Microsoft-Windows Networking VPN Plugin Platform
32 events across 2 channels
Event ID 2001: Vpn Connection Error = Error, Profile name = Profile, Plugin SID = Plugin.
#Event ID 2002: Vpn Plugin Background Task Execution Started
#Event ID 2003: Vpn Plugin Background Task Execution Exit
#Event ID 2004: Message from VPN App: [Profile] Message.
#Event ID 2005: Autotrigger [profileName], device is inside the trusted network boundary [NetworkName].
#Event ID 2006: Autotrigger [string], device is outside the trusted network boundary.
#Event ID 2007: Autotrigger: [string], device is attempting to connect to VPN.
#Event ID 2008: Autotrigger: [string], device failed to connect to VPN.
#Event ID 2009: Autotrigger: [string], device is connected to VPN.
#Event ID 2010: Autotrigger: [string], device got disconnected from VPN, Redial it.
#Event ID 2011: Autotrigger: [string], profile got activated.
#Event ID 2012: Autotrigger: [string], profile got deactivated.
#Event ID 2013: Autotrigger: [string], profile got auto disconnected.
#Event ID 2014: Autotrigger: [string], profile got disconnected as device going to sleep state.
#Event ID 2015: Autotrigger: [string], device is resumed, Redialling it.
#Event ID 2016: Autotrigger: [string], profile added.
#Event ID 2017: Autotrigger: [string], profile deleted.
#Event ID 2018: Autotrigger: [string], profile modified.
#Event ID 2019: Vpn State Machine Status : Invalid, Profile name = profile, Plugin SID = plugin.
#Event ID 2020: Vpn State Machine Status : Connecting, Profile name = profile, Plugin SID = plugin.
#Event ID 2021: Vpn State Machine Status : Connected, Profile name = profile, Plugin SID = plugin.
#Event ID 2022: Vpn State Machine Status : Disconnecting, Profile name = profile, Plugin SID = plugin.
#Event ID 2023: Vpn State Machine Status : Disconnected, Profile name = profile, Plugin SID = plugin.
#Event ID 2024: Vpn State Machine Status : Abort, Profile name = profile, Plugin SID = plugin.
#Event ID 2025: Vpn State Machine Status : Negotiating Network, Profile name = profile, Plugin SID = plugin.
#Event ID 2026: Vpn State Machine Status : Requesting Credentials, Profile name = profile, Plugin SID = plugin.
#Event ID 2027: Vpn State Machine Status : Requesting Credentials using Custom UI, Profile name = profile, Plugin SID = plugin.
#Event ID 2028: Keep Alive event invoked, Profile name = string.
#Event ID 2029: Autotrigger: DNS query string is made, matching VPN trigger rules.
#Event ID 2030: Autotrigger: [string] Unable to determine internet connectivity, vpn trigger failed.
#Event ID 2031: Autotrigger: auto trigger module initialization completed with Error = Error.
#Description
Autotrigger: auto trigger module initialization completed with Error = Error.
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows Networking VPN Plugin Platform",
"guid": "E5FC4A0F-7198-492F-9B0F-88FDCBFDED48",
"event_source_name": "",
"event_id": 2031,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223374235878031360,
"time_created": "2026-03-13T21:48:17.001311+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 5124,
"thread_id": 5756
},
"channel": "Windows Networking Vpn Plugin Platform/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Error": 13
},
"message": ""
}
Event ID 2032: Autotrigger: auto trigger Config registry content completed with Error = Error.
#Description
Autotrigger: auto trigger Config registry content completed with Error = Error.
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows Networking VPN Plugin Platform",
"guid": "E5FC4A0F-7198-492F-9B0F-88FDCBFDED48",
"event_source_name": "",
"event_id": 2032,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223374235878031360,
"time_created": "2026-03-13T21:48:16.999208+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 5124,
"thread_id": 5756
},
"channel": "Windows Networking Vpn Plugin Platform/Operational",
"computer": "LAB-DC01.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Error": 2
},
"message": ""
}
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID e5fc4a0f-7198-492f-9b0f-88fdcbfded48
Defined in windows.networking.vpn.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02