detection.wiki

Microsoft-Windows-NvmeDisk

EventTitleChannelSampleRule
200Request servicing time taken by device.AnalyticNN
201Dispatching a read request.DiagnoseNN
202Dispatching a write request.DiagnoseNN
203Dispatching a read request.DiagnoseNN
204Dispatching a write request.DiagnoseNN
205Completing a NVM command request.DiagnoseNN
206Retrying an NVM command request.DiagnoseNN
207Dispatching an IOCTL.DiagnoseNN
208Completing a non-read/write/Admin Command request.DiagnoseNN
209Dispatching a PnP request.DiagnoseNN
210Completing a PnP request.DiagnoseNN
211Completing a PnP enumeration request.DiagnoseNN
212Dispatching a PassThrough request.DiagnoseNN
213NVM command request.DiagnoseNN
214NVM command request completion.DiagnoseNN
215The driver changed the removal policy of device number DeviceNumber toOperationalNN
215The driver changed the removal policy of device number DeviceNumber to …DiagnoseNN
500Completing a NVM command request with error.OperationalNN
501The driver detected that the device DeviceGUID has its write cache enabled.OperationalNN
502The driver disabled the write cache on device DeviceGUID.OperationalNN

Event ID 200: Request servicing time taken by device.

#
Channel
Analytic
Task
Class

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
RequestDuration_100ns UInt64
Irp Pointer
CommandType UnicodeString
CommandTag UInt32
NTStatus HexInt32NTSTATUS reference
Command HexInt32
CDW10 HexInt32
CDW11 HexInt32
CDW12 HexInt32
CDW13 HexInt32
CDW14 HexInt32
CDW15 HexInt32

Event ID 201: Dispatching a read request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Command UInt8
LengthOfTransfer UInt64
LBA HexInt64

Event ID 202: Dispatching a write request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Command UInt8
LengthOfTransfer UInt64
LBA HexInt64

Event ID 203: Dispatching a read request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Command UInt8
LengthOfTransfer UInt64
LBA HexInt64

Event ID 204: Dispatching a write request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Command UInt8
LengthOfTransfer UInt64
LBA HexInt64

Event ID 205: Completing a NVM command request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
NTStatus HexInt32NTSTATUS reference
CommandTag UInt32
OPC HexInt32
CID UInt32
SQID UInt32
DW0 UInt32
DW1 UInt32
SCT HexInt32
SC HexInt32
DNR UInt8

Event ID 206: Retrying an NVM command request.

#
Channel
Diagnose
Task
Class
Opcode
Retryhandling.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
CurrentRetryCount UInt32
SCT UInt8
SC UInt8

Event ID 207: Dispatching an IOCTL.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
MajorFunction HexInt32
MinorFunction HexInt32
Parameter HexInt32

Event ID 208: Completing a non-read/write/Admin Command request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Status HexInt32NTSTATUS reference

Event ID 209: Dispatching a PnP request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
MinorFunction HexInt32
Type HexInt32
DeviceObject Pointer

Event ID 210: Completing a PnP request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
Status HexInt32NTSTATUS reference

Event ID 211: Completing a PnP enumeration request.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
NumberOfChildren UInt32
Status HexInt32NTSTATUS reference

Event ID 212: Dispatching a PassThrough request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
MajorFunction HexInt32
MinorFunction HexInt32
Parameter HexInt32

Event ID 213: NVM command request.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
CommandTag UInt32
OPC HexInt32
CID UInt32
NSID UInt32
PRP1 HexInt64
PRP2 HexInt64
CDW10 HexInt32
CDW11 HexInt32
CDW12 HexInt32
CDW13 HexInt32
CDW14 HexInt32
CDW15 HexInt32

Event ID 214: NVM command request completion.

#
Channel
Diagnose
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
NTStatus HexInt32NTSTATUS reference
CommandTag UInt32
OPC HexInt32
CID UInt32
SQID UInt32
DW0 UInt32
DW1 UInt32
SCT HexInt32
SC HexInt32
DNR UInt8

Event ID 215: The driver changed the removal policy of device number DeviceNumber to

#
Channel
Operational
Task
Class
Opcode
Dispatchingofrequest.

Description

The driver changed the removal policy of device number to .

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
RemovalPolicy UnicodeString
Status HexInt32NTSTATUS reference

Event ID 215: The driver changed the removal policy of device number DeviceNumber to RemovalPolicy.

#
Channel
Diagnose
Task
Class
Opcode
Dispatchingofrequest.

Message #

The driver changed the removal policy of device number %2 to %6.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
RemovalPolicy UnicodeString
Status HexInt32NTSTATUS reference

Event ID 500: Completing a NVM command request with error.

#
Channel
Operational
Task
Class
Opcode
Completionofrequest.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
Irp Pointer
NTStatus HexInt32NTSTATUS reference
CommandTag UInt32
OPC HexInt32
CID UInt32
SQID UInt32
DW0 UInt32
DW1 UInt32
SCT HexInt32
SC HexInt32
DNR UInt8

Event ID 501: The driver detected that the device DeviceGUID has its write cache enabled.

#
Channel
Operational
Task
Class
Opcode
Dispatchingofrequest.

Message #

The driver detected that the device %1 has its write cache enabled.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NamespaceID UInt32
VwcEnabled Boolean
Status HexInt32NTSTATUS reference

Event ID 502: The driver disabled the write cache on device DeviceGUID.

#
Channel
Operational
Task
Class
Opcode
Dispatchingofrequest.

Message #

The driver disabled the write cache on device %1.

Fields #

NameDescription
DeviceGUID GUID
DeviceNumber UInt32
Model AnsiString
FirmwareVersion AnsiString
SerialNumber AnsiString
NamespaceID UInt32
VwcEnabled Boolean
Status HexInt32NTSTATUS reference

Provenance

ETW provider GUID 9799276c-fb04-47e8-845e-36946045c218

Defined in nvmedisk.sys, the binary that emits these events.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB