Microsoft-Windows-NetworkProvisioning

34 events across 2 channels

Event	Title	Channel	Sample
1000	Creating provisioning document (SizeOfXMLInBytes bytes).	Analytic	N
1001	Finished creating provisioning document (Result=ErrorCode).	Analytic	N
1002	XML parsing completed (Result=Result).	Analytic	N
1003	XML schema validation completed (Result=Result).	Analytic	N
1004	XML signature verification completed (Result=Carrier_Id).	Analytic	N
1005	XML stream rejected because the size exceeded the limit (StreamSize > …	Operational	N
1006	XML stream rejected because of a parse error.	Operational	N
1007	XML stream rejected because schema validation failed.	Operational	N
1008	XML stream rejected because signature verification failed (Result).	Operational	N
2000	Provisioning document started	Analytic	N
2001	Finished provisioning document (Result=ErrorCode ErrorOccured=ErrorOccurred).	Analytic	N
2002	Certificate verification completed (bool=BoolResult).	Analytic	N
4001	Trigger to refresh task completed (Result=Result).	Analytic	N
5000	Activation method Carrier_Id has been started.	Operational	N
5001	Activation method ICarrier_Id has finished.	Operational	N
5002	The radio is already off on interface InterfaceGuid; assuming the user has …	Operational	N
5003	Unable to turn the radio RadioState on interface InterfaceGuid …	Operational	N
5004	Interface InterfaceGuid is not registered to the home network; aborting …	Operational	N
5005	Cannot locate the ProfileType profile on interface InterfaceGuid …	Operational	N
5006	Connection to profile ProfileName failed on interface InterfaceGuid …	Operational	N
5007	Unable to disconnect interface InterfaceGuid from network (error=ErrorCode).	Operational	N
6000	Purge task has been started	Operational	N
6001	Purge task has finished Result.	Operational	N
6002	Calling Purge [Details] Carrier Id: Carrier_Id Subscriber Id: Subscriber_Id …	Operational	N
9000	Handler HandlerName: provision (start).	Analytic	N
9001	Handler HandlerName: provision (stop) [result: ErrorCode].	Analytic	N
9100	Handler HandlerName: purge (start).	Analytic	N
9101	Handler HandlerName: purge (stop).	Analytic	N
10000	Failed to connect to the ServiceName: ErrorCode.	Operational	N
10001	Failed to set WLAN profile ProfileName on interface InterfaceGuid with error …	Operational	N
10002	Failed to set WWAN profile ProfileName on interface InterfaceGuid with error …	Operational	N
10003	Failed to apply metadata to profile ProfileName on interface InterfaceGuid with …	Operational	N
11000	The message rule at position Xml failed validation.	Operational	N
20000	Provisioning results for caller application (AppId CallerAppId): [ErrorCode].	Operational	N

Event ID 1000: Creating provisioning document (SizeOfXMLInBytes bytes).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: CreateDocument
Opcode: Start

Description

Creating provisioning document (SizeOfXMLInBytes bytes).

Message #

Creating provisioning document (%1 bytes)

Fields #

Name	Description
`SizeOfXMLInBytes` UInt64

Event ID 1001: Finished creating provisioning document (Result=ErrorCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: CreateDocument
Opcode: Stop

Description

Finished creating provisioning document (Result=ErrorCode).

Message #

Finished creating provisioning document (Result=%1)

Fields #

Name	Description
`ErrorCode` Int32

Event ID 1002: XML parsing completed (Result=Result).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: CreateDocument

Description

XML parsing completed (Result=Result).

Message #

XML parsing completed (Result=%1)

Fields #

Name	Description
`Result` Int32

Event ID 1003: XML schema validation completed (Result=Result).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: CreateDocument

Description

XML schema validation completed (Result=Result).

Message #

XML schema validation completed (Result=%1)

Fields #

Name	Description
`Result` Int32

Event ID 1004: XML signature verification completed (Result=Carrier_Id).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: CreateDocument

Description

XML signature verification completed (Result=Carrier_Id).

Message #

XML signature verification completed (Result=%1)



[Details]

Carrier Id: %2

Subscriber Id: %3

DeviceId: %4

Signer: %5

CertificateIssuer: %6

CertificateSubject: %7

Fields #

Name	Description
`ErrorCode` Int32
`CarrierId` UnicodeString
`SubscriberId` UnicodeString
`DeviceId` UnicodeString
`Signer` UnicodeString
`CertificateIssuer` UnicodeString
`CertificateSubject` UnicodeString

Event ID 1005: XML stream rejected because the size exceeded the limit (StreamSize > StreamSizeLimit).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: CreateDocument

Description

XML stream rejected because the size exceeded the limit (StreamSize > StreamSizeLimit).

Message #

XML stream rejected because the size exceeded the limit (%1 > %2)

Fields #

Name	Description
`StreamSize` UInt64
`StreamSizeLimit` UInt64

Event ID 1006: XML stream rejected because of a parse error.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: CreateDocument

Description

XML stream rejected because of a parse error.

Message #

XML stream rejected because of a parse error



[Details]

Error code: %1

Error Message: %2

Description: %3

Fields #

Name	Description
`ErrorCode` UInt32
`ErrorMessage` UnicodeString
`Description` UnicodeString

Event ID 1007: XML stream rejected because schema validation failed.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: CreateDocument

Description

XML stream rejected because schema validation failed.

Message #

XML stream rejected because schema validation failed



[Details]

Error code: %1

Line: %2

Line Pos: %3

Reason: %4

Fields #

Name	Description
`ErrorCode` UInt32
`Line` Int32
`LinePos` Int32
`Reason` UnicodeString

Event ID 1008: XML stream rejected because signature verification failed (Result).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: CreateDocument

Description

XML stream rejected because signature verification failed (Result).

Message #

XML stream rejected because signature verification failed (%1)

Fields #

Name	Description
`Result` Int32

Event ID 2000: Provisioning document started

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: ProvisioningDocument
Opcode: Start

Description

Provisioning document started.

Message #

Provisioning document started

Event ID 2001: Finished provisioning document (Result=ErrorCode ErrorOccured=ErrorOccurred).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: ProvisioningDocument
Opcode: Stop

Description

Finished provisioning document (Result=ErrorCode ErrorOccured=ErrorOccurred).

Message #

Finished provisioning document (Result=%1 ErrorOccured=%2)

Fields #

Name	Description
`ErrorCode` Int32
`ErrorOccurred` Boolean

Event ID 2002: Certificate verification completed (bool=BoolResult).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: ProvisioningDocument

Description

Certificate verification completed (bool=BoolResult).

Message #

Certificate verification completed (bool=%1)

Fields #

Name	Description
`BoolResult` Boolean

Event ID 4001: Trigger to refresh task completed (Result=Result).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: RefreshTask

Description

Trigger to refresh task completed (Result=Result).

Message #

Trigger to refresh task completed (Result=%1)

Fields #

Name	Description
`Result` Int32

Event ID 5000: Activation method Carrier_Id has been started.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Activation method Carrier_Id has been started.

Message #

Activation method %1 has been started



[Details]

Carrier Id: %2

Subscriber Id: %3

Params: %4

Fields #

Name	Description
`ActivationMethod` UInt32
`CarrierId` UnicodeString
`SubscriberId` UnicodeString
`Params` UnicodeString

Event ID 5001: Activation method ICarrier_Id has finished.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Activation method ICarrier_Id has finished.

Message #

Activation method %1 has finished 



[Details]

ICarrier Id: %2

Subscriber Id: %3

Params: %4

Result: %5

Fields #

Name	Description
`ActivationMethod` UInt32
`CarrierId` UnicodeString
`SubscriberId` UnicodeString
`Params` UnicodeString
`ErrorCode` Int32

Event ID 5002: The radio is already off on interface InterfaceGuid; assuming the user has switched it off; aborting activation method.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

The radio is already off on interface InterfaceGuid; assuming the user has switched it off; aborting activation method.

Message #

The radio is already off on interface %1; assuming the user has switched it off; aborting activation method

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 5003: Unable to turn the radio RadioState on interface InterfaceGuid (error=ErrorCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Unable to turn the radio RadioState on interface InterfaceGuid (error=ErrorCode).

Message #

Unable to turn the radio %2 on interface %1 (error=%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`RadioState` UInt32
`ErrorCode` Int32

Event ID 5004: Interface InterfaceGuid is not registered to the home network; aborting connection attempt (register state = RegisterState).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Interface InterfaceGuid is not registered to the home network; aborting connection attempt (register state = RegisterState).

Message #

Interface %1 is not registered to the home network; aborting connection attempt (register state = %2)

Fields #

Name	Description
`InterfaceGuid` GUID
`RegisterState` UInt32

Event ID 5005: Cannot locate the ProfileType profile on interface InterfaceGuid (error=ErrorCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Cannot locate the ProfileType profile on interface InterfaceGuid (error=ErrorCode).

Message #

Cannot locate the %2 profile on interface %1 (error=%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileType` UInt32
`ErrorCode` Int32

Event ID 5006: Connection to profile ProfileName failed on interface InterfaceGuid (error=ErrorCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Connection to profile ProfileName failed on interface InterfaceGuid (error=ErrorCode).

Message #

Connection to profile %2 failed on interface %1 (error=%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`ErrorCode` Int32

Event ID 5007: Unable to disconnect interface InterfaceGuid from network (error=ErrorCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ActivationTask

Description

Unable to disconnect interface InterfaceGuid from network (error=ErrorCode).

Message #

Unable to disconnect interface %1 from network (error=%2)

Fields #

Name	Description
`InterfaceGuid` GUID
`ErrorCode` Int32

Event ID 6000: Purge task has been started

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: PurgeTask

Description

Purge task has been started.

Message #

Purge task has been started

Event ID 6001: Purge task has finished Result.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: PurgeTask

Description

Purge task has finished.

Message #

Purge task has finished



Result: %1

Fields #

Name	Description
`ErrorCode` Int32

Event ID 6002: Calling Purge [Details] Carrier Id: Carrier_Id Subscriber Id: Subscriber_Id AppId: AppId.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: PurgeTask

Description

Calling Purge.

Message #

Calling Purge



[Details]

Carrier Id: %1

Subscriber Id: %2

AppId: %3

Fields #

Name	Description
`CarrierId` UnicodeString
`SubscriberId` UnicodeString
`AppId` UnicodeString

Event ID 9000: Handler HandlerName: provision (start).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: InvokeHandlers
Opcode: Start

Description

Handler HandlerName: provision (start).

Message #

Handler %1: provision (start)

Fields #

Name	Description
`HandlerName` UnicodeString

Event ID 9001: Handler HandlerName: provision (stop) [result: ErrorCode].

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: InvokeHandlers
Opcode: Stop

Description

Handler HandlerName: provision (stop) [result: ErrorCode].

Message #

Handler %1: provision (stop) [result: %2]

Fields #

Name	Description
`HandlerName` UnicodeString
`ErrorCode` Int32
`HasResults` Boolean

Event ID 9100: Handler HandlerName: purge (start).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: InvokeHandlers
Opcode: Start

Description

Handler HandlerName: purge (start).

Message #

Handler %1: purge (start)

Fields #

Name	Description
`HandlerName` UnicodeString

Event ID 9101: Handler HandlerName: purge (stop).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Analytic
Task: InvokeHandlers
Opcode: Stop

Description

Handler HandlerName: purge (stop).

Message #

Handler %1: purge (stop)

Fields #

Name	Description
`HandlerName` UnicodeString

Event ID 10000: Failed to connect to the ServiceName: ErrorCode.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ApplyProfiles

Description

Failed to connect to the ServiceName: ErrorCode.

Message #

Failed to connect to the %1: %2

Fields #

Name	Description
`ServiceName` UInt32
`ErrorCode` Int32

Event ID 10001: Failed to set WLAN profile ProfileName on interface InterfaceGuid with error code ErrorCode (reason=ReasonCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ApplyProfiles

Description

Failed to set WLAN profile ProfileName on interface InterfaceGuid with error code ErrorCode (reason=ReasonCode).

Message #

Failed to set WLAN profile %2 on interface %1 with error code %3 (reason=%4)

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`ErrorCode` Int32
`ReasonCode` UInt32

Event ID 10002: Failed to set WWAN profile ProfileName on interface InterfaceGuid with error code ErrorCode (reason=ReasonCode).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ApplyProfiles

Description

Failed to set WWAN profile ProfileName on interface InterfaceGuid with error code ErrorCode (reason=ReasonCode).

Message #

Failed to set WWAN profile %2 on interface %1 with error code %3 (reason=%4)

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`ErrorCode` Int32
`ReasonCode` UInt32

Event ID 10003: Failed to apply metadata to profile ProfileName on interface InterfaceGuid with error code ErrorCode (param=Parameter).

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ApplyProfiles

Description

Failed to apply metadata to profile ProfileName on interface InterfaceGuid with error code ErrorCode (param=Parameter).

Message #

Failed to apply metadata to profile %2 on interface %1 with error code %3 (param=%4)

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`ErrorCode` Int32
`Parameter` UInt32

Event ID 11000: The message rule at position Xml failed validation.

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: Notifications

Description

The message rule at position Xml failed validation.

Message #

The message rule at position %1 failed validation.

Xml:%2

Reason:%3

Fields #

Name	Description
`Position` UInt64
`RulesXml` UnicodeString
`Reason` UnicodeString

Event ID 20000: Provisioning results for caller application (AppId CallerAppId): [ErrorCode].

Provider: Microsoft-Windows-NetworkProvisioning
Channel: Operational
Task: ProvisioningAgent

Description

Provisioning results for caller application (AppId CallerAppId): [ErrorCode].

Message #

Provisioning results for caller application (AppId %1): [%2]

Fields #

Name	Description
`CallerAppId` UnicodeString
`ErrorCode` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 93a19ab3-fb2c-46eb-91ef-56b0a318b983

Defined in provcore.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-NetworkProvisioning registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)