Microsoft-Windows-MsLbfoEventProvider

32 events across 1 channel

Event	Title	Channel	Sample
1	Replacing Member OldMember with new Member NewMember for load balancing.	Operational	N
2	Excluding Member Member from load balancing.	Operational	N
3	Using Member Member for load balancing.	Operational	N
4	Starting ConnectTimer for Member Member.	Operational	N
5	Stopping to use Member Member for load balancing.	Operational	N
6	Priming Switch for TeamNic TeamNic using Member Member.	Operational	N
7	Failing NBL send on Member Member.	Operational	N
8	Failing NBL send on TeamNic TeamNic.	Operational	N
9	Dropping NBLs on Member Member.	Operational	N
10	DriverEntry exiting, Status = Status.	Operational	N
11	Member Member created.	Operational	N
12	Aggregator Aggregator created.	Operational	N
13	Member Member placed in Team TeamNic, Status = Status.	Operational	N
14	Indicating new link state for TeamNic TeamNic.	Operational	N
15	Default Aggregator for TeamNic TeamNic changed to Receiver.	Operational	N
16	BroadcastReceiver for TeamNic TeamNic changed to Receiver.	Operational	N
17	Initializing TeamNic TeamNic, Status = Status.	Operational	N
18	Removing Aggregator Aggregator from TeamNic TeamNic.	Operational	N
19	Removed Member Member from TeamNic TeamNic.	Operational	N
20	Removing TeamNic TeamNic.	Operational	N
21	MsLbfoProvider driver is unloading.	Operational	N
22	Changing Aggregator for Member Member from OldAggregator to NewAggregator.	Operational	N
23	LACP Initializing for Member Member, Status = Status.	Operational	N
24	LACP de-initialized for Member Member.	Operational	N
25	Received LACPDU on Member Member.	Operational	N
26	LBFO LACP Member Member; ReceiveMachine: OldState->NewState.	Operational	N
27	LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.	Operational	N
28	LBFO LACP Member Member; Mux Machine: OldState->NewState.	Operational	N
29	Sending LACPDU on Member Member.	Operational	N
30	LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.	Operational	N
31	LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: …	Operational	N
32	LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.	Operational	N

Event ID 1: Replacing Member OldMember with new Member NewMember for load balancing.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Replacing Member OldMember with new Member NewMember for load balancing.

Message #

Replacing Member %1 with new Member %2 for load balancing

Fields #

Name	Description
`OldMember` GUID
`NewMember` GUID

Event ID 2: Excluding Member Member from load balancing.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Excluding Member Member from load balancing.

Message #

Excluding Member %1 from load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 3: Using Member Member for load balancing.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Using Member Member for load balancing.

Message #

Using Member %1 for load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 4: Starting ConnectTimer for Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Starting ConnectTimer for Member Member.

Message #

Starting ConnectTimer for Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 5: Stopping to use Member Member for load balancing.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Stopping to use Member Member for load balancing.

Message #

Stopping to use Member %1 for load balancing

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 6: Priming Switch for TeamNic TeamNic using Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Priming Switch for TeamNic TeamNic using Member Member.

Message #

Priming Switch for TeamNic %1 using Member %2

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID

Event ID 7: Failing NBL send on Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Failing NBL send on Member Member.

Message #

Failing NBL send on Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 8: Failing NBL send on TeamNic TeamNic.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Failing NBL send on TeamNic TeamNic.

Message #

Failing NBL send on TeamNic %1

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 9: Dropping NBLs on Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Dropping NBLs on Member Member.

Message #

Dropping NBLs on Member %1

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 10: DriverEntry exiting, Status = Status.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

DriverEntry exiting, Status = Status.

Message #

DriverEntry exiting, Status = %1

Fields #

Name	Description
`Status` Int32	NTSTATUS reference

Event ID 11: Member Member created.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Member Member created.

Message #

Member %1 created.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 12: Aggregator Aggregator created.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Aggregator Aggregator created.

Message #

Aggregator %1 created.

Fields #

Name	Description
`Aggregator` Pointer

Event ID 13: Member Member placed in Team TeamNic, Status = Status.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Member Member placed in Team TeamNic, Status = Status.

Message #

Member %2 placed in Team %1, Status = %3.

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 14: Indicating new link state for TeamNic TeamNic.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Indicating new link state for TeamNic TeamNic. StatusBuffer = StatusBuffer.

Message #

Indicating new link state for TeamNic %1. StatusBuffer = %3.

Fields #

Name	Description
`TeamNic` Pointer
`StatusBufferLen` UInt32
`StatusBuffer` Binary

Event ID 15: Default Aggregator for TeamNic TeamNic changed to Receiver.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Default Aggregator for TeamNic TeamNic changed to Receiver.

Message #

Default Aggregator for TeamNic %1 changed to %2.

Fields #

Name	Description
`TeamNic` Pointer
`Receiver` Pointer

Event ID 16: BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

BroadcastReceiver for TeamNic TeamNic changed to Receiver.

Message #

BroadcastReceiver for TeamNic %1 changed to %2.

Fields #

Name	Description
`TeamNic` Pointer
`Receiver` Pointer

Event ID 17: Initializing TeamNic TeamNic, Status = Status.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Initializing TeamNic TeamNic, Status = Status.

Message #

Initializing TeamNic %1, Status = %2.

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 18: Removing Aggregator Aggregator from TeamNic TeamNic.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Removing Aggregator Aggregator from TeamNic TeamNic.

Message #

Removing Aggregator %2 from TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Aggregator` Pointer

Event ID 19: Removed Member Member from TeamNic TeamNic.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Removed Member Member from TeamNic TeamNic.

Message #

Removed Member %2 from TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 20: Removing TeamNic TeamNic.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Removing TeamNic TeamNic.

Message #

Removing TeamNic %1.

Fields #

Name	Description
`TeamNic` Pointer
`Status` Int32	NTSTATUS reference

Event ID 21: MsLbfoProvider driver is unloading.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

MsLbfoProvider driver is unloading.

Message #

MsLbfoProvider driver is unloading.

Event ID 22: Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Changing Aggregator for Member Member from OldAggregator to NewAggregator.

Message #

Changing Aggregator for Member %1 from %2 to %3.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer

Event ID 23: LACP Initializing for Member Member, Status = Status.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LACP Initializing for Member Member, Status = Status.

Message #

LACP Initializing for Member %1, Status = %2.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 24: LACP de-initialized for Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LACP de-initialized for Member Member.

Message #

LACP de-initialized for Member %1.

Fields #

Name	Description
`Member` GUID
`Status` Int32	NTSTATUS reference

Event ID 25: Received LACPDU on Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Received LACPDU on Member Member. Buffer= Buffer.

Message #

Received LACPDU on Member %1. Buffer= %3.

Fields #

Name	Description
`Member` GUID
`BufferLen` UInt32
`Buffer` Binary

Event ID 26: LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; ReceiveMachine: OldState->NewState.

Message #

LBFO LACP Member %1; ReceiveMachine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 27: LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; Periodic Transmission Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Periodic Transmission Machine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 28: LBFO LACP Member Member; Mux Machine: OldState->NewState.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; Mux Machine: OldState->NewState.

Message #

LBFO LACP Member %1; Mux Machine: %2->%3.

Fields #

Name	Description
`Member` GUID
`OldState` HexInt32
`NewState` HexInt32

Event ID 29: Sending LACPDU on Member Member.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

Sending LACPDU on Member Member. Buffer= Buffer.

Message #

Sending LACPDU on Member %1. Buffer= %3.

Fields #

Name	Description
`Member` GUID
`BufferLen` UInt32
`Buffer` Binary

Event ID 30: LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; Selected NewAgg: NewAggregator, Ready:Ready.

Message #

LBFO LACP Member %1; Selected NewAgg: %3, Ready:%4.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer
`Ready` Boolean

Event ID 31: LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; UnSelected, OldAgg: OldAggregator NewAgg: NewAggregator.

Message #

LBFO LACP Member %1; UnSelected, OldAgg: %2 NewAgg: %3.

Fields #

Name	Description
`Member` GUID
`OldAggregator` Pointer
`NewAggregator` Pointer
`Ready` Boolean

Event ID 32: LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Provider: Microsoft-Windows-MsLbfoEventProvider
Channel: Operational

Description

LBFO LACP Member Member; Churn Type (ChurnType): OldState->NewState.

Message #

LBFO LACP Member %1; Churn Type (%2): %3->%4.

Fields #

Name	Description
`Member` GUID
`ChurnType` Int32
`OldState` Int32
`NewState` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b72c6994-9fe0-45ad-83b3-8f5885f20e0e

Defined in MsLbfoProvider.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-MsLbfoEventProvider registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)