Microsoft-Windows-NetworkProvider

14 events across 2 channels

Event	Title	Channel	Sample
1000	Ignoring UNC Hardening Configuration Entry: Unsupported registry value type.	Operational	N
1001	Ignoring UNC Hardening Configuration Entry: Unable to parse UNC Path.	Operational	N
1002	Ignoring UNC Hardening Configuration Entry: Unsupported UNC Path.	Operational	N
1003	Ignoring UNC Hardening Configuration Property: Unsupported property name.	Operational	N
1004	Ignoring UNC Hardening Configuration Property: Unsupported property name.	Operational	N
1005	Ignoring UNC Hardening Configuration Property: Unsupported property value.	Operational	N
1006	Unable to parse UNC Hardening Configuration Entry: Unknown Error.	Operational	N
1007	Unable to parse UNC Hardening Configuration Entry: Unexpected token.	Operational	N
1008	Unable to parse UNC Hardening Configuration Entry: Unable to parse integer.	Operational	N
1009	Unable to parse UNC Hardening Configuration Entry: Unable to parse string.	Operational	N
1101	An administrator has enabled remote mailslots, which are off by default.	System	N
1102	An administrator has disabled remote mailslots.	System	N
1103	An administrator has enabled remote mailslots by policy.	System	N
1104	An administrator has disabled remote mailslots by policy.	System	N

Event ID 1000: Ignoring UNC Hardening Configuration Entry: Unsupported registry value type.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: UnsupportedRegistryValueType

Description

Ignoring UNC Hardening Configuration Entry: Unsupported registry value type.

Message #

Ignoring UNC Hardening Configuration Entry: Unsupported registry value type.

Registry Value Path: %2@%4

Registry Value Type: %5

Guidance:
UNC Hardening configuration only supports registry values of types REG_SZ and REG_MULTI_SZ.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`RegistryKeyLength` UInt16
`RegistryKey` UnicodeString
`RegistryValueNameLength` UInt16
`RegistryValueName` UnicodeString
`RegistryValueType` UInt32

Event ID 1001: Ignoring UNC Hardening Configuration Entry: Unable to parse UNC Path.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: InvalidUNCPath

Description

Ignoring UNC Hardening Configuration Entry: Unable to parse UNC Path.

Message #

Ignoring UNC Hardening Configuration Entry: Unable to parse UNC Path.

UNC Path: %2

UNC Hardening Configuration: %4

Guidance:
The registry value name is not a valid UNC path.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString

Event ID 1002: Ignoring UNC Hardening Configuration Entry: Unsupported UNC Path.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: UnsupportedUNCPath

Description

Ignoring UNC Hardening Configuration Entry: Unsupported UNC Path.

Message #

Ignoring UNC Hardening Configuration Entry: Unsupported UNC Path.

UNC Path: %2

UNC Hardening Configuration: %4

Guidance:
UNC Hardening is only supported at server or share granularity. If only a fraction of the resources available on a share require additional security, consider relocating contents that require additional security to a different share.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString

Event ID 1003: Ignoring UNC Hardening Configuration Property: Unsupported property name.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: UnsupportedPropertyName

Description

Ignoring UNC Hardening Configuration Property: Unsupported property name.

Message #

Ignoring UNC Hardening Configuration Property: Unsupported property name.

UNC Path: %2

UNC Hardening Configuration: %4

Property Name: %6

Property Value: %7

Guidance:
The specified property name does not match a UNC Hardening property supported on the current version of Windows and will be ignored.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`PropertyNameLength` UInt16
`PropertyName` UnicodeString
`PropertyValue` UInt64

Event ID 1004: Ignoring UNC Hardening Configuration Property: Unsupported property name.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: UnsupportedPropertyName

Description

Ignoring UNC Hardening Configuration Property: Unsupported property name.

Message #

Ignoring UNC Hardening Configuration Property: Unsupported property name.

UNC Path: %2

UNC Hardening Configuration: %4

Property Name: %6

Property Value: '%8'

Guidance:
The specified property name does not match a UNC Hardening property supported on the current version of Windows and will be ignored.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`PropertyNameLength` UInt16
`PropertyName` UnicodeString
`PropertyValueLength` UInt16
`PropertyValue` UnicodeString

Event ID 1005: Ignoring UNC Hardening Configuration Property: Unsupported property value.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: UnsupportedPropertyValue

Description

Ignoring UNC Hardening Configuration Property: Unsupported property value.

Message #

Ignoring UNC Hardening Configuration Property: Unsupported property value.

UNC Path: %2

UNC Hardening Configuration: %4

Property Name: %6

Property Value: '%8'

Guidance:
The specified property name expects a boolean value should be assigned a value of 0 (disabled) or 1 (enabled).

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`PropertyNameLength` UInt16
`PropertyName` UnicodeString
`PropertyValueLength` UInt16
`PropertyValue` UnicodeString

Event ID 1006: Unable to parse UNC Hardening Configuration Entry: Unknown Error.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: InvalidSyntax

Description

Unable to parse UNC Hardening Configuration Entry: Unknown Error.

Message #

Unable to parse UNC Hardening Configuration Entry: Unknown Error.

UNC Path: %2

UNC Hardening Configuration: %4

Guidance:
The UNC Hardening configuration for the path contains invalid syntax and may be ignored.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString

Event ID 1007: Unable to parse UNC Hardening Configuration Entry: Unexpected token.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: InvalidSyntax

Description

Unable to parse UNC Hardening Configuration Entry: Unexpected token.

Message #

Unable to parse UNC Hardening Configuration Entry: Unexpected token.

UNC Path: %2

UNC Hardening Configuration: %4

Expected Token: %5

Found Token: %7

Guidance: The UNC Hardening configuration for the path contains invalid syntax and may be ignored.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`ExpectedToken` UInt32
`FoundTokenLength` UInt16
`FoundToken` UnicodeString

Event ID 1008: Unable to parse UNC Hardening Configuration Entry: Unable to parse integer.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: InvalidSyntax

Description

Unable to parse UNC Hardening Configuration Entry: Unable to parse integer.

Message #

Unable to parse UNC Hardening Configuration Entry: Unable to parse integer.

UNC Path: %2

UNC Hardening Configuration: %4

Expected Token: %5

Found Token: %7

Guidance: The UNC Hardening configuration for the path contains invalid syntax and may be ignored. The value found token was parsed as an integer, but was found to contain illegal digits.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`ExpectedToken` UInt32
`FoundTokenLength` UInt16
`FoundToken` UnicodeString

Event ID 1009: Unable to parse UNC Hardening Configuration Entry: Unable to parse string.

Provider: Microsoft-Windows-NetworkProvider
Channel: Operational
Task: UNCHardeningConfiguration
Opcode: InvalidSyntax

Description

Unable to parse UNC Hardening Configuration Entry: Unable to parse string.

Message #

Unable to parse UNC Hardening Configuration Entry: Unable to parse string.

UNC Path: %2

UNC Hardening Configuration: %4

Expected Token: %5

Found Token: %7

Guidance: The UNC Hardening configuration for the path contains invalid syntax and may be ignored. The value found token was parsed as an string, but was not terminated or exceeded the maximum allowable string length.

For details on configuring Windows computers to require additional security when accessing specific UNC paths, visit http://support.microsoft.com/kb/3000483.

Fields #

Name	Description
`UncPathLength` UInt16
`UncPath` UnicodeString
`UncHardeningConfigurationLength` UInt32
`UncHardeningConfiguration` UnicodeString
`ExpectedToken` UInt32
`FoundTokenLength` UInt16
`FoundToken` UnicodeString

Event ID 1101: An administrator has enabled remote mailslots, which are off by default.

Provider: Microsoft-Windows-NetworkProvider
Channel: System

Description

An administrator has enabled remote mailslots, which are off by default. Microsoft does not recommend enabling remote mailslots. To disable remote mailslots, please run the command: Set-SmbClientConfiguration -EnableMailslots $FALSE

Message #

An administrator has enabled remote mailslots, which are off by default. Microsoft does not recommend enabling remote mailslots. To disable remote mailslots, please run the command: Set-SmbClientConfiguration -EnableMailslots $FALSE

Event ID 1102: An administrator has disabled remote mailslots.

Provider: Microsoft-Windows-NetworkProvider
Channel: System

Description

An administrator has disabled remote mailslots.

Message #

An administrator has disabled remote mailslots.

Event ID 1103: An administrator has enabled remote mailslots by policy.

Provider: Microsoft-Windows-NetworkProvider
Channel: System

Description

An administrator has enabled remote mailslots by policy. Microsoft does not recommend enabling remote mailslots.

Message #

An administrator has enabled remote mailslots by policy. Microsoft does not recommend enabling remote mailslots.

Event ID 1104: An administrator has disabled remote mailslots by policy.

Provider: Microsoft-Windows-NetworkProvider
Channel: System

Description

An administrator has disabled remote mailslots by policy.

Message #

An administrator has disabled remote mailslots by policy.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 1e9a4978-78c2-441e-8858-75b5d1326bc5

Defined in mup.sys, the binary that emits these events.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-NetworkProvider

Event ID 1000: Ignoring UNC Hardening Configuration Entry: Unsupported registry value type.

Description

Message #

Fields #

Event ID 1001: Ignoring UNC Hardening Configuration Entry: Unable to parse UNC Path.

Description

Message #

Fields #

Event ID 1002: Ignoring UNC Hardening Configuration Entry: Unsupported UNC Path.

Description

Message #

Fields #

Event ID 1003: Ignoring UNC Hardening Configuration Property: Unsupported property name.

Description

Message #

Fields #

Event ID 1004: Ignoring UNC Hardening Configuration Property: Unsupported property name.

Description

Message #

Fields #

Event ID 1005: Ignoring UNC Hardening Configuration Property: Unsupported property value.

Description

Message #

Fields #

Event ID 1006: Unable to parse UNC Hardening Configuration Entry: Unknown Error.

Description

Message #

Fields #

Event ID 1007: Unable to parse UNC Hardening Configuration Entry: Unexpected token.

Description

Message #

Fields #

Event ID 1008: Unable to parse UNC Hardening Configuration Entry: Unable to parse integer.

Description

Message #

Fields #

Event ID 1009: Unable to parse UNC Hardening Configuration Entry: Unable to parse string.

Description

Message #

Fields #

Event ID 1101: An administrator has enabled remote mailslots, which are off by default.

Description

Message #

Event ID 1102: An administrator has disabled remote mailslots.

Description

Message #

Event ID 1103: An administrator has enabled remote mailslots by policy.

Description

Message #

Event ID 1104: An administrator has disabled remote mailslots by policy.

Description

Message #

Provenance

Downloads