Microsoft-Windows-NCSI

Event	Title	Channel	Sample	Rule
2001	Corporate connectivity check will be skipped.	Analytic	N	N
2002	Corporate connectivity check is enabled	Analytic	N	N
2003	Corporate inside/outside location check will be skipped.	Analytic	N	N
2004	Corporate inside/outside location check is enabled	Analytic	N	N
4001	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N	N
4002	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N	N
4003	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N	N
4004	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N	N
4005	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N	N
4006	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N	N
4007	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic	N	N
4008	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic	N	N
4009	Inside/Outside detection started for interface IfLuid.	Operational	N	N
4010	Inside/Outside detection finished for interface IfLuid (CorporateLocation).	Operational	N	N
4011	Windows Firewall Group Policy settings have been updated.	Operational	N	N
4012	Inside/Outside probe failed for interface Host.	Operational	N	N
4013	Active Internet Probe started on interface InterfaceGuid.	Analytic	N	N
4014	Active Internet Probe finished on interface InterfaceGuid (Succeeded).	Analytic	N	N
4015	Active Internet Probe (DNS) started on interface InterfaceGuid.	Analytic	N	N
4016	Active Internet Probe (DNS) finished on interface InterfaceGuid.	Analytic	N	N
4017	Active Internet Probe (HTTP) started on interface InterfaceGuid.	Analytic	N	N
4018	Active Internet Probe (HTTP) finished on interface InterfaceGuid.	Analytic	N	N
4019	Active Corp Probe started on interface InterfaceGuid.	Analytic	N	N
4020	Active Corp Probe finished on interface InterfaceGuid (Succeeded).	Analytic	N	N
4021	Active Corp Probe (DNS) started on interface InterfaceGuid.	Analytic	N	N
4022	Active Corp Probe (DNS) finished on interface InterfaceGuid.	Analytic	N	N
4023	Active Corp Probe (HTTP) started on interface InterfaceGuid.	Analytic	N	N
4024	Active Corp Probe (HTTP) finished on interface InterfaceGuid.	Analytic	N	N
4025	Proxy Detection started	Analytic	N	N
4026	Proxy Detection stopped (HasProxy=ErrorCode).	Analytic	N	N
4027	Opportunistic Internet flag on interface InterfaceGuid for family Family marked.	Analytic	N	N
4028	Inside/Outside detection is suspect	Operational	N	N
4029	Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: …	Analytic	N	N
4030	Suspect state cancelled on interface IfLuid (Family: Family).	Analytic	N	N
4031	Suspect state expired on interface IfLuid (Family: Family).	Analytic	N	N
4032	Entered corporate suspect state on interface IfLuid.	Analytic	N	N
4033	Corporate suspect state cancelled on interface IfLuid.	Analytic	N	N
4034	Corporate suspect state expired on interface IfLuid.	Analytic	N	N
4035	Cancelling hotspot detection scenario for interface InterfaceGuid.	Analytic	N	N
4036	Check Corporate Inside/outside Location	Analytic	N	N
4037	Starting hotspot detection for family Family on interface IfLuid.	Analytic	N	N
4038	Hotspot detected on interface IfLuid (Family: Family).	Operational	N	N
4039	Hotspot not detected on interface IfLuid (Family: Family).	Analytic	N	N
4040	Interface ConnectedInterfaceGuid (IfLuid) has been connected.	Analytic	N	N
4041	Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.	Analytic	N	N
4042	Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability …	Operational	Y	N
4043	Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid …	Analytic	N	N
4044	Passive Poll state change.	Analytic	N	N
4045	NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).	Analytic	N	N
4046	Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: …	Analytic	N	N
4047	Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless …	Analytic	N	N
4048	Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: …	Analytic	N	N
4049	Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: …	Analytic	N	N
4050	Preferred global address change on HasPreferredGlobalAddress …	Analytic	N	N
4051	Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = …	Analytic	N	N
4052	Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: …	Analytic	N	N
4053	task_04053	Analytic	N	N
4054	task_04054	Analytic	N	N

Event ID 2001: Corporate connectivity check will be skipped.

Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Corporate connectivity check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate connectivity check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8

Event ID 2002: Corporate connectivity check is enabled

Channel: Analytic
Task: WaitforCorporateConnectivity

Event ID 2003: Corporate inside/outside location check will be skipped.

Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Description

Corporate inside/outside location check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate inside/outside location check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8

Event ID 2004: Corporate inside/outside location check is enabled

Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Event ID 4001: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Channel: Analytic
Task: WaitforNetReady

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4002: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Channel: Analytic
Task: WaitforNetReady

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4003: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Channel: Analytic
Task: WaitforLocalConnectivity

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4004: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Channel: Analytic
Task: WaitforLocalConnectivity

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4005: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Channel: Analytic
Task: WaitforInternetConnectivity

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4006: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Channel: Analytic
Task: WaitforInternetConnectivity

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4007: Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Channel: Analytic
Task: WaitforCorporateConnectivity

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4008: Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Channel: Analytic
Task: WaitforCorporateConnectivity

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4009: Inside/Outside detection started for interface IfLuid.

Channel: Operational
Task: CheckCorporateInside/outsideLocation

Message #

Inside/Outside detection started for interface %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64

Event ID 4010: Inside/Outside detection finished for interface IfLuid (CorporateLocation).

Channel: Operational
Task: CheckCorporateInside/outsideLocation

Message #

Inside/Outside detection finished for interface %3 (%4).

Fields #

Name	Description
`InterfaceGuid` GUID
`CurrentOrNextState` UInt8
`IfLuid` UInt64
`CorporateLocation` UInt8
`CorporateLocationMetadata` UInt32

Event ID 4011: Windows Firewall Group Policy settings have been updated.

Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection.

Message #

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection

Event ID 4012: Inside/Outside probe failed for interface Host.

Channel: Operational
Task: CheckCorporateInside/outsideLocation

Message #

Inside/Outside probe failed for interface %1.

Error: %6 (%5)
Host: %3/%4
Next retry: %7 second(s).

Fields #

Name	Description
`IfLuid` UInt64
`InterfaceGuid` GUID
`ProbeHost` UnicodeString
`ProbePath` UnicodeString
`ErrorCode` UInt32
`ErrorString` UnicodeString
`RetryInterval` UInt32

Event ID 4013: Active Internet Probe started on interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Message #

Active Internet Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`ForceWeb` Boolean
`UseProxyCache` Boolean

Event ID 4014: Active Internet Probe finished on interface InterfaceGuid (Succeeded).

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Message #

Active Internet Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID
`Succeeded` Boolean
`UsedDnsProbe` Boolean
`UsedProxy` Boolean
`ContentComparison` Boolean
`WebCompleted` Boolean
`WebRedirected` Boolean
`LocalErrorOccured` Boolean

Event ID 4015: Active Internet Probe (DNS) started on interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Message #

Active Internet Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4016: Active Internet Probe (DNS) finished on interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Message #

Active Internet Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4017: Active Internet Probe (HTTP) started on interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Message #

Active Internet Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4018: Active Internet Probe (HTTP) finished on interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Message #

Active Internet Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4019: Active Corp Probe started on interface InterfaceGuid.

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Message #

Active Corp Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4020: Active Corp Probe finished on interface InterfaceGuid (Succeeded).

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Message #

Active Corp Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID
`Succeeded` Boolean

Event ID 4021: Active Corp Probe (DNS) started on interface InterfaceGuid.

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Message #

Active Corp Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4022: Active Corp Probe (DNS) finished on interface InterfaceGuid.

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Message #

Active Corp Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4023: Active Corp Probe (HTTP) started on interface InterfaceGuid.

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Message #

Active Corp Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4024: Active Corp Probe (HTTP) finished on interface InterfaceGuid.

Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Message #

Active Corp Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4025: Proxy Detection started

Channel: Analytic
Task: ProxyDetection
Opcode: Start

Event ID 4026: Proxy Detection stopped (HasProxy=ErrorCode).

Channel: Analytic
Task: ProxyDetection
Opcode: Stop

Message #

Proxy Detection stopped (HasProxy=%1)

Fields #

Name	Description
`ErrorCode` UInt32
`Source` UInt8

Event ID 4027: Opportunistic Internet flag on interface InterfaceGuid for family Family marked.

Channel: Analytic
Task: InternetConnectivityDetection

Message #

Opportunistic Internet flag on interface %1 for family %2 marked

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4028: Inside/Outside detection is suspect

Channel: Operational
Task: Inside/Outside detection verification

Event ID 4029: Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: Family).

Channel: Analytic
Task: Suspectstate

Message #

Entered suspect state on interface %2 (Family: %3 Reason: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`SuspectStateReason` UInt8

Event ID 4030: Suspect state cancelled on interface IfLuid (Family: Family).

Channel: Analytic
Task: Suspectstate

Message #

Suspect state cancelled on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32

Event ID 4031: Suspect state expired on interface IfLuid (Family: Family).

Channel: Analytic
Task: Suspectstate

Message #

Suspect state expired on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32

Event ID 4032: Entered corporate suspect state on interface IfLuid.

Channel: Analytic
Task: CorporateSuspectstate

Message #

Entered corporate suspect state on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4033: Corporate suspect state cancelled on interface IfLuid.

Channel: Analytic
Task: CorporateSuspectstate

Message #

Corporate suspect state cancelled on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4034: Corporate suspect state expired on interface IfLuid.

Channel: Analytic
Task: CorporateSuspectstate

Message #

Corporate suspect state expired on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4035: Cancelling hotspot detection scenario for interface InterfaceGuid.

Channel: Analytic
Task: InternetConnectivityDetection

Message #

Cancelling hotspot detection scenario for interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4036: Check Corporate Inside/outside Location

Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 4037: Starting hotspot detection for family Family on interface IfLuid.

Channel: Analytic
Task: InternetConnectivityDetection

Message #

Starting hotspot detection for family %2 on interface %1

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4038: Hotspot detected on interface IfLuid (Family: Family).

Channel: Operational
Task: InternetConnectivityDetection

Message #

Hotspot detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4039: Hotspot not detected on interface IfLuid (Family: Family).

Channel: Analytic
Task: InternetConnectivityDetection

Message #

Hotspot not detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64
`Family` UInt32

Event ID 4040: Interface ConnectedInterfaceGuid (IfLuid) has been connected.

Channel: Analytic

Message #

Interface %1 (%2) has been connected

Fields #

Name	Description
`ConnectedInterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4041: Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.

Channel: Analytic

Message #

Interface %1 (%2) has been disconnected

Fields #

Name	Description
`DisconnectedInterfaceGuid` GUID
`IfLuid` UInt64

Event ID 4042: Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability ChangeReason: CapabilityChangeReason).

Channel: Operational
Level: Informational

Message #

Capability change on %1 (%2 Family: %3 Capability: %4 ChangeReason: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32	2 Family.
`Capability` UInt32
`CapabilityChangeReason` UInt32	ChangeReason.
`PreviousCapability` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-NCSI",
    "guid": "{314DE49F-CE63-4779-BA2B-D616F6963A88}",
    "event_source_name": "",
    "event_id": 4042,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387936,
    "time_created": "2026-05-29T16:33:35.2696049+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 1828,
      "thread_id": 2016
    },
    "channel": "Microsoft-Windows-NCSI/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "InterfaceGuid": "{2a7bd48e-ddc6-4641-9f41-682f29f1d76c}",
    "IfLuid": "1689399632855040",
    "Family": "0",
    "Capability": "2",
    "CapabilityChangeReason": "8",
    "PreviousCapability": "1"
  },
  "message": "Capability change on {2a7bd48e-ddc6-4641-9f41-682f29f1d76c} (0x6008001000000 Family: V4 Capability: Internet ChangeReason: ActiveDnsProbeSucceeded)"
}

Event ID 4043: Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid ProxiedCapability: Family).

Channel: Analytic

Message #

Proxied capability change on %1 (%2 Family: %3 ProxiedCapability: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`ProxiedCapability` UInt32

Event ID 4044: Passive Poll state change.

Channel: Analytic

Description

Passive Poll state change (ShouldPassivePollRun: ShouldPassivePollRun WasPassivePollRunning: WasPassivePollRunning IsPassivePollAllowed: IsPassivePollAllowed ClientPresent: ClientPresent UserPresent: UserPresent NetworkQuietMode: NetworkQuietMode DeadUserPollCount: DeadUserPollCount DeadNetPollCountV4: DeadNetPollCountV4 DeadNetPollCountV6: DeadNetPollCountV6)

Message #

Passive Poll state change (ShouldPassivePollRun: %1 WasPassivePollRunning: %2 IsPassivePollAllowed: %3 ClientPresent: %4 UserPresent: %5 NetworkQuietMode: %6 DeadUserPollCount: %7 DeadNetPollCountV4: %8 DeadNetPollCountV6: %9)

Fields #

Name	Description
`ShouldPassivePollRun` Boolean
`WasPassivePollRunning` Boolean
`IsPassivePollAllowed` Boolean
`ClientPresent` Boolean
`UserPresent` Boolean
`NetworkQuietMode` Boolean
`DeadUserPollCount` UInt32
`DeadNetPollCountV4` UInt32
`DeadNetPollCountV6` UInt32

Event ID 4045: NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).

Channel: Analytic

Message #

NetReady update on %1 (%2 Family: %3 NetReady: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`NetReady` Boolean

Event ID 4046: Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: IfLuid HasCorporateConnectivity: Family).

Channel: Analytic

Message #

Corporate connectivity change on %1 (%2 Family: %3 HasCorporateConnectivity: %4)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasCorporateConnectivity` Boolean

Event ID 4047: Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: I...

Channel: Analytic

Description

Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: IpAddressLength).

Message #

Default gateway is set on %1 (%2 Family: %3 GatewayIP: %5 GatewayMAC: %7 KnownHotspot: %8 KnownOppInternet: %9 KnownProxiedOppInternet: %10)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`IpAddressLength` UInt32
`IpAddress` Binary
`MacAddressLength` UInt32
`MacAddress` Binary
`KnownHotspot` Boolean	GatewayIP.
`KnownOppInternet` Boolean
`KnownProxiedOppInternet` Boolean	GatewayMAC.

Event ID 4048: Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: InterfaceGuid HasNextHopToInternet: IfLuid NextHopAddress: NextHopAddressLength).

Channel: Analytic

Message #

Next hop to Internet has changed on %1 (%2 Family: %3 HasNextHopToInternet: %4 NextHopAddress: %6)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasNextHopToInternet` Boolean
`NextHopAddressLength` UInt32
`NextHopAddress` Binary	2 Family.

Event ID 4049: Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredAddress: IfLuid AddressSuffixOrigins: Family).

Channel: Analytic

Message #

Preferred address change on %1 (%2 Family: %3 HasPreferredAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasPreferredAddress` Boolean
`AddressSuffixOrigins` UInt32	2 Family.

Event ID 4050: Preferred global address change on HasPreferredGlobalAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredGlobalAddress: IfLuid AddressSuffixOrigins: Family).

Channel: Analytic

Message #

Preferred global address change on %1 (%2 Family: %3 HasPreferredGlobalAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`HasPreferredGlobalAddress` Boolean
`AddressSuffixOrigins` UInt32	2 Family.

Event ID 4051: Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = ActiveProbeResultCode.

Channel: Analytic

Message #

Active probe result code on interface %1 (%2 Family: %3) = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`Family` UInt32
`ActiveProbeResultCode` UInt32

Event ID 4052: Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used...

Channel: Analytic

Description

Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used: IfLuid, IPv6 test used: HasPreferredGlobalAddressIPv4.

Message #

Interface diagnostic for %1 (%2): IPv4 address: %3, IPv6 address: %4, IPv4 capability: %5, IPv6 capability: %6, IPv4 test used: %7, IPv6 test used: %8

Fields #

Name	Description
`InterfaceGuid` GUID
`IfLuid` UInt64
`HasPreferredGlobalAddressIPv4` Boolean
`HasPreferredGlobalAddressIPv6` Boolean
`InternetCapabilityIPv4` UInt8
`InternetCapabilityIPv6` UInt8
`InternetTestIPv4` UInt8
`InternetTestIPv6` UInt8

Event ID 4053: task_04053

Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Event ID 4054: task_04054

Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID
`Family` UInt32

Provenance

ETW provider GUID 314de49f-ce63-4779-ba2b-d616f6963a88

Defined in ncsi.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB