Microsoft-Windows-MsLbfoSysEvtProvider
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 16945 | MAC conflict: A port on the virtual switch has the same MAC as one of the … | Operational | N | N |
| 16946 | Use of Vlan detected on non-default Team Nic | Operational | N | N |
| 16947 | LACP Churn detected on Member Nic | Operational | N | N |
| 16948 | Connection Timer Started for Member Nic | Operational | N | N |
| 16949 | Member Nic Member Disconnected | Operational | N | N |
| 16950 | Member Nic Member Connected | Operational | N | N |
| 1073758772 | Connection Timer Started for Member Nic Member. | Operational | N | N |
| 1073758774 | Member Nic Member Connected. | Operational | N | N |
| 2147500593 | MAC conflict: A port on the virtual switch has the same MAC as one of the … | Operational | N | N |
| 2147500594 | Use of Vlan detected on non-default Team Nic Member. | Operational | N | N |
| 2147500595 | LACP Churn detected on Member Nic Member. | Operational | N | N |
| 2147500597 | Member Nic Member Disconnected. | Operational | N | N |
Event ID 16945: MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 16946: Use of Vlan detected on non-default Team Nic
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 16947: LACP Churn detected on Member Nic
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 16948: Connection Timer Started for Member Nic
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 16949: Member Nic Member Disconnected
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 16950: Member Nic Member Connected
#Fields #
| Name | Description |
|---|---|
DriverObject UnicodeString | |
Member UnicodeString |
Event ID 1073758772: Connection Timer Started for Member Nic Member.
#Event ID 1073758774: Member Nic Member Connected.
#Event ID 2147500593: MAC conflict: A port on the virtual switch has the same MAC as one of the underlying team members on Team Nic Member.
#Event ID 2147500594: Use of Vlan detected on non-default Team Nic Member.
#Event ID 2147500595: LACP Churn detected on Member Nic Member.
#Provenance
ETW provider GUID 387ed463-8b1b-42c9-9ef0-803fdfd5d94e
Defined in MsLbfoProvider.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB