Microsoft-Windows-NcdAutoSetup
17 events across 2 channels
Event ID 4001: Network connected device (Name: Network_connected_device_Name; Model String1) got qualified for automatic setup.
#Event ID 4002: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because it was manually removed earlier.
#Event ID 4003: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category is disqualified.
#Event ID 4004: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup due to an unexpected error (String2).
#Event ID 4005: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category property is missing.
#Event ID 4006: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device IP address property is missing.
#Event ID 4007: Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device PnP-X Id property is missing.
#Event ID 4008: Network connected device (Model String1) got disqualified for automatic setup because its device friendly name property is missing.
#Event ID 5001: Network (String1) got qualified for automatic setup of network connected devices.
#Description
Network (String1) got qualified for automatic setup of network connected devices.
Message #
Fields #
| Name | Description |
|---|---|
String1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-NcdAutoSetup",
"guid": "EC23F986-AE2D-4269-B52F-4E20765C1A94",
"event_source_name": "",
"event_id": 5001,
"version": 0,
"level": 4,
"task": 3,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-10-25T21:24:48.831864+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 7248,
"thread_id": 7332
},
"channel": "Microsoft-Windows-NcdAutoSetup/Operational",
"computer": "WinDevEval",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"String1": "Network"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5002: Network (String1) got disqualified for automatic setup of network connected devices because its network category is disqualified.
#Event ID 5003: Network (String1) got disqualified for automatic setup of network connected devices because its network size is disqualified.
#Event ID 5004: Network (String1) got disqualified for automatic setup of network connected devices because network discovery is turned off.
#Event ID 5005: Network (String1) got disqualified for automatic setup of network connected devices because Integer1 bits are used for its mask.
#Event ID 6001: taskNetworkSizeCalculation
#Event ID 6002: taskNetworkSizeCalculation6002
#Event ID 6003: taskNetworkQualificationCheck
#Event ID 6004: taskNetworkQualificationCheck6004
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID ec23f986-ae2d-4269-b52f-4e20765c1a94
Defined in NcdAutoSetup.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02