detection.wiki

Microsoft-Windows-UAC-FileVirtualization

EventTitleChannelSampleRule
2000Failed to register with Filter Manager.OperationalNN
2001Failed to read the settings.OperationalNN
2002Failed to read the file list.OperationalNN
2003Failed to initialize security.OperationalNN
2004Failed to start filtering.OperationalNN
2005Failed to set up the instance for a volume.OperationalNN
2006Failed to query the virtualization mode.OperationalNN
2007Failed to query virtual store file information.OperationalNN
2008Failed to select which file to create.OperationalNN
2009Failed to create a stream handle context.OperationalNN
2010Failed to set the stream handle context.OperationalNN
2011Failed to perform the administrator access check.OperationalNN
2012Failed to prepare for delayed virtualization.OperationalNN
2013Failed to perform delayed virtualization.OperationalNN
2014Failed to switch one or more delayed file objects.OperationalNN
2015Failed to create the virtual file path.OperationalNN
2016Failed to copy the file into the virtual store.OperationalNN
2017Failed to perform the merged directory query.OperationalNN
2018Failed to query information for the file object.OperationalNN
2019Failed to check target file for WRP protection.OperationalNN
4000Virtual file "FileNameBuffer" created.OperationalNN
4001Virtual file "FileNameBuffer" renamed to "TargetFileNameBuffer".OperationalNN
4002Virtual delete of file "FileNameBuffer" requested.OperationalNN
5000Operation on file "FileNameBuffer" excluded from virtualization.OperationalNN
5002Delayed virtual file "FileNameBuffer" not virtualized.OperationalNN
5003Access was denied on WRP file "FileNameBuffer".OperationalNN
5004Access was denied to delete file "FileNameBuffer".OperationalNN

Event ID 2000: Failed to register with Filter Manager.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2001: Failed to read the settings.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2002: Failed to read the file list.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2003: Failed to initialize security.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2004: Failed to start filtering.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2005: Failed to set up the instance for a volume.

#
Channel
Operational

Fields #

NameDescription
Error UInt32

Event ID 2006: Failed to query the virtualization mode.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2007: Failed to query virtual store file information.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2008: Failed to select which file to create.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2009: Failed to create a stream handle context.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2010: Failed to set the stream handle context.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2011: Failed to perform the administrator access check.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2012: Failed to prepare for delayed virtualization.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2013: Failed to perform delayed virtualization.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2014: Failed to switch one or more delayed file objects.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2015: Failed to create the virtual file path.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2016: Failed to copy the file into the virtual store.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2017: Failed to perform the merged directory query.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2018: Failed to query information for the file object.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 2019: Failed to check target file for WRP protection.

#
Channel
Operational

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
Error UInt32

Event ID 4000: Virtual file "FileNameBuffer" created.

#
Channel
Operational

Message #

Virtual file "%5" created.

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
CreateOptions UInt32
DesiredAccess UInt32Process access rights reference
IrpMajorFunction UInt8

Event ID 4001: Virtual file "FileNameBuffer" renamed to "TargetFileNameBuffer".

#
Channel
Operational

Message #

Virtual file "%5" renamed to "%9"

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
TargetFileNameLength UInt16
TargetFileNameBuffer UnicodeString

Event ID 4002: Virtual delete of file "FileNameBuffer" requested.

#
Channel
Operational

Message #

Virtual delete of file "%5" requested.

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString

Event ID 5000: Operation on file "FileNameBuffer" excluded from virtualization.

#
Channel
Operational

Message #

Operation on file "%5" excluded from virtualization.

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
CreateOptions UInt32
DesiredAccess UInt32Process access rights reference
IrpMajorFunction UInt8
Exclusions UInt32

Event ID 5002: Delayed virtual file "FileNameBuffer" not virtualized.

#
Channel
Operational

Message #

Delayed virtual file "%5" not virtualized.

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString
CreateOptions UInt32
DesiredAccess UInt32Process access rights reference

Event ID 5003: Access was denied on WRP file "FileNameBuffer".

#
Channel
Operational

Message #

Access was denied on WRP file "%5"

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString

Event ID 5004: Access was denied to delete file "FileNameBuffer".

#
Channel
Operational

Message #

Access was denied to delete file "%5"

Fields #

NameDescription
Flags UInt32
SidLength UInt32
Sid SID
FileNameLength UInt16
FileNameBuffer UnicodeString
ProcessImageNameLength UInt16
ProcessImageNameBuffer UnicodeString

Provenance

ETW provider GUID c02afc2b-e24e-4449-ad76-bcc2c2575ead

Defined in luafv.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB