detection.wiki

Microsoft-Windows-Network-Setup

EventTitleChannelSampleRule
100The Network Setup service is startingDiagnosticYN
101The Network Setup service has startedDiagnosticYN
102The Network Setup service failed to start with error Code.DiagnosticNN
110The Network Setup service will stop due to inactivityDiagnosticYN
111The Network Setup service will stop due to a user requestDiagnosticYN
112The Network Setup service is stoppingDiagnosticYN
113The Network Setup service has stoppedDiagnosticYN
200A new transaction has startedDiagnosticYN
201A transaction has been closedDiagnosticYN
202Network Setup has begun calculating new driver bindingsDiagnosticNN
203Network Setup has finished calculating new driver bindingsDiagnosticNN
204Network Setup has begun committing changes to the registryDiagnosticYN
205Network Setup has finished committing changes to the registryDiagnosticYN
300Begin API Api on transaction TransactionGuid.DiagnosticYN
301End API Api on transaction TransactionGuid.DiagnosticYN
400Begin calling into plugin PluginName.DiagnosticYN
401End calling into pluginDiagnosticYN
500Begin operation OperationType on ObjectType in transaction TransactionGuid: …DiagnosticYN
501Operation TransactionGuid ended with code Code.DiagnosticYN
600Begin API Api.DiagnosticNN
601End API with status code Code.DiagnosticNN
700Invoking API ComponentId on Notify Object for TransactionGuid.DiagnosticNN
701The Notify Object returned with status: Code.DiagnosticNN
702An error occurred while invoking the Notify Object.DiagnosticNN

Event ID 100: The Network Setup service is starting

#
Channel
Diagnostic
Level
Informational
Task
Runservice
Opcode
Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 100,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 3820
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.240Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 101: The Network Setup service has started

#
Channel
Diagnostic
Level
Informational
Task
Runservice

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 101,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 3820
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.245Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 102: The Network Setup service failed to start with error Code.

#
Channel
Diagnostic
Task
Runservice

Message #

The Network Setup service failed to start with error %1

Fields #

NameDescription
Code Int32

Event ID 110: The Network Setup service will stop due to inactivity

#
Channel
Diagnostic
Level
Informational
Task
Runservice

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 110,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5704,
      "thread_id": 5692
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:11:59.350Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 111: The Network Setup service will stop due to a user request

#
Channel
Diagnostic
Level
Informational
Task
Runservice

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5704,
      "thread_id": 11532
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:11:59.350Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 112: The Network Setup service is stopping

#
Channel
Diagnostic
Level
Informational
Task
Runservice

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 112,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5704,
      "thread_id": 11532
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:11:59.350Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 113: The Network Setup service has stopped

#
Channel
Diagnostic
Level
Informational
Task
Runservice
Opcode
Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 113,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5704,
      "thread_id": 11532
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:11:59.351Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 200: A new transaction has started

#
Channel
Diagnostic
Level
Informational
Task
Transaction
Opcode
Start

Fields #

NameDescription
TransactionGuid GUID
EnvironmentType UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 200,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.250Z",
    "version": 0
  },
  "event_data": {
    "EnvironmentType": 4,
    "TransactionGuid": "{F8D25AD4-7EF8-43AA-BC20-5552048B7DBD}"
  },
  "message": ""
}

Event ID 201: A transaction has been closed

#
Channel
Diagnostic
Level
Informational
Task
Transaction
Opcode
Stop

Fields #

NameDescription
TransactionGuid GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 201,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.272Z",
    "version": 0
  },
  "event_data": {
    "TransactionGuid": "{F8D25AD4-7EF8-43AA-BC20-5552048B7DBD}"
  },
  "message": ""
}

Event ID 202: Network Setup has begun calculating new driver bindings

#
Channel
Diagnostic
Task
Calculatebindings
Opcode
Start

Fields #

NameDescription
TransactionGuid GUID

Event ID 203: Network Setup has finished calculating new driver bindings

#
Channel
Diagnostic
Task
Calculatebindings
Opcode
Stop

Fields #

NameDescription
TransactionGuid GUID

Event ID 204: Network Setup has begun committing changes to the registry

#
Channel
Diagnostic
Level
Informational
Task
Commitchanges
Opcode
Start

Fields #

NameDescription
TransactionGuid GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 204,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.572Z",
    "version": 0
  },
  "event_data": {
    "TransactionGuid": "{564E16CE-7E84-420B-9B1B-DA77BAE5FD05}"
  },
  "message": ""
}

Event ID 205: Network Setup has finished committing changes to the registry

#
Channel
Diagnostic
Level
Informational
Task
Commitchanges
Opcode
Stop

Fields #

NameDescription
TransactionGuid GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 205,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.574Z",
    "version": 0
  },
  "event_data": {
    "TransactionGuid": "{564E16CE-7E84-420B-9B1B-DA77BAE5FD05}"
  },
  "message": ""
}

Event ID 300: Begin API Api on transaction TransactionGuid.

#
Channel
Diagnostic
Level
Informational
Task
ExternalAPI
Opcode
Start

Message #

Begin API %2 on transaction %1

Fields #

NameDescription
TransactionGuid GUID
Api UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 300,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3908,
      "thread_id": 11420
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.115Z",
    "version": 0
  },
  "event_data": {
    "Api": 1,
    "TransactionGuid": "{4EEBC5ED-0C0F-44C3-9954-76CA919E22D0}"
  },
  "message": ""
}

Event ID 301: End API Api on transaction TransactionGuid.

#
Channel
Diagnostic
Level
Informational
Task
ExternalAPI
Opcode
Stop

Message #

End API %2 on transaction %1

Fields #

NameDescription
TransactionGuid GUID
Api UInt32
Code Int32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 301,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.257Z",
    "version": 0
  },
  "event_data": {
    "Api": 1,
    "Code": 0,
    "TransactionGuid": "{F8D25AD4-7EF8-43AA-BC20-5552048B7DBD}"
  },
  "message": ""
}

Event ID 400: Begin calling into plugin PluginName.

#
Channel
Diagnostic
Level
Informational
Task
Plugincallback
Opcode
Start

Message #

Begin calling into plugin %3

Fields #

NameDescription
TransactionGuid GUID
PluginId UInt32
PluginName UnicodeString
Api UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 400,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.362Z",
    "version": 0
  },
  "event_data": {
    "Api": 301,
    "PluginId": 805306368,
    "PluginName": "NET_LUID allocator",
    "TransactionGuid": "{564E16CE-7E84-420B-9B1B-DA77BAE5FD05}"
  },
  "message": ""
}

Event ID 401: End calling into plugin

#
Channel
Diagnostic
Level
Informational
Task
Plugincallback
Opcode
Stop

Fields #

NameDescription
TransactionGuid GUID
Output UInt32
Code Int32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 401,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.365Z",
    "version": 0
  },
  "event_data": {
    "Code": 0,
    "Output": 0,
    "TransactionGuid": "{564E16CE-7E84-420B-9B1B-DA77BAE5FD05}"
  },
  "message": ""
}

Event ID 500: Begin operation OperationType on ObjectType in transaction TransactionGuid: ObjectId on PropertyBufferSize:PropertyBuffer.

#
Channel
Diagnostic
Level
Informational
Task
Operation
Opcode
Start

Message #

Begin operation %2 on %3 in transaction %1: %4 on %5:%6

Fields #

NameDescription
TransactionGuid GUID
OperationType UInt32
Known values
%%1904
New registry value created
%%1905
Existing registry value modified
%%1906
Registry value deleted
%%14674
Value Added
%%14675
Value Deleted
%%14680
Value Added With Expiration Time
%%14681
Value Deleted With Expiration Time
%%14688
Value Auto Deleted With Expiration Time
ObjectType UInt32
ObjectId GUID
PropertyBufferSize UInt16
PropertyBuffer Binary

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 500,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.252Z",
    "version": 0
  },
  "event_data": {
    "ObjectId": "{00000000-0000-0000-0000-000000000000}",
    "ObjectType": 0,
    "OperationType": 0,
    "PropertyBuffer": "",
    "PropertyBufferSize": 0,
    "TransactionGuid": "{F8D25AD4-7EF8-43AA-BC20-5552048B7DBD}"
  },
  "message": ""
}

Event ID 501: Operation TransactionGuid ended with code Code.

#
Channel
Diagnostic
Level
Informational
Task
Operation
Opcode
Stop

Message #

Operation %1 ended with code %2

Fields #

NameDescription
TransactionGuid GUID
Code Int32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Network-Setup/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 501,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1904,
      "thread_id": 10732
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Network-Setup",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:12:00.257Z",
    "version": 0
  },
  "event_data": {
    "Code": 0,
    "TransactionGuid": "{F8D25AD4-7EF8-43AA-BC20-5552048B7DBD}"
  },
  "message": ""
}

Event ID 600: Begin API Api.

#
Channel
Diagnostic
Task
INetCfgAPI
Opcode
Start

Message #

Begin API %1

Fields #

NameDescription
Api UInt32

Event ID 601: End API with status code Code.

#
Channel
Diagnostic
Task
INetCfgAPI
Opcode
Stop

Message #

End API with status code %1

Fields #

NameDescription
Code Int32

Event ID 700: Invoking API ComponentId on Notify Object for TransactionGuid.

#
Channel
Diagnostic
Task
INetCfgNotifyObject
Opcode
Start

Message #

Invoking API %2 on Notify Object for %1

Fields #

NameDescription
TransactionGuid GUID
ComponentId UnicodeString
Api UInt32
Parameter1 UInt32
Parameter2 UnicodeString

Event ID 701: The Notify Object returned with status: Code.

#
Channel
Diagnostic
Task
INetCfgNotifyObject
Opcode
Stop

Message #

The Notify Object returned with status: %1

Fields #

NameDescription
Code Int32

Event ID 702: An error occurred while invoking the Notify Object.

#
Channel
Diagnostic
Task
INetCfgNotifyObject
Opcode
Stop

Description

An error occurred while invoking the Notify Object. The call was aborted with status: Code.

Message #

An error occurred while invoking the Notify Object.  The call was aborted with status: %1.

Fields #

NameDescription
Code Int32

Provenance

ETW provider GUID a111f1c2-5923-47c0-9a68-d0bafb577901

Defined in NetSetupSvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4767, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB