Microsoft-Windows-MediaFoundation-Platform
Event ID 1: Attempt to use MFT clsid clsid marked as do not use.
#Event ID 2: Attempt to use Media Source clsid clsid marked as do not use.
#Event ID 3: Mark MFT clsid clsid do not use = Disabled.
#Event ID 4: Mark Media Source clsid clsid do not use = Disabled.
#Event ID 5: Choosing preferred MFT clsid clsid for subtype Selector.
#Event ID 6: Registering preferred MFT clsid clsid for subtype Selector.
#Event ID 7: Choosing preferred Media Source clsid clsid for Selector.
#Event ID 8: Registering preferred Media Soure clsid clsid for Selector.
#Event ID 9: Found preferred MFT clsid clsid for media subtype Selector.
#Event ID 10: Did not find preferred MFT for media subtype Selector.
#Event ID 11: Query MFT clsid clsid do not use: Disabled.
#Event ID 12: Found preferred Media Source clsid clsid for Selector.
#Event ID 13: Did not find preferred Media Source for Selector.
#Event ID 14: Query Media Source clsid clsid do not use: Disabled.
#Event ID 16: Unregistering local MFT(MFTName).
#Event ID 19: MF_MFT_Hardware_Enumeration
#Fields #
| Name | Description |
|---|---|
LinkName UnicodeString | |
FriendlyName UnicodeString |
Event ID 21: Configuration: dwType = dwType dwConfig=dwConfig.
#Event ID 100: MFStartup returned hr.
#Message #
Fields #
| Name | Description |
|---|---|
hr HexInt32 |
Example Event #
{
"system": {
"channel": "MediaFoundationPlatform",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 100,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10776,
"thread_id": 5912
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MediaFoundation-Platform",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:10:39.401Z",
"version": 0
},
"event_data": {
"hr": "00000000"
},
"message": ""
}
Event ID 101: MFShutdown Start
#Event ID 103: MFGetConfigurationKey Type Type Key KeyName Result lResult.
#Message #
Fields #
| Name | Description |
|---|---|
Type Int32 | |
KeyName UnicodeString | |
lResult Int32 |
Example Event #
{
"system": {
"channel": "MediaFoundationPlatform",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 103,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10776,
"thread_id": 5912
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-MediaFoundation-Platform",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:10:39.400Z",
"version": 0
},
"event_data": {
"KeyName": "SOFTWARE\\Microsoft\\Windows Media Foundation\\Platform",
"Type": 0,
"lResult": 0
},
"message": ""
}
Event ID 104: MFGetConfigurationValueDWORD Type Type Key KeyName ValueName ValueName Result lResult QuerySize QuerySize ValueResult ValueDWORD.
#Message #
Fields #
| Name | Description |
|---|---|
Type Int32 | |
KeyName UnicodeString | |
ValueName UnicodeString | |
lResult Int32 | |
QuerySize Boolean | |
ValueDWORD UInt32 |
Example Event #
{
"system": {
"channel": "MediaFoundationPlatform",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 104,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 10776,
"thread_id": 5912
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-MediaFoundation-Platform",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 02:10:39.401Z",
"version": 0
},
"event_data": {
"KeyName": "Platform\\CallStackTracingEnabled",
"QuerySize": false,
"Type": 0,
"ValueDWORD": 0,
"ValueName": "CallStackTracingEnabled",
"lResult": 2
},
"message": ""
}
Event ID 105: MFGetConfigurationValueString Type Type Key KeyName ValueName ValueName Result lResult QuerySize QuerySize ValueResult ValueString.
#Event ID 200: Source Resolver Context(Context) Resolve url flags hr.
#Event ID 201: Source Resolver Context(Context) Trying Scheme Handler clsid.
#Event ID 202: Source Resolver Context(Context) Trying Byte Scheme Handler CLSID(clsid).
#Event ID 203: Source Resolver Context(Context) SchemeHandler Result hr.
#Event ID 204: Source Resolver Context(Context) Byte stream Handler Result hr.
#Event ID 205: Source Resolver Context(Context) Resolving url returned hr.
#Event ID 206: TraceFailure logger (Context) line Line result hr function function.
#Event ID 207: ByteStreamOnInputStream_Read_Start stream (stream) ptr offset length length.
#Event ID 208: ByteStreamOnInputStream_Read_Stop stream (stream) ptr length length buffer hr hr.
#Event ID 300: MFTEnumEx flags flags, category Category for input type (inputType,inputSubtype), output type (outputType,outputSubtype).
#Event ID 301: Found matching software MFT clsid.
#Event ID 304: MFTEnumEx returned code hr, found localMFTs local MFTs, softwareMFTs software MFTs, hardwareMFTs hardware MFTs, deviceRegHardwareMFTs device reg hardware MFTs, and packagedMFTs packaged MFTs.
#Event ID 305: MFTEnum2 flags flags, category Category for input type (inputType,inputSubtype), output type (outputType,outputSubtype), LUID set: luidSet.
#Event ID 306: MFTEnum2 returned code hr, found numMFTs MFTs matching adapter with vendor ID adapterVendorId, device ID adapterDeviceId, SubSys ID adapterSubSysId, Revision adapterRevision.
#Event ID 2500: MFGetMFTMerit Enter
#Event ID 2501: MFGetMFTMerit Leave Merit(Merit) Return Code(hr).
#Event ID 2502: MFGetMFTMerit: StartInitialization returned hr.
#Event ID 2503: MFGetMFTMerit: Validate Certificate returned hr.
#Event ID 2504: MFGetMFTMerit: EndInitialization returned hr.
#Provenance
ETW provider GUID bc97b970-d001-482f-8745-b8d7d5759f99
Defined in mfplat.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB