseStart	Operational	N
1171	SwDevice_IrpCloseStop	Operational	N
1172	SwDevice_KernelCloseStart	Operational	N
1173	SwDevice_KernelCloseStop	Operational	N
1174	SwDevice_CloseDescendants	Operational	N
1175	SwDevice_CloseDevice	Operational	N
1176	SwDevice_ProcessRemove	Operational	N
1177	SwDevice_ProcessParentRemove	Operational	N
1178	SwDevice_UninstallDevice	Operational	N
1190	SwDevice_GetChildPdoStart	Operational	N
1191	SwDevice_GetChildPdoStop	Operational	N
1192	SwDevice_GetChildPdo	Operational	N
1200	SwDevice_AttributesChangeStart	Operational	N
1201	SwDevice_AttributesChangeStop	Operational	N
1202	SwDevice_AttributesChange	Operational	N
1300	task_01300	Operational	N
1301	task_01301	Operational	N
1302	task_01302	Operational	N
1303	task_01303	Operational	N
1304	task_01304	Operational	N
1400	Begin serializing boot with PnP device enumeration	Boot Diagnostic	N
1401	End serializing boot with PnP device enumeration	Boot Diagnostic	N

Event ID 200: Begin boot start drivers phase

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: BootStart
Opcode: Start

Description

Begin boot start drivers phase.

Message #

Begin boot start drivers phase

Event ID 201: End boot start drivers phase

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: BootStart
Opcode: Stop

Description

End boot start drivers phase.

Message #

End boot start drivers phase

Event ID 202: Begin system start drivers phase

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStart
Opcode: Start

Description

Begin system start drivers phase.

Message #

Begin system start drivers phase

Event ID 203: End system start drivers phase

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStart
Opcode: Stop

Description

End system start drivers phase.

Message #

End system start drivers phase

Event ID 204: OS Loader Start: OS_Loader_Start.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: OsLoader

Description

OS Loader Start: OS_Loader_Start.

Message #

OS Loader Start: %1
OS Loader End: %2

Fields #

Name	Description
`OSLoaderStart` UInt64
`OSLoaderEnd` UInt64
`PreloadEndTime` UInt64
`TcbLoaderStartTime` UInt64
`LoadHypervisorTime` UInt64
`LaunchHypervisorTime` UInt64
`LoadVsmTime` UInt64
`LaunchVsmTime` UInt64
`ExecuteTransitionStartTime` UInt64
`ExecuteTransitionEndTime` UInt64
`PerformanceDataFrequency` UInt64

Event ID 205: EarlyLaunchAntiMalwareStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: EarlyLaunchAntiMalware
Opcode: Start

Fields #

Name	Description
`ElamDriverNameLength` UInt16
`ElamDriverName` UnicodeString

Event ID 206: EarlyLaunchAntiMalwareStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: EarlyLaunchAntiMalware
Opcode: Stop

Fields #

Name	Description
`ElamDriverNameLength` UInt16
`ElamDriverName` UnicodeString

Event ID 207: EarlyLaunchAntiMalwareStart207

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: EarlyLaunchAntiMalware
Opcode: Start

Fields #

Name	Description
`ElamStatus` UInt32

Event ID 208: EarlyLaunchAntiMalwareStop208

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: EarlyLaunchAntiMalware
Opcode: Stop

Fields #

Name	Description
`ElamStatus` UInt32

Event ID 209: EarlyLaunchAntiMalware

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: EarlyLaunchAntiMalware

Fields #

Name	Description
`Classification` UInt32
`Policy` UInt32
`Result` UInt32

Event ID 210: Begin initializing boot start driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: BootInit
Opcode: Start

Description

Begin initializing boot start driver DriverName.

Message #

Begin initializing boot start driver %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 211: End initializing boot start driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: BootInit
Opcode: Stop

Description

End initializing boot start driver DriverName. Status: Status.

Message #

End initializing boot start driver %2.  Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 212: Begin loading driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverLoad
Opcode: Start

Description

Begin loading driver DriverName.

Message #

Begin loading driver %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 213: End loading driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverLoad
Opcode: Stop

Description

End loading driver DriverName. Status: Status.

Message #

End loading driver %5.  Status: %3

Fields #

Name	Description
`ServiceNameLength` UInt16
`ServiceName` UnicodeString
`Status` UInt32	NTSTATUS reference
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Version` UInt32

Event ID 214: Begin unloading driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverUnload
Opcode: Start

Description

Begin unloading driver DriverName.

Message #

Begin unloading driver %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 215: End unloading driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverUnload
Opcode: Stop

Description

End unloading driver DriverName. Status: Status.

Message #

End unloading driver %5.  Status: %3

Fields #

Name	Description
`ServiceNameLength` UInt16
`ServiceName` UnicodeString
`Status` UInt32	NTSTATUS reference
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Version` UInt32

Event ID 216: Begin starting device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceStart
Opcode: Start

Description

Begin starting device DriverName.

Message #

Begin starting device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 217: Pending start of device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceStart
Opcode: Suspend

Description

Pending start of device DriverName.

Message #

Pending start of device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 218: End starting device DriverName using driver FailureName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceStart
Opcode: Stop

Description

End starting device DriverName using driver FailureName. Status: Status.

Message #

End starting device %2 using driver %5.  Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureNameLength` UInt16
`FailureName` UnicodeString
`Version` UInt32

Event ID 219: The driver FailureName failed to load.

Provider: Microsoft-Windows-Kernel-PnP
Channel: System
Level: Warning
Collection Priority: Recommended (NSA)
Task: DriverLoad

Description

The driver FailureName failed to load.

Message #

The driver %5 failed to load.
Device: %2
Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureNameLength` UInt16
`FailureName` UnicodeString
`Version` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 219,
    "version": 0,
    "level": 3,
    "task": 212,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:19.591886+00:00",
    "event_record_id": 1645,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 224
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DriverNameLength": 15,
    "DriverName": "ROOT\\VMBus\\0000",
    "Status": 3221226341,
    "FailureNameLength": 14,
    "FailureName": "\\Driver\\vmbusr",
    "Version": 0
  },
  "message": ""
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/event-id-219-when-device-plugged-in-windows-system
Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 220: Begin querying bus relations for device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceEnum
Opcode: Start

Description

Begin querying bus relations for device DriverName.

Message #

Begin querying bus relations for device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 221: Pending querying bus relations for device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceEnum
Opcode: Suspend

Description

Pending querying bus relations for device DriverName.

Message #

Pending querying bus relations for device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 222: End querying bus relations for device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceEnum
Opcode: Stop

Description

End querying bus relations for device DriverName.

Message #

End querying bus relations for device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 223: Begin attempting to eject device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceEject
Opcode: Start

Description

Begin attempting to eject device DriverName.

Message #

Begin attempting to eject device %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 224: End attempting to eject device DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceEject
Opcode: Stop

Description

End attempting to eject device DriverName. Status: Status.

Message #

End attempting to eject device %2. Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureNameLength` UInt16
`FailureName` UnicodeString
`Version` UInt32

Event ID 225: The application ProcessName with process id ProcessId stopped the removal or ejection for the device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: System
Task: DeviceEject

Description

The application ProcessName with process id ProcessId stopped the removal or ejection for the device DeviceInstance.

Message #

The application %3 with process id %1 stopped the removal or ejection for the device %5.

Fields #

Name	Description
`ProcessId` UInt32
`ProcessNameLength` UInt16
`ProcessName` UnicodeString
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`CommandLineLength` UInt16
`CommandLine` UnicodeString
`VetoingDevicesLength` UInt16
`VetoingDevices` UnicodeString

Event ID 226: Begin calling driver initialization routine for driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverInit
Opcode: Start

Description

Begin calling driver initialization routine for driver DriverName.

Message #

Begin calling driver initialization routine for driver %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 227: End calling driver initialization routine for driver DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverInit
Opcode: Stop

Description

End calling driver initialization routine for driver DriverName. Status: Status.

Message #

End calling driver initialization routine for driver %2. Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 228: task_0

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmSid` SID
`SqmWindowsSessionId` UInt32
`SqmSessionFlags` UInt32

Event ID 229: task_0229

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID

Event ID 230: task_0230

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 231: task_0Stop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Stop

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 232: task_0232

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 233: task_0233

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 234: task_0234

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 235: task_0235

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStringDatapointValue` UnicodeString

Event ID 236: task_0236

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Event ID 240: A partition unit replace operation has been initiated.

Provider: Microsoft-Windows-Kernel-PnP
Channel: System
Opcode: Info

Description

A partition unit replace operation has been initiated.

Message #

A partition unit replace operation has been initiated.

Fields #

Name	Description
`TargetPath` UnicodeString
`SparePath` UnicodeString

Event ID 241: A partition unit replace operation has failed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: System
Opcode: Info

Description

A partition unit replace operation has failed.

Message #

A partition unit replace operation has failed.

Fields #

Name	Description
`TargetPath` UnicodeString
`SparePath` UnicodeString
`Status` HexInt32	NTSTATUS reference
`Location` UInt32
`ExtendedStatus` UInt32

Event ID 242: A partition unit has been successfully replaced.

Provider: Microsoft-Windows-Kernel-PnP
Channel: System
Opcode: Info

Description

A partition unit has been successfully replaced.

Message #

A partition unit has been successfully replaced.

Fields #

Name	Description
`TargetPath` UnicodeString
`TargetAffinity` HexInt64
`TargetProcessorCount` UInt32
`TargetMemoryCount` UInt32
`TargetMemorySize` HexInt64
`SparePath` UnicodeString
`SpareProcessorCount` UInt32
`SpareMemoryCount` UInt32
`SpareMemorySize` HexInt64
`TimeTotal` UInt32
`TimeToQuiesce` UInt32
`TimeQuiesced` UInt32
`TimeToWake` UInt32
`TargetProcessors` FILETIME
`TargetMemoryRanges` SYSTEMTIME
`SpareProcessors` HexInt32
`SpareMemoryRanges` HexInt64

Event ID 250: Begin configuration of device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DeviceConfig
Opcode: Start

Description

Begin configuration of device DeviceInstance.

Message #

Begin configuration of device %2

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString

Event ID 251: Pending configuration of device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DeviceConfig
Opcode: Suspend

Description

Pending configuration of device DeviceInstance.

Message #

Pending configuration of device %2

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString

Event ID 252: End configuration of device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DeviceConfig
Opcode: Stop

Description

End configuration of device DeviceInstance. Status: Status.

Message #

End configuration of device %2. Status: %3

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 260: Begin starting system start drivers part 1

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStartPnPEnum
Opcode: Start

Description

Begin starting system start drivers part 1.

Message #

Begin starting system start drivers part 1

Event ID 261: End starting system start drivers part 1

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStartPnPEnum
Opcode: Stop

Description

End starting system start drivers part 1.

Message #

End starting system start drivers part 1

Event ID 262: Begin starting system start drivers part 2

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStartLegacyEnum
Opcode: Start

Description

Begin starting system start drivers part 2.

Message #

Begin starting system start drivers part 2

Event ID 263: End starting system start drivers part 2

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SystemStartLegacyEnum
Opcode: Stop

Description

End starting system start drivers part 2.

Message #

End starting system start drivers part 2

Event ID 264: Begin processing reinitialization requests for boot start drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: BootDriverReinit
Opcode: Start

Description

Begin processing reinitialization requests for boot start drivers.

Message #

Begin processing reinitialization requests for boot start drivers

Event ID 265: End processing reinitialization requests for boot start drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: BootDriverReinit
Opcode: Stop

Description

End processing reinitialization requests for boot start drivers.

Message #

End processing reinitialization requests for boot start drivers

Event ID 266: Begin processing reinitialization requests for system start drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: SystemStartDriverReinit
Opcode: Start

Description

Begin processing reinitialization requests for system start drivers.

Message #

Begin processing reinitialization requests for system start drivers

Event ID 267: End processing reinitialization requests for system start drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: SystemStartDriverReinit
Opcode: Stop

Description

End processing reinitialization requests for system start drivers.

Message #

End processing reinitialization requests for system start drivers

Event ID 270: Begin loading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseLoad
Opcode: Start

Description

Begin loading driver database DriverName.

Message #

Begin loading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 271: Pending loading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseLoad
Opcode: Suspend

Description

Pending loading driver database DriverName.

Message #

Pending loading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 272: End loading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseLoad
Opcode: Stop

Description

End loading driver database DriverName.

Message #

End loading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 273: Begin unloading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseUnload
Opcode: Start

Description

Begin unloading driver database DriverName.

Message #

Begin unloading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 274: Pending unloading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseUnload
Opcode: Suspend

Description

Pending unloading driver database DriverName.

Message #

Pending unloading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 275: End unloading driver database DriverName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: DriverDatabaseUnload
Opcode: Stop

Description

End unloading driver database DriverName.

Message #

End unloading driver database %2

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 276: DriverDatabaseLoadedStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: DriverDatabaseLoaded
Opcode: Start

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString

Event ID 277: DriverDatabaseLoadedStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: DriverDatabaseLoaded
Opcode: Stop

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 278: task_0278

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`BlockedDriverEntry` GUID

Event ID 300: Begin starting initialization of drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Opcode: Info

Description

Begin starting initialization of drivers.

Message #

Begin starting initialization of drivers

Event ID 301: End starting initialization of drivers

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Opcode: Info

Description

End starting initialization of drivers.

Message #

End starting initialization of drivers

Event ID 400: Device DeviceInstanceId was configured.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Informational
Collection Priority: Recommended (NSA)
Opcode: Info

Description

Device DeviceInstanceId was configured.

Message #

Device %1 was configured.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Parent Device: %14

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`DriverDate` UnicodeString
`DriverVersion` UnicodeString
`DriverProvider` UnicodeString
`DriverInbox` Boolean
`DriverSection` UnicodeString
`DriverRank` HexInt32
`MatchingDeviceId` UnicodeString
`OutrankedDrivers` UnicodeString
`DeviceUpdated` Boolean
`Status` HexInt32	NTSTATUS reference
`ParentDeviceInstanceId` UnicodeString	Parent Device.
`DriverPackageId`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:12:15.8137445+00:00",
    "event_record_id": 143,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8188
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ROOT\\VBUS\\0000",
    "DriverName": "vbus.inf",
    "ClassGuid": "{4d36e97d-e325-11ce-bfc1-08002be10318}",
    "DriverDate": "06/21/2006",
    "DriverVersion": "10.0.20348.469",
    "DriverProvider": "Microsoft",
    "DriverInbox": "true",
    "DriverSection": "Vbus_Device.NT",
    "DriverRank": "0xff0000",
    "MatchingDeviceId": "ROOT\\vbus",
    "OutrankedDrivers": "",
    "DeviceUpdated": "false",
    "Status": "0x0",
    "ParentDeviceInstanceId": "HTREE\\ROOT\\0"
  },
  "message": "Device ROOT\\VBUS\\0000 was configured.\r\n\r\nDriver Name: vbus.inf\r\nClass Guid: {4d36e97d-e325-11ce-bfc1-08002be10318}\r\nDriver Date: 06/21/2006\r\nDriver Version: 10.0.20348.469\r\nDriver Provider: Microsoft\r\nDriver Section: Vbus_Device.NT\r\nDriver Rank: 0xFF0000\r\nMatching Device Id: ROOT\\vbus\r\nOutranked Drivers: \r\nDevice Updated: false\r\nParent Device: HTREE\\ROOT\\0"
}

Event ID 401: Device Driver_Name failed configuration.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device Driver_Name failed configuration.

Message #

Device %1 failed configuration.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Status: %13
Parent Device: %14

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`DriverDate` UnicodeString
`DriverVersion` UnicodeString
`DriverProvider` UnicodeString
`DriverInbox` Boolean
`DriverSection` UnicodeString
`DriverRank` HexInt32
`MatchingDeviceId` UnicodeString
`OutrankedDrivers` UnicodeString
`DeviceUpdated` Boolean
`Status` HexInt32	Outranked Drivers. NTSTATUS reference
`ParentDeviceInstanceId` UnicodeString
`DriverPackageId` UnicodeString

Event ID 402: Device Driver_Name had its configuration blocked by policy.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device Driver_Name had its configuration blocked by policy.

Message #

Device %1 had its configuration blocked by policy.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Status: %13
Parent Device: %14

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`DriverDate` UnicodeString
`DriverVersion` UnicodeString
`DriverProvider` UnicodeString
`DriverInbox` Boolean
`DriverSection` UnicodeString
`DriverRank` HexInt32
`MatchingDeviceId` UnicodeString
`OutrankedDrivers` UnicodeString
`DeviceUpdated` Boolean
`Status` HexInt32	Outranked Drivers. NTSTATUS reference
`ParentDeviceInstanceId` UnicodeString
`DriverPackageId` UnicodeString

Event ID 403: Device DeviceInstanceId requires a system reboot to complete configuration.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Warning
Opcode: Info

Description

Device DeviceInstanceId requires a system reboot to complete configuration.

Message #

Device %1 requires a system reboot to complete configuration.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Status: %13
Parent Device: %14

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`DriverDate` UnicodeString
`DriverVersion` UnicodeString
`DriverProvider` UnicodeString
`DriverInbox` Boolean
`DriverSection` UnicodeString
`DriverRank` HexInt32
`MatchingDeviceId` UnicodeString
`OutrankedDrivers` UnicodeString
`DeviceUpdated` Boolean
`Status` HexInt32	NTSTATUS reference
`ParentDeviceInstanceId` UnicodeString	Parent Device.
`DriverPackageId`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-26T04:16:19.107877+00:00",
    "event_record_id": 112,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 248
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ROOT\\VOLMGR\\0000",
    "DriverName": "volmgr.inf",
    "ClassGuid": "4D36E97D-E325-11CE-BFC1-08002BE10318",
    "DriverDate": "06/21/2006",
    "DriverVersion": "10.0.22621.608",
    "DriverProvider": "Microsoft",
    "DriverInbox": true,
    "DriverSection": "Volmgr",
    "DriverRank": "0xff0000",
    "MatchingDeviceId": "ROOT\\VOLMGR",
    "OutrankedDrivers": "",
    "DeviceUpdated": false,
    "Status": "0x0",
    "ParentDeviceInstanceId": "HTREE\\ROOT\\0"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 410: Device DeviceInstanceId was started.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Informational
Collection Priority: Recommended (NSA)
Opcode: Info

Description

Device DeviceInstanceId was started.

Message #

Device %1 was started.

Driver Name: %2
Class GUID: %3
Service: %4
Lower Filters: %5
Upper Filters: %6

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`ServiceName` UnicodeString	Service.
`LowerFilters` UnicodeString
`UpperFilters` UnicodeString
`Problem` HexInt32
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 410,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:12:16.5253427+00:00",
    "event_record_id": 145,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 2340
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ROOT\\NETFT\\0000",
    "DriverName": "netft.inf",
    "ClassGuid": "{4d36e972-e325-11ce-bfc1-08002be10318}",
    "ServiceName": "Netft",
    "LowerFilters": "",
    "UpperFilters": "",
    "Problem": "0x0",
    "Status": "0x0"
  },
  "message": "Device ROOT\\NETFT\\0000 was started.\r\n\r\nDriver Name: netft.inf\r\nClass Guid: {4d36e972-e325-11ce-bfc1-08002be10318}\r\nService: Netft\r\nLower Filters: \r\nUpper Filters: "
}

Event ID 411: Device DeviceInstanceId had a problem starting.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Error
Opcode: Info

Description

Device DeviceInstanceId had a problem starting.

Message #

Device %1 had a problem starting.

Driver Name: %2
Class GUID: %3
Service: %4
Lower Filters: %5
Upper Filters: %6
Problem: %7
Problem Status: %8

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`ServiceName` UnicodeString	Service.
`LowerFilters` UnicodeString
`UpperFilters` UnicodeString
`Problem` HexInt32
`Status` HexInt32	Problem Status. NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 411,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-26T04:17:42.366175+00:00",
    "event_record_id": 168,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 52
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "PCI\\VEN_8086&DEV_100F&SUBSYS_075015AD&REV_01\\4&bbf9765&0&0088",
    "DriverName": "nete1g3e.inf",
    "ClassGuid": "4D36E972-E325-11CE-BFC1-08002BE10318",
    "ServiceName": "E1G60",
    "LowerFilters": "",
    "UpperFilters": "",
    "Problem": "0x0",
    "Status": "0xc00000e5"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 412: Device Driver_Name requires a system reboot before it can be started.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device Driver_Name requires a system reboot before it can be started.

Message #

Device %1 requires a system reboot before it can be started.

Driver Name: %2
Class GUID: %3
Service: %4
Lower Filters: %5
Upper Filters: %6
Problem: %7
Problem Status: %8

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ClassGuid` GUID
`ServiceName` UnicodeString
`LowerFilters` UnicodeString
`UpperFilters` UnicodeString
`Problem` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 420: Device DeviceInstanceId was deleted.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Informational
Opcode: Info

Description

Device DeviceInstanceId was deleted.

Message #

Device %1 was deleted.

Class GUID: %2

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`ClassGuid` GUID
`Problem` HexInt32
`Status` HexInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 420,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T17:24:14.944455+00:00",
    "event_record_id": 226,
    "correlation": {},
    "execution": {
      "process_id": 3668,
      "thread_id": 7476
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "SWD\\PRINTENUM\\{01F312F1-DACA-4AA7-96B1-5CE1A11685FD}",
    "ClassGuid": "1ED2BBF9-11F0-4084-B21F-AD83A8E6DCDC",
    "Problem": "0x2d",
    "Status": "0x0"
  },
  "message": ""
}

Event ID 421: Device Class_Guid could not be deleted.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device Class_Guid could not be deleted.

Message #

Device %1 could not be deleted.

Class GUID: %2
Problem: %3
Status: %4

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`ClassGuid` GUID
`Problem` HexInt32
`Status` HexInt32	NTSTATUS reference

Event ID 430: Device DeviceInstanceId requires further installation.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Level: Informational
Opcode: Info

Description

Device DeviceInstanceId requires further installation.

Message #

Device %1 requires further installation.

Fields #

Name	Description
`DeviceInstanceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 430,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-26T04:16:49.350000+00:00",
    "event_record_id": 160,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 248
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "PCI\\VEN_8086&DEV_100F&SUBSYS_075015AD&REV_01\\4&bbf9765&0&0888"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 440: Device settings for Last_Device_Instance_Id were migrated from previous OS installation.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device settings for Last_Device_Instance_Id were migrated from previous OS installation.

Message #

Device settings for %1 were migrated from previous OS installation.

Last Device Instance ID: %2
Class GUID: %3
Location Path: %4
Migration Rank: %5
Present: %6

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`LastDeviceInstanceId` UnicodeString
`ClassGuid` GUID
`LocationPath` UnicodeString
`MigrationRank` HexInt64
`Present` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 441: Device settings for Last_Device_Instance_Id could not be migrated from previous OS installation.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device settings for Last_Device_Instance_Id could not be migrated from previous OS installation.

Message #

Device settings for %1 could not be migrated from previous OS installation.

Last Device Instance ID: %2
Class GUID: %3
Location Path: %4
Migration Rank: %5
Present: %6
Status: %7

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`LastDeviceInstanceId` UnicodeString
`ClassGuid` GUID
`LocationPath` UnicodeString
`MigrationRank` HexInt64
`Present` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 442: Device settings for Last_Device_Instance_Id were not migrated from previous OS installation due to partial or ambiguous device match.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration
Opcode: Info

Description

Device settings for Last_Device_Instance_Id were not migrated from previous OS installation due to partial or ambiguous device match.

Message #

Device settings for %1 were not migrated from previous OS installation due to partial or ambiguous device match.

Last Device Instance ID: %2
Class GUID: %3
Location Path: %4
Migration Rank: %5
Present: %6
Status: %7

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`LastDeviceInstanceId` UnicodeString
`ClassGuid` GUID
`LocationPath` UnicodeString
`MigrationRank` HexInt64
`Present` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 500: DevQuery_QueryProcessing

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: DevQuery_QueryProcessing
Opcode: QueryStart

Fields #

Name	Description
`QueryAddress` Pointer
`ProcessId` UInt32
`ObjectType` UnicodeString
`QueryType` UnicodeString
`ObjectId` UnicodeString
`QueryFlags` UnicodeString
`PreferredLanguages` UnicodeString
`RequestedProperties` UnicodeString
`FilterExpression` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 500,
    "version": 0,
    "level": 4,
    "task": 500,
    "opcode": 10,
    "keywords": "0x0000000001200000",
    "time_created": "2026-06-02T05:27:16.405+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-0002-0E59-828753F0DC01}"
    },
    "execution": {
      "process_id": 16540,
      "thread_id": 23192
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "FilterExpression": "NULL",
    "ObjectId": "NULL",
    "ObjectType": "Device",
    "PreferredLanguages": "NULL",
    "ProcessId": 16540,
    "QueryAddress": "0xFFFF878DC7348210",
    "QueryFlags": "",
    "QueryType": "Type",
    "RequestedProperties": "NULL"
  },
  "message": "DevQuery_QueryProcessing"
}

Event ID 501: DevQuery_QueryProcessingProcessingStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: DevQuery_QueryProcessing
Opcode: ProcessingStart

Fields #

Name	Description
`QueryAddress` Pointer

Event ID 502: DevQuery_QueryProcessingProcessingStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: DevQuery_QueryProcessing
Opcode: ProcessingStop

Fields #

Name	Description
`QueryAddress` Pointer

Event ID 503: DevQuery_QueryProcessing

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: DevQuery_QueryProcessing
Opcode: QueryStop

Fields #

Name	Description
`QueryAddress` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 503,
    "version": 0,
    "level": 4,
    "task": 500,
    "opcode": 11,
    "keywords": "0x0000000001200000",
    "time_created": "2026-06-02T05:27:16.407+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-0002-0E59-828753F0DC01}"
    },
    "execution": {
      "process_id": 16540,
      "thread_id": 17996
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "QueryAddress": "0xFFFF878DC7348210"
  },
  "message": "DevQuery_QueryProcessing"
}

Event ID 600: A start type override of StartType was set for driver Driver in hardware configuration HardwareConfigurationId.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Diagnostic
Task: DriverOverride

Description

A start type override of StartType was set for driver Driver in hardware configuration HardwareConfigurationId.

Message #

A start type override of %3 was set for driver %2 in hardware configuration %1

Fields #

Name	Description
`HardwareConfigurationId` HexInt32
`Driver` UnicodeString
`StartType` HexInt32	Known values `0` Boot `1` System `2` Automatic `3` Manual `4` Disabled

Event ID 700: CfgMgr_DeviceList

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: CfgMgr_DeviceList
Opcode: Start

Fields #

Name	Description
`Filter` UnicodeString
`FilterBy` UnicodeString
`OnlyPresent` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 700,
    "version": 0,
    "level": 4,
    "task": 700,
    "opcode": 1,
    "keywords": "0x0000000001400000",
    "time_created": "2026-06-02T05:27:15.299+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4028,
      "thread_id": 17828
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Filter": "{6bdd1fc5-810f-11d0-bec7-08002be2092f}",
    "FilterBy": "Class",
    "OnlyPresent": true
  },
  "message": "CfgMgr_DeviceList"
}

Event ID 701: CfgMgr_DeviceList

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: CfgMgr_DeviceList
Opcode: Stop

Fields #

Name	Description
`Result` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 701,
    "version": 0,
    "level": 4,
    "task": 700,
    "opcode": 2,
    "keywords": "0x0000000001400000",
    "time_created": "2026-06-02T05:27:15.299+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4028,
      "thread_id": 17828
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "00000000"
  },
  "message": "CfgMgr_DeviceList"
}

Event ID 702: CfgMgr_DeviceInterfaceList

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: CfgMgr_DeviceInterfaceList
Opcode: Start

Fields #

Name	Description
`Class` GUID
`Device` UnicodeString
`OnlyPresent` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 702,
    "version": 0,
    "level": 4,
    "task": 702,
    "opcode": 1,
    "keywords": "0x0000000001400000",
    "time_created": "2026-06-02T05:27:15.469+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 11204,
      "thread_id": 17268
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Class": "{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}",
    "Device": "NULL",
    "OnlyPresent": false
  },
  "message": "CfgMgr_DeviceInterfaceList"
}

Event ID 703: CfgMgr_DeviceInterfaceList

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Also via: realtime ETW trace
Level: Informational
Task: CfgMgr_DeviceInterfaceList
Opcode: Stop

Fields #

Name	Description
`Result` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 703,
    "version": 0,
    "level": 4,
    "task": 702,
    "opcode": 2,
    "keywords": "0x0000000001400000",
    "time_created": "2026-06-02T05:27:15.469+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 11204,
      "thread_id": 17268
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Result": "00000000"
  },
  "message": "CfgMgr_DeviceInterfaceList"
}

Event ID 704: CfgMgr_QueryRemoveStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: CfgMgr_QueryRemove
Opcode: Start

Fields #

Name	Description
`QueryRemoveType` HexInt32
`Device` UnicodeString

Event ID 705: CfgMgr_QueryRemoveStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: CfgMgr_QueryRemove
Opcode: Stop

Fields #

Name	Description
`Device` UnicodeString

Event ID 800: Begin processing new device (DeviceNode).

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ProcessNewDevice
Opcode: Start

Description

Begin processing new device (DeviceNode).

Message #

Begin processing new device (%1)

Fields #

Name	Description
`DeviceNode` Pointer

Event ID 801: Processing device DeviceInstancePath (DeviceNode).

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ProcessNewDevice

Description

Processing device DeviceInstancePath (DeviceNode).

Message #

Processing device %2 (%1)

Fields #

Name	Description
`DeviceNode` Pointer
`DeviceInstancePath` UnicodeString
`ParentDeviceInstancePath` UnicodeString

Event ID 802: End processing new device (DeviceNode).

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ProcessNewDevice
Opcode: Stop

Description

End processing new device (DeviceNode).

Message #

End processing new device (%1)

Fields #

Name	Description
`DeviceNode` Pointer

Event ID 803: Begin processing phase Phase of starting device Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: ProcessDeviceStart
Opcode: Start

Description

Begin processing phase Phase of starting device Device.

Message #

Begin processing phase %1 of starting device %2

Fields #

Name	Description
`Phase` HexInt32
`Device` UnicodeString

Event ID 804: End processing phase Phase of starting device Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: ProcessDeviceStart
Opcode: Stop

Description

End processing phase Phase of starting device Device.

Message #

End processing phase %1 of starting device %2

Fields #

Name	Description
`Phase` HexInt32
`Device` UnicodeString

Event ID 805: Begin processing phase Phase of restarting device Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: ProcessDeviceRestart
Opcode: Start

Description

Begin processing phase Phase of restarting device Device.

Message #

Begin processing phase %1 of restarting device %2

Fields #

Name	Description
`Phase` HexInt32
`Device` UnicodeString

Event ID 806: End processing phase Phase of restarting device Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: ProcessDeviceRestart
Opcode: Stop

Description

End processing phase Phase of restarting device Device.

Message #

End processing phase %1 of restarting device %2

Fields #

Name	Description
`Phase` HexInt32
`Device` UnicodeString

Event ID 807: Begin device add operation for driver DriverName, device DeviceInstancePath.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceAdd
Opcode: Start

Description

Begin device add operation for driver DriverName, device DeviceInstancePath.

Message #

Begin device add operation for driver %3, device %4

Fields #

Name	Description
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`DriverNameLength` UInt16
`DriverName` UnicodeString
`DeviceInstancePath` UnicodeString

Event ID 808: End device add, status (Status).

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceAdd
Opcode: Stop

Description

End device add, status (Status).

Message #

End device add, status (%1)

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 809: Duplicate device instance reported by BusId and DeviceId.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Duplicate device instance reported by BusId and DeviceId.

Message #

Duplicate device instance reported by %4 and %5.
Bus ID: %1
Device ID: %2
Instance ID: %3

Fields #

Name	Description
`BusId` UnicodeString
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`PreviousParent` UnicodeString
`CurrentParent` UnicodeString

Event ID 810: Reenumeration of device tree below Device has been queued.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceTree

Description

Reenumeration of device tree below Device has been queued.

Message #

Reenumeration of device tree below %1 has been queued.

Fields #

Name	Description
`Device` UnicodeString
`ReenumerateType` HexInt32

Event ID 811: Begin reenumeration of device tree below Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceTree
Opcode: Start

Description

Begin reenumeration of device tree below Device.

Message #

Begin reenumeration of device tree below %1.

Fields #

Name	Description
`Device` UnicodeString
`ReenumerateType` HexInt32

Event ID 812: End reenumeration of device tree below Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceTree
Opcode: Stop

Description

End reenumeration of device tree below Device.

Message #

End reenumeration of device tree below %1.

Fields #

Name	Description
`Device` UnicodeString
`ReenumerateType` HexInt32

Event ID 813: Reenumeration of Device has been queued.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceOnly

Description

Reenumeration of Device has been queued.

Message #

Reenumeration of %1 has been queued.

Fields #

Name	Description
`Device` UnicodeString

Event ID 814: Begin reenumeration of Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceOnly
Opcode: Start

Description

Begin reenumeration of Device.

Message #

Begin reenumeration of %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 815: End reenumeration of Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: ReenumerateDeviceOnly
Opcode: Stop

Description

End reenumeration of Device.

Message #

End reenumeration of %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 816: Configuration of device Device for configuration type RequestType has been queued.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: ConfigureDevice

Description

Configuration of device Device for configuration type RequestType has been queued.

Message #

Configuration of device %1 for configuration type %2 has been queued.

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32

Event ID 817: Begin configuration of device Device for configuration type RequestType.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: ConfigureDevice
Opcode: Start

Description

Begin configuration of device Device for configuration type RequestType.

Message #

Begin configuration of device %1 for configuration type %2.

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32

Event ID 818: End configuration of device Device for configuration type RequestType.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Configuration Diagnostic
Task: ConfigureDevice
Opcode: Stop

Description

End configuration of device Device for configuration type RequestType. Result is Status.

Message #

End configuration of device %1 for configuration type %2. Result is %3

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32
`Status` UInt32	NTSTATUS reference

Event ID 819: GenericDeviceAction

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: GenericDeviceAction

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32

Event ID 820: GenericDeviceActionStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: GenericDeviceAction
Opcode: Start

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32

Event ID 821: GenericDeviceActionStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: GenericDeviceAction
Opcode: Stop

Fields #

Name	Description
`Device` UnicodeString
`RequestType` HexInt32
`Status` UInt32	NTSTATUS reference

Event ID 830: Removal of Device has been queued.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceRemoval

Description

Removal of Device has been queued.

Message #

Removal of %1 has been queued.

Fields #

Name	Description
`Device` UnicodeString
`EventGuid` GUID
`ProblemCode` UInt32
`ProblemStatus` HexInt32
`Synchronous` Boolean
`Flags` HexInt32

Event ID 831: Begin removal of Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceRemoval
Opcode: Start

Description

Begin removal of Device.

Message #

Begin removal of %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 832: End removal of Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: DeviceRemoval
Opcode: Stop

Description

End removal of Device.

Message #

End removal of %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 840: Begin resetting device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Opcode: Start

Description

Begin resetting device DeviceInstance.

Message #

Begin resetting device %2.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString

Event ID 841: End resetting device DeviceInstance with status Status, veto type VetoType, veto name VetoName.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Opcode: Stop

Description

End resetting device DeviceInstance with status Status, veto type VetoType, veto name VetoName.

Message #

End resetting device %2 with status %3, veto type %4, veto name %6.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`Status` UInt32	NTSTATUS reference
`VetoType` UInt32
`VetoNameLength` UInt16
`VetoName` UnicodeString

Event ID 850: Begin assigning resources to device tree below Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: AssignResources
Opcode: Start

Description

Begin assigning resources to device tree below Device.

Message #

Begin assigning resources to device tree below %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 851: End assigning resources to device tree below Device.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: AssignResources
Opcode: Stop

Description

End assigning resources to device tree below Device.

Message #

End assigning resources to device tree below %1.

Fields #

Name	Description
`Device` UnicodeString

Event ID 852: Begin rebalancing resources for device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: Rebalance
Opcode: Start

Description

Begin rebalancing resources for device DeviceInstance.

Message #

Begin rebalancing resources for device %2.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString

Event ID 853: End rebalancing resources for device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Enumeration Diagnostic
Task: Rebalance
Opcode: Stop

Description

End rebalancing resources for device DeviceInstance.

Message #

End rebalancing resources for device %2.

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 860: Updated problem code on device DeviceInstanceId.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: ProblemCode

Description

Updated problem code on device DeviceInstanceId.

Message #

Updated problem code on device %2.
Service name: %3
New problem code: %4
New problem status: %5
Old problem code: %6
Old problem status: %7

Fields #

Name	Description
`DeviceNode` Pointer
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`NewProblemCode` UInt32
`NewProblemStatus` HexInt32
`OldProblemCode` UInt32
`OldProblemStatus` HexInt32

Event ID 900: A long running thread for the device event queue was detected.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Warning
Task: WatchdogTriggered
Opcode: Start

Description

A long running thread for the device event queue was detected. The thread has been running for ThreadId milliseconds.

Message #

A long running thread for the device event queue was detected. The thread has been running for %4 milliseconds.
Thread ID: %1
Device: %2
Service: %3

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64
`EventCategory` UInt32
`EventGuid` GUID
`EventArgument` HexInt32
`EventArgumentStatus` HexInt32
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 900,
    "version": 1,
    "level": 3,
    "task": 900,
    "opcode": 1,
    "keywords": 144115188075855872,
    "time_created": "2026-05-30T02:07:59.6698259+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 424
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Driver Watchdog",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ThreadId": "0x108",
    "DeviceInstanceId": "",
    "ServiceName": "",
    "ElapsedTimeMs": "3003",
    "EventCategory": "2",
    "EventGuid": "{cb3a4004-46f0-11d0-b08f-00609713053f}",
    "EventArgument": "0x0",
    "EventArgumentStatus": "0x0",
    "CategorySpecificData_Guid": "{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}",
    "CategorySpecificData_String": "\\??\\STORAGE#Volume#{4769a76b-3ac5-11f1-a6b7-806e6f6e6963}#0000000021100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
  },
  "message": "A long running thread for the device event queue was detected. The thread has been running for 3003 milliseconds.\r\nThread ID: 0x108\r\nDevice: \r\nService: \r\nEvent Category: 2\r\nEvent GUID: {cb3a4004-46f0-11d0-b08f-00609713053f}\r\nEvent Argument: 0x0\r\nArgument Status: 0x0\r\nCategory Specific Data:\r\n{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\r\n\\??\\STORAGE#Volume#{4769a76b-3ac5-11f1-a6b7-806e6f6e6963}#0000000021100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
}

Event ID 901: A long running thread for the device event queue has been completed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Informational
Task: WatchdogTriggered
Opcode: Stop

Description

A long running thread for the device event queue has been completed.

Message #

A long running thread for the device event queue has been completed.
Thread ID: %1
Device: %2
Service: %3
Total run time in milliseconds: %4

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64
`EventCategory` UInt32
`EventGuid` GUID
`EventArgument` HexInt32
`EventArgumentStatus` HexInt32
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 901,
    "version": 1,
    "level": 4,
    "task": 900,
    "opcode": 2,
    "keywords": 144115188075855872,
    "time_created": "2026-05-30T02:07:59.7719600+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 264
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Driver Watchdog",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ThreadId": "0x108",
    "DeviceInstanceId": "",
    "ServiceName": "",
    "ElapsedTimeMs": "3105",
    "EventCategory": "2",
    "EventGuid": "{cb3a4004-46f0-11d0-b08f-00609713053f}",
    "EventArgument": "0x0",
    "EventArgumentStatus": "0x0",
    "CategorySpecificData_Guid": "{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}",
    "CategorySpecificData_String": "\\??\\STORAGE#Volume#{4769a76b-3ac5-11f1-a6b7-806e6f6e6963}#0000000021100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
  },
  "message": "A long running thread for the device event queue has been completed.\r\nThread ID: 0x108\r\nDevice: \r\nService: \r\nEvent Category: 2\r\nEvent GUID: {cb3a4004-46f0-11d0-b08f-00609713053f}\r\nEvent Argument: 0x0\r\nArgument Status: 0x0\r\nCategory Specific Data:\r\n{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\r\n\\??\\STORAGE#Volume#{4769a76b-3ac5-11f1-a6b7-806e6f6e6963}#0000000021100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\r\n\r\nTotal run time in milliseconds: 3105"
}

Event ID 902: A long running thread for device start processing was detected.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Warning
Task: WatchdogTriggered
Opcode: Start

Description

A long running thread for device start processing was detected. The thread has been running for ThreadId milliseconds.

Message #

A long running thread for device start processing was detected. The thread has been running for %4 milliseconds.
Thread ID: %1
Device: %2
Service: %3

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "event_id": 902,
    "level": 3,
    "task": 900,
    "opcode": 1,
    "time_created": "2026-04-18T00:24:03.8885756+00:00",
    "computer": "USERUSE-I0E7KUG",
    "channel": "Microsoft-Windows-Kernel-PnP"
  },
  "event_data": {
    "ThreadId": "0x8",
    "DeviceInstanceId": "PCIIDE\\IDEChannel\\4&403bef5&0&1",
    "ElapsedTimeMs": "3001",
    "ServiceName": "atapi"
  }
}

Event ID 903: A long running thread for device start processing has been completed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Informational
Task: WatchdogTriggered
Opcode: Stop

Description

A long running thread for device start processing has been completed.

Message #

A long running thread for device start processing has been completed.
Thread ID: %1
Device: %2
Service: %3
Total run time in milliseconds: %4

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "event_id": 903,
    "level": 4,
    "task": 900,
    "opcode": 2,
    "time_created": "2026-04-18T00:24:03.8892545+00:00",
    "computer": "USERUSE-I0E7KUG",
    "channel": "Microsoft-Windows-Kernel-PnP"
  },
  "event_data": {
    "ThreadId": "0x8",
    "DeviceInstanceId": "PCIIDE\\IDEChannel\\4&403bef5&0&1",
    "ElapsedTimeMs": "3001",
    "ServiceName": "atapi"
  }
}

Event ID 904: A long running thread for device removal was detected.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Task: WatchdogTriggered
Opcode: Start

Description

A long running thread for device removal was detected. The thread has been running for ThreadId milliseconds.

Message #

A long running thread for device removal was detected. The thread has been running for %4 milliseconds.
Thread ID: %1
Device: %2
Service: %3

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64

Event ID 905: A long running thread for device removal has been completed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Task: WatchdogTriggered
Opcode: Stop

Description

A long running thread for device removal has been completed.

Message #

A long running thread for device removal has been completed.
Thread ID: %1
Device: %2
Service: %3
Total run time in milliseconds: %4

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`ElapsedTimeMs` UInt64

Event ID 906: A long running thread for device add routine was detected.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Task: WatchdogTriggered
Opcode: Start

Description

A long running thread for device add routine was detected. The thread has been running for ThreadId milliseconds.

Message #

A long running thread for device add routine was detected. The thread has been running for %4 milliseconds.
Thread ID: %1
Device: %2
Driver: %3

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ElapsedTimeMs` UInt64

Event ID 907: A long running thread for device add routine has been completed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Task: WatchdogTriggered
Opcode: Stop

Description

A long running thread for device add routine has been completed.

Message #

A long running thread for device add routine has been completed.
Thread ID: %1
Device: %2
Driver: %3
Total run time in milliseconds: %4

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString
`ElapsedTimeMs` UInt64

Event ID 908: A long running thread for driver entry was detected.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Warning
Task: WatchdogTriggered
Opcode: Start

Description

A long running thread for driver entry was detected. The thread has been running for ElapsedTimeMs milliseconds.

Message #

A long running thread for driver entry was detected. The thread has been running for %4 milliseconds.
Thread ID: %1
Driver: %3

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString	Driver.
`ElapsedTimeMs` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 908,
    "version": 0,
    "level": 3,
    "task": 900,
    "opcode": 1,
    "keywords": 144115188075855872,
    "time_created": "2023-11-06T00:25:57.930157+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 2352
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Driver Watchdog",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ThreadId": "0x2ba4",
    "DeviceInstanceId": "",
    "DriverName": "avgSP",
    "ElapsedTimeMs": 10005
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 909: A long running thread for driver entry routine has been completed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog
Level: Informational
Task: WatchdogTriggered
Opcode: Stop

Description

A long running thread for driver entry routine has been completed.

Message #

A long running thread for driver entry routine has been completed.
Thread ID: %1
Driver: %3
Total run time in milliseconds: %4

Fields #

Name	Description
`ThreadId` HexInt64
`DeviceInstanceId` UnicodeString
`DriverName` UnicodeString	Driver.
`ElapsedTimeMs` UInt64	Total run time in milliseconds.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 909,
    "version": 0,
    "level": 4,
    "task": 900,
    "opcode": 2,
    "keywords": 144115188075855872,
    "time_created": "2023-11-06T00:26:29.468233+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11172
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Driver Watchdog",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ThreadId": "0x2ba4",
    "DeviceInstanceId": "",
    "DriverName": "avgSP",
    "ElapsedTimeMs": 41546
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 930: Timed out waiting for response from user mode clients to synchronous notification EventGuid.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog

Description

Timed out waiting for response from user mode clients to synchronous notification EventGuid.

Message #

Timed out waiting for response from user mode clients to synchronous notification %1
Event Category: %2
Device Instance ID: %3
Category Specific Data:
%4
%5

Fields #

Name	Description
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`TimeMs` UInt64

Event ID 931: Responses from user mode clients to synchronous notification EventGuid took TimeMs milliseconds.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog

Description

Responses from user mode clients to synchronous notification EventGuid took TimeMs milliseconds.

Message #

Responses from user mode clients to synchronous notification %1 took %6 milliseconds
Event Category: %2
Device Instance ID: %3
Category Specific Data:
%4
%5

Fields #

Name	Description
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`TimeMs` UInt64

Event ID 932: Synchronous notification EventGuid to process ProcessId (ProcessImageName) was removed after ElapsedTimeMs milliseconds.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog

Description

Synchronous notification EventGuid to process ProcessId (ProcessImageName) was removed after ElapsedTimeMs milliseconds.

Message #

Synchronous notification %7 to process %2 (%3) was removed after %14 milliseconds
Event Category: %8
Device Instance ID: %9
Category Specific Data:
%10
%11

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`RegistrationTeardown` Boolean
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`NotificationReceivedByClient` Boolean
`ElapsedTimeMs` UInt64

Event ID 933: Notification EventGuid to driver DriverName took ElapsedTimeMs milliseconds.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Driver Watchdog

Description

Notification EventGuid to driver DriverName took ElapsedTimeMs milliseconds.

Message #

Notification %4 to driver %3 took %5 milliseconds
Event Category: %1
Notification Specific Data:
%6
%8

Fields #

Name	Description
`EventCategory` UInt32
`DriverNameLength` UInt16
`DriverName` UnicodeString
`EventGuid` GUID
`ElapsedTimeMs` UInt64
`NotificationSpecific_Guid` GUID
`UnicodeStringLength` UInt16
`NotificationSpecific_UnicodeString` UnicodeString

Event ID 1000: Device DeviceInstanceId could not be query removed as the removal was vetoed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Level: Warning
Opcode: Info

Description

Device DeviceInstanceId could not be query removed as the removal was vetoed.

Message #

Device %1 could not be query removed as the removal was vetoed.

Veto Type: %2
Vetoed By: %3

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`VetoType` UInt32
`VetoName` UnicodeString	Vetoed By.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 1000,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 72057594037927936,
    "time_created": "2023-10-25T22:50:39.854895+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 384
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Device Management",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ACPI\\PNP0303\\4&1bd7f811&0",
    "VetoType": 6,
    "VetoName": "ACPI\\PNP0303\\4&1bd7f811&0\\Driver\\i8042prt"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1010: Device DeviceInstanceId has been surprise removed as it is reported as missing on the bus.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Level: Informational
Opcode: Info

Description

Device DeviceInstanceId has been surprise removed as it is reported as missing on the bus.

Message #

Device %1 has been surprise removed as it is reported as missing on the bus.
Count of devices removed: %2

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DeviceCount` UInt32	Count of devices removed.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 1010,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 72057594037927936,
    "time_created": "2026-06-13T05:22:34.5416180+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8144
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Device Management",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "UMB\\UMB\\1&841921d&0&TERMINPUT_BUS",
    "DeviceCount": "1"
  },
  "message": "Device UMB\\UMB\\1&841921d&0&TERMINPUT_BUS has been surprise removed as it is reported as missing on the bus.\r\nCount of devices removed: 1"
}

Event ID 1011: Device DeviceInstanceId has been surprise removed as it was reported to be failing.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Level: Warning
Opcode: Info

Description

Device DeviceInstanceId has been surprise removed as it was reported to be failing.

Message #

Device %1 has been surprise removed as it was reported to be failing.
Count of devices removed: %2

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`DeviceCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "{9C205A39-1250-487D-ABD7-E831C6290539}",
    "event_source_name": "",
    "event_id": 1011,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 72057594037927936,
    "time_created": "2026-04-15T21:23:59.3712212+00:00",
    "event_record_id": 696,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 6568
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Device Management",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "SWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001",
    "DeviceCount": "2"
  },
  "message": "Device SWD\\RemoteDisplayEnum\\RdpIdd_IndirectDisplay&SessionId_0001 has been surprise removed as it was reported to be failing.\r\nCount of devices removed: 2"
}

Event ID 1020: A resource rebalance operation has succeeded.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

A resource rebalance operation has succeeded.

Message #

A resource rebalance operation has succeeded.

Device Instance ID: %1
Service Name: %2
Device Count: %3
Rebalance Phase: %4
Subtree Root Instance ID: %5
Subtree Includes Root: %6
Rebalance Due to Dynamic Partitioning: %7
Rebalance Reason: %8
Conflicting Resource Type: %9
Duration in Milliseconds: %10
Device Reset: %11

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`DeviceCount` UInt32
`Phase` UInt32
`SubtreeRootInstanceId` UnicodeString
`SubtreeIncludesRoot` Boolean
`RebalanceDueToDynamicPartitioning` Boolean
`RebalanceReason` UInt32
`ConflictResourceType` UInt8
`DurationInMs` UInt64
`ResetDeviceWhileStopped` Boolean

Event ID 1021: A resource rebalance operation has failed.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

A resource rebalance operation has failed.

Message #

A resource rebalance operation has failed.

Device Instance ID: %1
Service Name: %2
Device Count: %3
Rebalance Phase: %4
Subtree Root Instance ID: %5
Subtree Includes Root: %6
Rebalance Due to Dynamic Partitioning: %7
Rebalance Reason: %8
Conflicting Resource Type: %9
Rebalance Failure: %10
Veto Reason: %11
Vetoing Device Node Instance ID: %12
Duration in Milliseconds: %13
Device Reset: %14

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`ServiceName` UnicodeString
`DeviceCount` UInt32
`Phase` UInt32
`SubtreeRootInstanceId` UnicodeString
`SubtreeIncludesRoot` Boolean
`RebalanceDueToDynamicPartitioning` Boolean
`RebalanceReason` UInt32
`ConflictResourceType` UInt8
`RebalanceFailure` UInt32
`VetoReason` UInt32
`VetoNodeInstanceId` UnicodeString
`DurationInMs` UInt64
`ResetDeviceWhileStopped` Boolean

Event ID 1030: Device Device has been assigned to a guest partition.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Device Device has been assigned to a guest partition.

Message #

Device %1 has been assigned to a guest partition.

Fields #

Name	Description
`Device` UnicodeString

Event ID 1031: Device Device is no longer assigned to a guest partition.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Device Device is no longer assigned to a guest partition.

Message #

Device %1 is no longer assigned to a guest partition.

Fields #

Name	Description
`Device` UnicodeString

Event ID 1040: Device Flags has requested a platform-level device reset.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Start

Description

Device Flags has requested a platform-level device reset.

Message #

Device %1 has requested a platform-level device reset.

Flags: %2

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`Flags` UInt32

Event ID 1041: Device Veto_type has completed a platform-level device reset.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Stop

Description

Device Veto_type has completed a platform-level device reset.

Message #

Device %2 has completed a platform-level device reset.

Status: %3
Veto type: %4
Vetoed By: %6

Fields #

Name	Description
`DeviceInstanceLength` UInt16
`DeviceInstance` UnicodeString
`Status` UInt32	NTSTATUS reference
`VetoType` UInt32
`VetoNameLength` UInt16
`VetoName` UnicodeString

Event ID 1050: Failed to create driver package defined child device of Child_Instance_ID.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Failed to create driver package defined child device of Child_Instance_ID.

Message #

Failed to create driver package defined child device of %1.

Child Instance ID: %2
Status: %3

Fields #

Name	Description
`ParentDeviceInstancePath` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1060: Failed to create computer device derived from firmware information.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Failed to create computer device derived from firmware information. Status: Status.

Message #

Failed to create computer device derived from firmware information. Status: %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

Event ID 1065: Device DeviceInstanceId with problem code ProblemCode and problem status ProblemStatus requires the system to be rebooted.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management

Description

Device DeviceInstanceId with problem code ProblemCode and problem status ProblemStatus requires the system to be rebooted.

Message #

Device %1 with problem code %2 and problem status %3 requires the system to be rebooted.
Additional information:
%4

Fields #

Name	Description
`DeviceInstanceId` UnicodeString
`ProblemCode` UInt32
`ProblemStatus` HexInt32
`AdditionalInfo` HexInt64

Event ID 1070: Failed to open DeviceStackLocation driver service ServiceName for device DeviceInstance.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Opcode: Info

Description

Failed to open DeviceStackLocation driver service ServiceName for device DeviceInstance. Status: Status.

Message #

Failed to open %3 driver service %2 for device %1. Status: %4

Fields #

Name	Description
`DeviceInstance` UnicodeString
`ServiceName` UnicodeString
`DeviceStackLocation` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1080: The driver FailureName failed to unload.

Provider: Microsoft-Windows-Kernel-PnP
Channel: Device Management
Task: DriverUnload

Description

The driver FailureName failed to unload.

Message #

The driver %5 failed to unload.
Driver Version: %6
Status: %3

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`Status` UInt32	NTSTATUS reference
`FailureNameLength` UInt16
`FailureName` UnicodeString
`Version` UInt32

Event ID 1100: SwDevice_IrpCreateStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_IrpCreate
Opcode: Start

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1100

Event ID 1101: SwDevice_IrpCreateStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_IrpCreate
Opcode: Stop

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1101

Event ID 1102: SwDevice_KernelCreateStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_KernelCreate
Opcode: Start

Fields #

Name	Description
`EnumeratorName` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1102

Event ID 1103: SwDevice_KernelCreateStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_KernelCreate
Opcode: Stop

Fields #

Name	Description
`EnumeratorName` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1104: task_01104

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`EnumeratorName` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString
`CapabilityFlags` HexInt32
`DeviceDescription` UnicodeString
`DeviceLocation` UnicodeString
`NumProperties` UInt32

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1104

Event ID 1105: task_01105

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1105

Event ID 1106: task_01106

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1107: task_01107

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Opcode: Info

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`RemovedFromBus` Boolean
`HasPrimaryDeviceObject` Boolean

Event ID 1108: SwDevice_InstanceTable_Add

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_InstanceTable_Add

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`AlreadyExists` Boolean

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=1108

Event ID 1109: SwDevice_InstanceTable_Remove

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_InstanceTable_Remove

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1110: SwDevice_DeviceEnumeratedStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_DeviceEnumerated
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`DeviceInstancePath` UnicodeString

Event ID 1111: SwDevice_DeviceEnumeratedStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_DeviceEnumerated
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1120: SwDevice_RelationAddStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RelationAdd
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1121: SwDevice_RelationAddStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RelationAdd
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

References #

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 1122: SwDevice_RelationRemove

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RelationRemove

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString

Event ID 1130: SwDevice_LifetimeChangeStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_LifetimeChange
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1131: SwDevice_LifetimeChangeStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_LifetimeChange
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1132: SwDevice_LifetimeChange

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_LifetimeChange

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`OldLifetime` UInt32
`NewLifetime` UInt32

Event ID 1140: SwDevice_RegisterInterfaceStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RegisterInterface
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1141: SwDevice_RegisterInterfaceStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RegisterInterface
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1142: SwDevice_RegisterInterface

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_RegisterInterface

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`SymbolicLink` UnicodeString

Event ID 1143: SwDevice_SetInterfaceState

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetInterfaceState

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`SymbolicLink` UnicodeString
`Enable` Boolean

Event ID 1144: SwDevice_SetInterfaceStateStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetInterfaceState
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1145: SwDevice_SetInterfaceStateStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetInterfaceState
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1150: SwDevice_SetDevicePropertyStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetDeviceProperty
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1151: SwDevice_SetDevicePropertyStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetDeviceProperty
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1160: SwDevice_SetInterfacePropertyStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetInterfaceProperty
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1161: SwDevice_SetInterfacePropertyStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_SetInterfaceProperty
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1170: SwDevice_IrpCloseStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_IrpClose
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1171: SwDevice_IrpCloseStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_IrpClose
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`DeviceClosed` Boolean

Event ID 1172: SwDevice_KernelCloseStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_KernelClose
Opcode: Start

Fields #

Name	Description
`ParentDeviceInstanceId` UnicodeString
`EnumeratorName` UnicodeString
`InstanceId` UnicodeString

Event ID 1173: SwDevice_KernelCloseStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_KernelClose
Opcode: Stop

Fields #

Name	Description
`ParentDeviceInstanceId` UnicodeString
`EnumeratorName` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1174: SwDevice_CloseDescendants

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_CloseDescendants

Fields #

Name	Description
`ParentDeviceInstanceId` UnicodeString

Event ID 1175: SwDevice_CloseDevice

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_CloseDevice

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1176: SwDevice_ProcessRemove

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_ProcessRemove

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`DeviceInstanceId` UnicodeString
`KeepActive` Boolean
`SwDeviceFlags` HexInt32
`DeviceExtensionFlags` HexInt32

Event ID 1177: SwDevice_ProcessParentRemove

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_ProcessParentRemove

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`DeviceInstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString
`SwDeviceFlags` HexInt32
`DeviceExtensionFlags` HexInt32

Event ID 1178: SwDevice_UninstallDevice

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_UninstallDevice

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`DeviceInstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1190: SwDevice_GetChildPdoStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_GetChildPdo
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`ParentDeviceInstanceId` UnicodeString
`SwDeviceFlags` HexInt32

Event ID 1191: SwDevice_GetChildPdoStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_GetChildPdo
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`PdoReported` Boolean
`NewPdo` Boolean

Event ID 1192: SwDevice_GetChildPdo

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_GetChildPdo

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`SkipCount` UInt32

Event ID 1200: SwDevice_AttributesChangeStart

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_AttributesChange
Opcode: Start

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString

Event ID 1201: SwDevice_AttributesChangeStop

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_AttributesChange
Opcode: Stop

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`Status` HexInt32	NTSTATUS reference

Event ID 1202: SwDevice_AttributesChange

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational
Task: SwDevice_AttributesChange

Fields #

Name	Description
`DeviceId` UnicodeString
`InstanceId` UnicodeString
`OldAttributes` UInt32
`NewAttributes` UInt32

Event ID 1300: task_01300

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`ElapsedTimeMs` UInt64

Event ID 1301: task_01301

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`ElapsedTimeMs` UInt64

Event ID 1302: task_01302

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 1303: task_01303

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`Status` HexInt32	NTSTATUS reference

Event ID 1304: task_01304

Provider: Microsoft-Windows-Kernel-PnP
Channel: Operational

Fields #

Name	Description
`FilterType` UInt32
`ProcessId` UInt32
`ProcessImageName` UnicodeString
`QueueDepth` UInt32
`DropCount` UInt32
`RegistrationTeardown` Boolean
`EventGuid` GUID
`EventCategory` UInt32
`DeviceInstanceId` UnicodeString
`CategorySpecificData_Guid` GUID
`CategorySpecificData_String` UnicodeString
`Synchronous` Boolean
`NotificationReceivedByClient` Boolean
`ElapsedTimeMs` UInt64

Event ID 1400: Begin serializing boot with PnP device enumeration

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SerializeBoot
Opcode: Start

Description

Begin serializing boot with PnP device enumeration.

Message #

Begin serializing boot with PnP device enumeration

Event ID 1401: End serializing boot with PnP device enumeration

Provider: Microsoft-Windows-Kernel-PnP
Channel: Boot Diagnostic
Task: SerializeBoot
Opcode: Stop

Description

End serializing boot with PnP device enumeration.

Message #

End serializing boot with PnP device enumeration

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {9C205A39-1250-487D-ABD7-E831C6290539}

Defined in microsoft-windows-kernel-pnp-events.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)