Microsoft-Windows-MediaFoundation-Platform
49 events across 2 channels
Event ID 1: Attempt to use MFT clsid clsid marked as do not use.
#Event ID 2: Attempt to use Media Source clsid clsid marked as do not use.
#Event ID 3: Mark MFT clsid clsid do not use = Disabled.
#Event ID 4: Mark Media Source clsid clsid do not use = Disabled.
#Event ID 5: Choosing preferred MFT clsid clsid for subtype Selector.
#Event ID 6: Registering preferred MFT clsid clsid for subtype Selector.
#Event ID 7: Choosing preferred Media Source clsid clsid for Selector.
#Event ID 8: Registering preferred Media Soure clsid clsid for Selector.
#Event ID 9: Found preferred MFT clsid clsid for media subtype Selector.
#Event ID 10: Did not find preferred MFT for media subtype Selector.
#Event ID 11: Query MFT clsid clsid do not use: Disabled.
#Event ID 12: Found preferred Media Source clsid clsid for Selector.
#Event ID 13: Did not find preferred Media Source for Selector.
#Event ID 14: Query Media Source clsid clsid do not use: Disabled.
#Event ID 15: Registering local MFT(MFTName).
#Event ID 16: Unregistering local MFT(MFTName).
#Event ID 17: Enumerating local MFT(MFTName).
#Event ID 19: MF_MFT_Hardware_Enumeration
#Fields #
| Name | Description |
|---|---|
LinkName UnicodeString | |
FriendlyName UnicodeString |
Event ID 21: Configuration: dwType = dwType dwConfig=dwConfig.
#Event ID 100: MFStartup returned hr.
#Event ID 102: MFShutdown Stop - return code hr.
#Event ID 103: MFGetConfigurationKey Type Type Key KeyName Result lResult.
#Event ID 104: MFGetConfigurationValueDWORD Type Type Key KeyName ValueName ValueName Result lResult QuerySize QuerySize ValueResult ValueDWORD.
#Event ID 105: MFGetConfigurationValueString Type Type Key KeyName ValueName ValueName Result lResult QuerySize QuerySize ValueResult ValueString.
#Event ID 200: Source Resolver Context(Context) Resolve url flags hr.
#Event ID 201: Source Resolver Context(Context) Trying Scheme Handler clsid.
#Event ID 202: Source Resolver Context(Context) Trying Byte Scheme Handler CLSID(clsid).
#Event ID 203: Source Resolver Context(Context) SchemeHandler Result hr.
#Event ID 204: Source Resolver Context(Context) Byte stream Handler Result hr.
#Event ID 205: Source Resolver Context(Context) Resolving url returned hr.
#Event ID 206: TraceFailure logger (Context) line Line result hr function function.
#Event ID 207: ByteStreamOnInputStream_Read_Start stream (stream) ptr offset length length.
#Event ID 208: ByteStreamOnInputStream_Read_Stop stream (stream) ptr length length buffer hr hr.
#Event ID 300: MFTEnumEx flags flags, category Category for input type (inputType,inputSubtype), output type (outputType,outputSubtype).
#Event ID 301: Found matching software MFT clsid.
#Event ID 302: Found Local MFT string.
#Event ID 303: Found Hardware MFT string.
#Event ID 304: MFTEnumEx returned code hr, found localMFTs local MFTs, softwareMFTs software MFTs, hardwareMFTs hardware MFTs, deviceRegHardwareMFTs device reg hardware MFTs, and packagedMFTs packaged MFTs.
#Description
MFTEnumEx returned code hr, found localMFTs local MFTs, softwareMFTs software MFTs, hardwareMFTs hardware MFTs, deviceRegHardwareMFTs device reg hardware MFTs, and packagedMFTs packaged MFTs.
Message #
Fields #
| Name | Description |
|---|---|
hr HexInt32 | |
localMFTs UInt32 | |
softwareMFTs UInt32 | |
hardwareMFTs UInt32 | |
deviceRegHardwareMFTs UInt32 | |
packagedMFTs UInt32 |
Event ID 305: MFTEnum2 flags flags, category Category for input type (inputType,inputSubtype), output type (outputType,outputSubtype), LUID set: luidSet.
#Event ID 306: MFTEnum2 returned code hr, found numMFTs MFTs matching adapter with vendor ID adapterVendorId, device ID adapterDeviceId, SubSys ID adapterSubSysId, Revision adapterRevision.
#Description
MFTEnum2 returned code hr, found numMFTs MFTs matching adapter with vendor ID adapterVendorId, device ID adapterDeviceId, SubSys ID adapterSubSysId, Revision adapterRevision.
Message #
Fields #
| Name | Description |
|---|---|
hr HexInt32 | |
numMFTs UInt32 | |
adapterVendorId HexInt32 | |
adapterDeviceId HexInt32 | |
adapterSubSysId HexInt32 | |
adapterRevision HexInt32 |
Event ID 2501: MFGetMFTMerit Leave Merit(Merit) Return Code(hr).
#Event ID 2502: MFGetMFTMerit: StartInitialization returned hr.
#Event ID 2503: MFGetMFTMerit: Validate Certificate returned hr.
#Event ID 2504: MFGetMFTMerit: EndInitialization returned hr.
#Event ID 2505: MFGetMFTMerit: GetInformation returned hr.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID bc97b970-d001-482f-8745-b8d7d5759f99
Defined in mfplat.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02