detection.wiki

Microsoft-Windows-NdisImPlatformEventProvider

EventTitleChannelSampleRule
1Received NetPnPEvent NetPnpEvent from Member Member.OperationalNN
2Nic Adapter is transitioning into a new power state PowerState.OperationalNN
3Member Adapter is doing a status indication.OperationalNN
4Member Adapter is indicating a new link state.OperationalNN
5Oid Oid on TeamNic Adapter failed due to invalid port number.OperationalNN
6Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed.OperationalNN
7Querying for OID Oid on TeamNic Adapter failed.OperationalNN
8Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter.OperationalNN
9Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter.OperationalNN
10New Packet Filters for TeamNic TeamNic are PacketFilter.OperationalNN
11Received new per-port Packet Filters PacketFilter for TeamNic TeamNic and Member …OperationalNN
12Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter.OperationalNN
13Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on …OperationalNN
14Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on …OperationalNN
15Failed to set OID Oid on TeamNic Adapter.OperationalNN
16Recalculating Packet Filters on Member Adapter failed.OperationalNN
17Failed Sending as TeamNic Adapter is not available.OperationalNN
18Failed Sending as Member is not foundOperationalNN
19Aborted Sending on TeamNic Adapter.OperationalNN
20Member Adapter is not ready to receive.OperationalNN
21Aborting receive on TeamNic Adapter as it is not ready.OperationalNN
22No matching TeamNic found for packets received from member Adapter.OperationalNN
23Aborting sending queued NBLs on TeamNic TeamNic and Member Member.OperationalNN
24Binding to member adapter Adapter.OperationalNN
25Unbinding from member adapter Adapter.OperationalNN
26Binding to member adapter Adapter failed.OperationalNN
27Creating internal binding between TeamNic TeamNic and Member Member.OperationalNN
28Creating internal binding between TeamNic TeamNic and Member Member failed.OperationalNN
29Removed internal binding between TeamNic TeamNic and Member Member.OperationalNN
30Allocating Port failed for Member TeamNic on TeamNic Member, Status = Status.OperationalNN
31Creating team Team.OperationalNN
32Creating team Team failed, Status = Status.OperationalNN
33Removed team Team.OperationalNN
34Added Member Member to team Team.OperationalNN
35Added Member Member from team Team.OperationalNN
36Added TeamNic TeamNic to team Team.OperationalNN
37Removed TeamNic TeamNic from team Team.OperationalNN
38Creating TeamNic TeamNic for Team Team.OperationalNN
39Creating TeamNic TeamNic for Team Team failed, Status = Status.OperationalNN
40Removed TeamNic Adapter.OperationalNN
41Indicated new task offload hardware capabilities for TeamNic TeamNic.OperationalNN
42Indicated new task offload current config for TeamNic TeamNic.OperationalNN
43TeamNic Adapter indicated link state change.OperationalNN
44Support MacOptions for TeamNic TeamNic reduced from OldValue to NewValue due to …OperationalNN
45Support MtuSize for TeamNic TeamNic reduced from OldValue to NewValue due to …OperationalNN
46TeamNic Adapter being initialized.OperationalNN
47TeamNic Adapter failed to Initialize, Status = Status.OperationalNN
48TeamNic Adapter halted.OperationalNN

Event ID 1: Received NetPnPEvent NetPnpEvent from Member Member.

#
Channel
Operational

Message #

Received NetPnPEvent %1 from Member %2

Fields #

NameDescription
NetPnpEvent UInt32
Member UnicodeString

Event ID 2: Nic Adapter is transitioning into a new power state PowerState.

#
Channel
Operational

Message #

Nic %1 is transitioning into a new power state %2

Fields #

NameDescription
Adapter UnicodeString
PowerState UInt32

Event ID 3: Member Adapter is doing a status indication.

#
Channel
Operational

Description

Member Adapter is doing a status indication. StatusCode = StatusBufferLength.

Message #

Member %1 is doing a status indication. StatusCode = %2

Fields #

NameDescription
Adapter UnicodeString
StatusBufferLength UInt32
StatusBuffer Binary

Event ID 4: Member Adapter is indicating a new link state.

#
Channel
Operational

Description

Member Adapter is indicating a new link state. Link State Buffer = StatusBuffer.

Message #

Member %1 is indicating a new link state. Link State Buffer = %3

Fields #

NameDescription
Adapter UnicodeString
StatusBufferLength UInt32
StatusBuffer Binary

Event ID 5: Oid Oid on TeamNic Adapter failed due to invalid port number.

#
Channel
Operational

Description

Oid Oid on TeamNic Adapter failed due to invalid port number. Oid Buffer = OidBuffer.

Message #

Oid %1 on TeamNic %2 failed due to invalid port number. Oid Buffer = %4

Fields #

NameDescription
Oid UInt32
Adapter UnicodeString
OidBufferLen UInt32
OidBuffer Binary
Status Int32NTSTATUS reference

Event ID 6: Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed.

#
Channel
Operational

Description

Forwarding of OID Oid from TeamNic TeamNic due to Member Member failed. Status = Status.

Message #

Forwarding of OID %1 from TeamNic %2 due to Member %3 failed.  Status = %4

Fields #

NameDescription
Oid UInt32
TeamNic UnicodeString
Member UnicodeString
Status Int32NTSTATUS reference

Event ID 7: Querying for OID Oid on TeamNic Adapter failed.

#
Channel
Operational

Description

Querying for OID Oid on TeamNic Adapter failed. OidBuffer is OidBuffer failed. Status = Status.

Message #

Querying for OID %1 on TeamNic %2 failed. OidBuffer is %4 failed.  Status = %5

Fields #

NameDescription
Oid UInt32
Adapter UnicodeString
OidBufferLen UInt32
OidBuffer Binary
Status Int32NTSTATUS reference

Event ID 8: Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter.

#
Channel
Operational

Description

Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_LOOKAHEAD on Member %1. Status = %2

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 9: Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter.

#
Channel
Operational

Description

Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_LOOKAHEAD on TeamNic %1. Status = %2

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 10: New Packet Filters for TeamNic TeamNic are PacketFilter.

#
Channel
Operational

Message #

New Packet Filters for TeamNic %1 are %2

Fields #

NameDescription
TeamNic UnicodeString
PacketFilter UInt32

Event ID 11: Received new per-port Packet Filters PacketFilter for TeamNic TeamNic and Member Member.

#
Channel
Operational

Message #

Received new per-port Packet Filters %3 for TeamNic %1 and Member %2

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString
PacketFilter UInt32

Event ID 12: Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter.

#
Channel
Operational

Description

Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member Adapter. Status = Status.

Message #

Failed to set OID_GEN_CURRENT_PACKET_FILTER on Member %1.  Status = %2

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 13: Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on TeamNic TeamNic.

#
Channel
Operational

Description

Failed OID_802_3_MULTICAST_LIST on Member Member while processing the Oid on TeamNic TeamNic. Status = Status.

Message #

Failed OID_802_3_MULTICAST_LIST on Member %1 while processing the Oid on TeamNic %2. Status = %3

Fields #

NameDescription
Member UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 14: Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on TeamNic TeamNic.

#
Channel
Operational

Description

Failed OID_OFFLOAD_ENCAPSULATION on Member Member while processing the Oid on TeamNic TeamNic. Status = Status.

Message #

Failed OID_OFFLOAD_ENCAPSULATION on Member %1 while processing the Oid on TeamNic %2. Status = %3

Fields #

NameDescription
Member UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 15: Failed to set OID Oid on TeamNic Adapter.

#
Channel
Operational

Description

Failed to set OID Oid on TeamNic Adapter. Buffer is OidBuffer . Status = Status.

Message #

Failed to set OID %1 on TeamNic %2. Buffer is %4 . Status = %5

Fields #

NameDescription
Oid UInt32
Adapter UnicodeString
OidBufferLen UInt32
OidBuffer Binary
Status Int32NTSTATUS reference

Event ID 16: Recalculating Packet Filters on Member Adapter failed.

#
Channel
Operational

Description

Recalculating Packet Filters on Member Adapter failed. Status = Status.

Message #

Recalculating Packet Filters on Member %1 failed. Status = %2

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 17: Failed Sending as TeamNic Adapter is not available.

#
Channel
Operational

Message #

Failed Sending as TeamNic %1 is not available

Fields #

NameDescription
Adapter UnicodeString

Event ID 18: Failed Sending as Member is not found

#
Channel
Operational

Event ID 19: Aborted Sending on TeamNic Adapter.

#
Channel
Operational

Message #

Aborted Sending on TeamNic %1

Fields #

NameDescription
Adapter UnicodeString

Event ID 20: Member Adapter is not ready to receive.

#
Channel
Operational

Message #

Member %1 is not ready to receive.

Fields #

NameDescription
Adapter UnicodeString

Event ID 21: Aborting receive on TeamNic Adapter as it is not ready.

#
Channel
Operational

Message #

Aborting receive on TeamNic %1 as it is not ready.

Fields #

NameDescription
Adapter UnicodeString

Event ID 22: No matching TeamNic found for packets received from member Adapter.

#
Channel
Operational

Message #

No matching TeamNic found for packets received from member %1.

Fields #

NameDescription
Adapter UnicodeString

Event ID 23: Aborting sending queued NBLs on TeamNic TeamNic and Member Member.

#
Channel
Operational

Message #

Aborting sending queued NBLs on TeamNic %1 and Member %2.

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString

Event ID 24: Binding to member adapter Adapter.

#
Channel
Operational

Message #

Binding to member adapter %1.

Fields #

NameDescription
Adapter UnicodeString

Event ID 25: Unbinding from member adapter Adapter.

#
Channel
Operational

Message #

Unbinding from member adapter %1.

Fields #

NameDescription
Adapter UnicodeString

Event ID 26: Binding to member adapter Adapter failed.

#
Channel
Operational

Description

Binding to member adapter Adapter failed. Status = Status. Potential reason could be inadequate capabilities.

Message #

Binding to member adapter %1 failed. Status = %2. Potential reason could be inadequate capabilities.

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 27: Creating internal binding between TeamNic TeamNic and Member Member.

#
Channel
Operational

Message #

Creating internal binding between TeamNic %1 and Member %2.

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString

Event ID 28: Creating internal binding between TeamNic TeamNic and Member Member failed.

#
Channel
Operational

Description

Creating internal binding between TeamNic TeamNic and Member Member failed. Status = Status.

Message #

Creating internal binding between TeamNic %1 and Member %2 failed. Status = %3

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString
Status Int32NTSTATUS reference

Event ID 29: Removed internal binding between TeamNic TeamNic and Member Member.

#
Channel
Operational

Message #

Removed internal binding between TeamNic %1 and Member %2.

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString

Event ID 30: Allocating Port failed for Member TeamNic on TeamNic Member, Status = Status.

#
Channel
Operational

Message #

Allocating Port failed for Member %1 on TeamNic %2, Status = %3.

Fields #

NameDescription
TeamNic UnicodeString
Member UnicodeString
Status Int32NTSTATUS reference

Event ID 31: Creating team Team.

#
Channel
Operational

Message #

Creating team %1.

Fields #

NameDescription
Team UnicodeString
Status Int32NTSTATUS reference

Event ID 32: Creating team Team failed, Status = Status.

#
Channel
Operational

Message #

Creating team %1 failed, Status = %2.

Fields #

NameDescription
Team UnicodeString
Status Int32NTSTATUS reference

Event ID 33: Removed team Team.

#
Channel
Operational

Message #

Removed team %1.

Fields #

NameDescription
Team UnicodeString
Status Int32NTSTATUS reference

Event ID 34: Added Member Member to team Team.

#
Channel
Operational

Message #

Added Member %2 to team %1.

Fields #

NameDescription
Team UnicodeString
Member UnicodeString
Status Int32NTSTATUS reference

Event ID 35: Added Member Member from team Team.

#
Channel
Operational

Message #

Added Member %2 from team %1.

Fields #

NameDescription
Team UnicodeString
Member UnicodeString
Status Int32NTSTATUS reference

Event ID 36: Added TeamNic TeamNic to team Team.

#
Channel
Operational

Message #

Added TeamNic %2 to team %1.

Fields #

NameDescription
Team UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 37: Removed TeamNic TeamNic from team Team.

#
Channel
Operational

Message #

Removed TeamNic %2 from team %1.

Fields #

NameDescription
Team UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 38: Creating TeamNic TeamNic for Team Team.

#
Channel
Operational

Message #

Creating TeamNic %2 for Team %1.

Fields #

NameDescription
Team UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 39: Creating TeamNic TeamNic for Team Team failed, Status = Status.

#
Channel
Operational

Message #

Creating TeamNic %2 for Team %1 failed, Status = %3.

Fields #

NameDescription
Team UnicodeString
TeamNic UnicodeString
Status Int32NTSTATUS reference

Event ID 40: Removed TeamNic Adapter.

#
Channel
Operational

Message #

Removed TeamNic %1.

Fields #

NameDescription
Adapter UnicodeString

Event ID 41: Indicated new task offload hardware capabilities for TeamNic TeamNic.

#
Channel
Operational

Description

Indicated new task offload hardware capabilities for TeamNic TeamNic. StatusBuffer = Buffer.

Message #

Indicated new task offload hardware capabilities for TeamNic %1. StatusBuffer = %3.

Fields #

NameDescription
TeamNic UnicodeString
BufferLen UInt32
Buffer Binary

Event ID 42: Indicated new task offload current config for TeamNic TeamNic.

#
Channel
Operational

Description

Indicated new task offload current config for TeamNic TeamNic. StatusBuffer = Buffer.

Message #

Indicated new task offload current config for TeamNic %1. StatusBuffer = %3.

Fields #

NameDescription
TeamNic UnicodeString
BufferLen UInt32
Buffer Binary

Event ID 43: TeamNic Adapter indicated link state change.

#
Channel
Operational

Description

TeamNic Adapter indicated link state change. StatusBuffer = StatusBuffer.

Message #

TeamNic %1 indicated link state change. StatusBuffer = %3.

Fields #

NameDescription
Adapter UnicodeString
StatusBufferLength UInt32
StatusBuffer Binary

Event ID 44: Support MacOptions for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

#
Channel
Operational

Message #

Support MacOptions for TeamNic %1 reduced from %2 to %3 due to cached capabilities of a member which is currently not bound to the team

Fields #

NameDescription
TeamNic UnicodeString
OldValue UInt32
NewValue UInt32

Event ID 45: Support MtuSize for TeamNic TeamNic reduced from OldValue to NewValue due to cached capabilities of a member which is currently not bound to the team.

#
Channel
Operational

Message #

Support MtuSize for TeamNic %1 reduced from %2 to %3 due to cached capabilities of a member which is currently not bound to the team

Fields #

NameDescription
TeamNic UnicodeString
OldValue UInt32
NewValue UInt32

Event ID 46: TeamNic Adapter being initialized.

#
Channel
Operational

Message #

TeamNic %1 being initialized.

Fields #

NameDescription
Adapter UnicodeString

Event ID 47: TeamNic Adapter failed to Initialize, Status = Status.

#
Channel
Operational

Message #

TeamNic %1 failed to Initialize, Status = %2.

Fields #

NameDescription
Adapter UnicodeString
Status Int32NTSTATUS reference

Event ID 48: TeamNic Adapter halted.

#
Channel
Operational

Message #

TeamNic %1 halted.

Fields #

NameDescription
Adapter UnicodeString

Provenance

ETW provider GUID 11c5d8ad-756a-42c2-8087-eb1b4a72a846

Defined in NdisImPlatform.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB