detection.wiki

Microsoft-Windows-USB-USBHUB

EventTitleChannelSampleRule
1USB Hub AddedDiagnosticNN
2USB Hub RemovedDiagnosticNN
3USB Hub InformationDiagnosticYN
10Start Enumeration of PortDiagnosticNN
11Enumeration Port Debounce FailedDiagnosticNN
12Create PDO FailedDiagnosticNN
13IoCreateDevice FailedDiagnosticNN
14Create PnP ID FailedDiagnosticNN
15Enumeration Port Reset FailureDiagnosticNN
16Port Enabled but not Connected After First ResetDiagnosticNN
17First Enumeration Port Reset Timed OutDiagnosticNN
18Create Device FailedDiagnosticNN
19Initialize Device FailedDiagnosticNN
20Get Descriptors Request FailedDiagnosticNN
21Valdiation of USB Configuration Descriptor FailedDiagnosticNN
22Validation of USB Device Descriptor FailedDiagnosticNN
23Request for Microsoft OS Descriptor FailedDiagnosticNN
24Request for Serial Number String Descriptor FailedDiagnosticNN
25Build PnP ID failedDiagnosticNN
26Duplicate Serial Number DetectedOperationalNN
27Enumeration Timed Out Waiting for Previous Instance of USB Device to be RemovedDiagnosticNN
28Enumeration Failed Due to Registry FailureDiagnosticNN
29Retrying Enumeration of PortDiagnosticNN
30Hub Disconnected During Enumeration of PortDiagnosticNN
31Enumeration Debounce CompletedDiagnosticNN
32PDO Created for EnumerationDiagnosticNN
33First Enumeration Port Reset CompleteDiagnosticNN
34Enumeration - CreateDevice CompleteDiagnosticNN
35Second Enumeration Port Reset CompleteDiagnosticNN
36Enumeration - InitializeDevice CompleteDiagnosticNN
37Enumeration - SetupDevice CompleteDiagnosticNN
39Enumeration of Port CompletedDiagnosticNN
40Reset Recovery of Hub StartedDiagnosticNN
41Reset Recovery of Hub QueuedDiagnosticNN
49Reset Recovery of Hub CompletedDiagnosticNN
50Started Selective Suspend of HubDiagnosticYN
51Selective Suspend of Hub Failed to Pause BusDiagnosticNN
59Completed Selective Suspend of HubDiagnosticYN
60Started Resume of Hub from Selective SuspendDiagnosticYN
61Resume of Hub CompletedDiagnosticYN
62Propagated Resume of Hub DownstreamDiagnosticNN
63Resumed Port for Hub ResumeDiagnosticYN
64Propagated Resume of Hub UpstreamDiagnosticYN
70USB Hub Query Device Relations (BusRelations) IRP DispatchedOperationalYN
71USB Hub Query Device Relations IRP CompletedDiagnosticYN
80USB Hub Port AttributesDiagnosticYN
81ACPI USB Port Capabilities (_UPC)DiagnosticNN
82ACPI Physical Device Location (_PLD)DiagnosticNN
83Query for ACPI USB Port Capabilities (_UPC) FailedDiagnosticNN
84Query for ACPI Physical Device Location (_PLD) FailedDiagnosticNN
100USB Device AddedDiagnosticNN
101USB Device RemovedDiagnosticNN
102USB Device InformationDiagnosticYN
103USB Device DescriptionDiagnosticYN
110USB Device Start IRP DispatchedDiagnosticNN
111Restart of USB Device Failed Due to Device Reset FailureDiagnosticNN
112Start Device Failed for USB Device Due to Registry FailureDiagnosticNN
113Unable to Create Symbolic Link for USB DeviceDiagnosticNN
114New USB Device DescriptionDiagnosticNN
119USB Device Start IRP CompletedDiagnosticNN
120USB Device Set D0 Device Power IRP DispatchedDiagnosticYN
121USB Device Set D0 Device Power IRP CompletedDiagnosticYN
122USB Device Set Dx Device Power IRP DispatchedDiagnosticYN
123USB Device Set Dx Device Power IRP CompletedDiagnosticYN
130USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION DispatchedDiagnosticYN
139USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION CompletedDiagnosticYN
140USB Device Wait Wake IRP DispatchedDiagnosticYN
149USB Device Wait Wake IRP CompletedDiagnosticYN
150USB Hub Wait Wake IRP StartedDiagnosticYN
151USB Hub Wait Wake IRP DispatchedDiagnosticYN
159USB Hub Wait Wake IRP CompletedDiagnosticYN
160USB Hub Set Dx Device Power IRP StartedDiagnosticNN
161USB Hub Set Dx Device Power IRP DispatchedDiagnosticNN
169USB Hub Set Dx Device Power IRP CompletedDiagnosticNN
170USB Hub Set D0 Device Power IRP StartedDiagnosticNN
171USB Hub Set D0 Device Power IRP DispatchedDiagnosticNN
172USB Hub Cold StartDiagnosticNN
173USB Hub Disconnected During Cold StartDiagnosticNN
174USB Device Disconnected During Cold Start of HubDiagnosticNN
175USB Device Connected During Cold Start of HubDiagnosticNN
176Device Lost Power During Cold Start of HubDiagnosticNN
177USB Device Needs to be Reset During Cold Start of HubDiagnosticNN
178USB Hub Cold Start CompletedDiagnosticNN
179USB Hub Warm StartDiagnosticNN
180USB Device Failed to Resume During Warm Start of HubDiagnosticNN
181USB Device Requires Reset During Warm Start of HubDiagnosticNN
183USB Hub Warm Start CompletedDiagnosticNN
184USB Hub Lost Power During System SuspendDiagnosticNN
185USB Hub Was Disconnected During System SuspendDiagnosticNN
189USB Hub Set D0 Device Power IRP CompletedDiagnosticNN
190USB Hub Set Sx System Power IRP DispatchedDiagnosticNN
199USB Hub Set Sx System Power IRP CompletedDiagnosticNN
200USB Hub Set S0 System Power IRP DispatchedDiagnosticNN
209USB Hub Set S0 System Power IRP CompleteDiagnosticNN
210USB Hub Exception LoggedDiagnosticYN
211USB Hub Port Status ChangeDiagnosticYN
212USB Hub Timer DisabledDiagnosticYN
213USB Hub Timer EnabledDiagnosticYN
214USB Hub Timer CallbackDiagnosticYN
220USB Device Internal Reset StartedDiagnosticNN
229USB Device Internal Reset CompletedDiagnosticNN
230USB Hub Past Exception LoggedDiagnosticYN
231Start IOCTL_INTERNAL_USB_RESET_PORTDiagnosticNN
232Complete IOCTL_INTERNAL_USB_RESET_PORTDiagnosticNN
233Request for Microsoft OS 2.DiagnosticNN
234Validation of Microsoft OS 2.DiagnosticNN

Event ID 1: USB Hub Added

#
Channel
Diagnostic
Task
USBHub
Opcode
Add

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_USBHUB_Hub_State Binary
fid_USB_HubDescriptor Pointer

Event ID 2: USB Hub Removed

#
Channel
Diagnostic
Task
USBHub
Opcode
Remove

Fields #

NameDescription
fid_USBHUB_HC AnsiString
fid_USBHUB_Hub Int32

Event ID 3: USB Hub Information

#
Channel
Diagnostic
Also via
realtime ETW trace
Level
Informational
Task
USBHub
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_USBHUB_Hub_State Binary
fid_USB_HubDescriptor Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-USB-USBHUB",
    "guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 16,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:32:14.404+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 20896,
      "thread_id": 19908
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_Hub_State": "0100000004000000",
    "fid_USB_HubDescriptor": "0929021B00010000FF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
  },
  "message": "USBHUB_HUB"
}

Event ID 10: Start Enumeration of Port

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 11: Enumeration Port Debounce Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 12: Create PDO Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 13: IoCreateDevice Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 14: Create PnP ID Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 15: Enumeration Port Reset Failure

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 16: Port Enabled but not Connected After First Reset

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 17: First Enumeration Port Reset Timed Out

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 18: Create Device Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_USBHUB_CD_Error_Information Binary

Event ID 19: Initialize Device Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_USBHUB_ID_Error_Information Binary

Event ID 20: Get Descriptors Request Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 21: Valdiation of USB Configuration Descriptor Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 22: Validation of USB Device Descriptor Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 23: Request for Microsoft OS Descriptor Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 24: Request for Serial Number String Descriptor Failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 25: Build PnP ID failed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 26: Duplicate Serial Number Detected

#
Channel
Operational
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 27: Enumeration Timed Out Waiting for Previous Instance of USB Device to be Removed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 28: Enumeration Failed Due to Registry Failure

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 29: Retrying Enumeration of Port

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 30: Hub Disconnected During Enumeration of Port

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 31: Enumeration Debounce Completed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 32: PDO Created for Enumeration

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 33: First Enumeration Port Reset Complete

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 34: Enumeration - CreateDevice Complete

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 35: Second Enumeration Port Reset Complete

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 36: Enumeration - InitializeDevice Complete

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 37: Enumeration - SetupDevice Complete

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 39: Enumeration of Port Completed

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 40: Reset Recovery of Hub Started

#
Channel
Diagnostic
Task
USBHubResetRecovery
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 41: Reset Recovery of Hub Queued

#
Channel
Diagnostic
Task
USBHubResetRecovery
Opcode
Queue

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 49: Reset Recovery of Hub Completed

#
Channel
Diagnostic
Task
USBHubResetRecovery
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 50: Started Selective Suspend of Hub

#
Channel
Diagnostic
Level
Informational
Task
USBHubSuspend
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 50,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.865Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 51: Selective Suspend of Hub Failed to Pause Bus

#
Channel
Diagnostic
Task
USBHubSuspend
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 59: Completed Selective Suspend of Hub

#
Channel
Diagnostic
Level
Informational
Task
USBHubSuspend
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 59,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.882Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 60: Started Resume of Hub from Selective Suspend

#
Channel
Diagnostic
Level
Informational
Task
USBHubResume
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 60,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.667Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 61: Resume of Hub Completed

#
Channel
Diagnostic
Level
Informational
Task
USBHubResume
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 61,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 62: Propagated Resume of Hub Downstream

#
Channel
Diagnostic
Task
USBHubResume
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 63: Resumed Port for Hub Resume

#
Channel
Diagnostic
Level
Informational
Task
USBHubResume
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 63,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 1,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 64: Propagated Resume of Hub Upstream

#
Channel
Diagnostic
Level
Informational
Task
USBHubResume
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 64,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 70: USB Hub Query Device Relations (BusRelations) IRP Dispatched

#
Channel
Operational
Level
Informational
Task
USBHubQueryDeviceRelationsIRP_BusRelations
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 70,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.667Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 71: USB Hub Query Device Relations IRP Completed

#
Channel
Diagnostic
Level
Informational
Task
USBHubQueryDeviceRelationsIRP_BusRelations
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 71,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 80: USB Hub Port Attributes

#
Channel
Diagnostic
Also via
realtime ETW trace
Level
Informational
Task
USBHubPortInformation
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_PortAttributes UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-USB-USBHUB",
    "guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
    "event_source_name": "",
    "event_id": 80,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 16,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:32:14.404+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 20896,
      "thread_id": 19908
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fid_PortAttributes": 0,
    "fid_PortNumber": 1,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": "USBHUB_PORT_INFORMATION"
}

Event ID 81: ACPI USB Port Capabilities (_UPC)

#
Channel
Diagnostic
Task
USBHubPortInformation
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_USBHUB_Acpi_Upc_Package Binary

Event ID 82: ACPI Physical Device Location (_PLD)

#
Channel
Diagnostic
Task
USBHubPortInformation
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_USBHUB_Acpi_Pld Binary

Event ID 83: Query for ACPI USB Port Capabilities (_UPC) Failed

#
Channel
Diagnostic
Task
USBHubPortInformation
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 84: Query for ACPI Physical Device Location (_PLD) Failed

#
Channel
Diagnostic
Task
USBHubPortInformation
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 100: USB Device Added

#
Channel
Diagnostic
Task
USBDevice
Opcode
Add

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_USBHUB_Device_State GUID
fid_DeviceDescriptor Pointer

Event ID 101: USB Device Removed

#
Channel
Diagnostic
Task
USBDevice
Opcode
Remove

Fields #

NameDescription
fid_USBHUB_HC AnsiString
fid_USBHUB_Device Int32

Event ID 102: USB Device Information

#
Channel
Diagnostic
Also via
realtime ETW trace
Level
Informational
Task
USBDevice
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_USBHUB_Device_State GUID
fid_DeviceDescriptor Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-USB-USBHUB",
    "guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 16,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:32:14.404+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 20896,
      "thread_id": 19908
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fid_DeviceDescriptor": "120100020000000827060100000001030A01",
    "fid_USBHUB_Device": "708DFBB28D87FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_Device_State": "03000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": "USBHUB_DEVICE"
}

Event ID 103: USB Device Description

#
Channel
Diagnostic
Also via
realtime ETW trace
Level
Informational
Task
USBDevice
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_DeviceDescription UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-USB-USBHUB",
    "guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 4,
    "task": 20,
    "opcode": 16,
    "keywords": "0x0000400000000001",
    "time_created": "2026-06-02T05:32:14.404+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 20896,
      "thread_id": 19908
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fid_DeviceDescription": "USB Input Device",
    "fid_USBHUB_Device": "708DFBB28D87FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": "USBHUB_DEVICE"
}

Event ID 110: USB Device Start IRP Dispatched

#
Channel
Diagnostic
Task
USBDeviceStart
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 111: Restart of USB Device Failed Due to Device Reset Failure

#
Channel
Diagnostic
Task
USBDeviceStart
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 112: Start Device Failed for USB Device Due to Registry Failure

#
Channel
Diagnostic
Task
USBDeviceStart
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 113: Unable to Create Symbolic Link for USB Device

#
Channel
Diagnostic
Task
USBDeviceStart
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 114: New USB Device Description

#
Channel
Diagnostic
Task
USBDevice
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_DeviceDescription UnicodeString

Event ID 119: USB Device Start IRP Completed

#
Channel
Diagnostic
Task
USBDeviceStart
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 120: USB Device Set D0 Device Power IRP Dispatched

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceSetPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_PowerState UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 120,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 20
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.726Z",
    "version": 0
  },
  "event_data": {
    "fid_PowerState": 1,
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 121: USB Device Set D0 Device Power IRP Completed

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceSetPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_PowerState UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 121,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.727Z",
    "version": 0
  },
  "event_data": {
    "fid_PowerState": 1,
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 122: USB Device Set Dx Device Power IRP Dispatched

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceSetPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_PowerState UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 122,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 16
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.743Z",
    "version": 0
  },
  "event_data": {
    "fid_PowerState": 3,
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 123: USB Device Set Dx Device Power IRP Completed

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceSetPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Device Int64
fid_PowerState UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 123,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 16
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.746Z",
    "version": 0
  },
  "event_data": {
    "fid_PowerState": 3,
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 130: USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION Dispatched

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceIdleNotification
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 130,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 14320
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.740Z",
    "version": 0
  },
  "event_data": {
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 139: USB Device IOCTL_INTERNAL_USB_SUBMIT_IDLE_NOTIFICATION Completed

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceIdleNotification
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 139,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_Status": 3221225760,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 140: USB Device Wait Wake IRP Dispatched

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceWaitWake
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 140,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 20
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.740Z",
    "version": 0
  },
  "event_data": {
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 149: USB Device Wait Wake IRP Completed

#
Channel
Diagnostic
Level
Informational
Task
USBDeviceWaitWake
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 149,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12720
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_Status": 0,
    "fid_USBHUB_Device": "B01D7FB607C8FFFF270601000100000001000000000000000000000000000000000000000000000001000000",
    "fid_USBHUB_HC": "000000000100020086802070"
  },
  "message": ""
}

Event ID 150: USB Hub Wait Wake IRP Started

#
Channel
Diagnostic
Level
Informational
Task
USBHubWaitWake
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 150,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.865Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 151: USB Hub Wait Wake IRP Dispatched

#
Channel
Diagnostic
Level
Informational
Task
USBHubWaitWake
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 151,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 13,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.865Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 159: USB Hub Wait Wake IRP Completed

#
Channel
Diagnostic
Level
Informational
Task
USBHubWaitWake
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 159,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 12,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.693Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_Status": 3221225494,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 160: USB Hub Set Dx Device Power IRP Started

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 161: USB Hub Set Dx Device Power IRP Dispatched

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 169: USB Hub Set Dx Device Power IRP Completed

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 170: USB Hub Set D0 Device Power IRP Started

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 171: USB Hub Set D0 Device Power IRP Dispatched

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 172: USB Hub Cold Start

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 173: USB Hub Disconnected During Cold Start

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 174: USB Device Disconnected During Cold Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 175: USB Device Connected During Cold Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 176: Device Lost Power During Cold Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 177: USB Device Needs to be Reset During Cold Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 178: USB Hub Cold Start Completed

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 179: USB Hub Warm Start

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 180: USB Device Failed to Resume During Warm Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 181: USB Device Requires Reset During Warm Start of Hub

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 183: USB Hub Warm Start Completed

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 184: USB Hub Lost Power During System Suspend

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Error

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 185: USB Hub Was Disconnected During System Suspend

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 189: USB Hub Set D0 Device Power IRP Completed

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 190: USB Hub Set Sx System Power IRP Dispatched

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 199: USB Hub Set Sx System Power IRP Completed

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 200: USB Hub Set S0 System Power IRP Dispatched

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Dispatch

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 209: USB Hub Set S0 System Power IRP Complete

#
Channel
Diagnostic
Task
USBHubPower
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PowerState UInt32
fid_Status UInt32

Event ID 210: USB Hub Exception Logged

#
Channel
Diagnostic
Level
Informational
Task
USBHubException
Opcode
Exception

Fields #

NameDescription
fid_USBHUB_HC Int32
fid_USBHUB_Hub Double
fid_PortNumber UInt32
fid_Class UInt32
fid_NtStatus UInt32
fid_UsbdStatus UInt32
fid_DebugText AnsiString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 210,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 17,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.865Z",
    "version": 0
  },
  "event_data": {
    "fid_Class": 123,
    "fid_DebugText": "HubErr_SetUsbWakeFailed",
    "fid_NtStatus": 3221225473,
    "fid_PortNumber": 0,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000",
    "fid_UsbdStatus": 3221225476
  },
  "message": ""
}

Event ID 211: USB Hub Port Status Change

#
Channel
Diagnostic
Level
Informational
Task
USBHubPortStatus
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_PortStatusChange UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 211,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12720
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.714Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 1,
    "fid_PortStatusChange": 4,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 212: USB Hub Timer Disabled

#
Channel
Diagnostic
Level
Informational
Task
USBHubTimer
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_TimerTag UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 212,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.726Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_TimerTag": 1397966964,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 213: USB Hub Timer Enabled

#
Channel
Diagnostic
Level
Informational
Task
USBHubTimer
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_TimerTag UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 213,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 13696
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:32.725Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_TimerTag": 1397966964,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 214: USB Hub Timer Callback

#
Channel
Diagnostic
Level
Informational
Task
USBHubTimer
Opcode
Information

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_TimerTag UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-USB-USBHUB/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 214,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 16,
    "provider": "Microsoft-Windows-USB-USBHUB",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 08:10:37.802Z",
    "version": 0
  },
  "event_data": {
    "fid_PortNumber": 0,
    "fid_TimerTag": 1397966964,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": "868020700000000000000000000000000000000000000000000000000000000001000000"
  },
  "message": ""
}

Event ID 220: USB Device Internal Reset Started

#
Channel
Diagnostic
Task
USBDeviceInternalReset
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 229: USB Device Internal Reset Completed

#
Channel
Diagnostic
Task
USBDeviceInternalReset
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 230: USB Hub Past Exception Logged

#
Channel
Diagnostic
Also via
realtime ETW trace
Level
Informational
Task
USBHubPastException
Opcode
Exception

Fields #

NameDescription
fid_TimeElapsedBeforeLogStart UInt64
fid_USBHUB_HC UInt32
fid_USBHUB_Hub Boolean
fid_PortNumber UInt32
fid_Class UInt32
fid_NtStatus UInt32
fid_UsbdStatus UInt32
fid_DebugText AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-USB-USBHUB",
    "guid": "{7426A56B-E2D5-4B30-BDEF-B31815C1A74A}",
    "event_source_name": "",
    "event_id": 230,
    "version": 0,
    "level": 4,
    "task": 28,
    "opcode": 17,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:32:14.404+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 20896,
      "thread_id": 19908
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fid_Class": 100,
    "fid_DebugText": "PnpErr_LegacyDevice",
    "fid_NtStatus": 0,
    "fid_PortNumber": 1,
    "fid_TimeElapsedBeforeLogStart": 2188854863381,
    "fid_USBHUB_HC": "000000000100020086802070",
    "fid_USBHUB_Hub": false,
    "fid_UsbdStatus": 0
  },
  "message": "USBHUB_HUB_PAST_EXCEPTION"
}

Event ID 231: Start IOCTL_INTERNAL_USB_RESET_PORT

#
Channel
Diagnostic
Task
USBDeviceIOCTL_INTERNAL_USB_RESET_PORT
Opcode
Start

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 232: Complete IOCTL_INTERNAL_USB_RESET_PORT

#
Channel
Diagnostic
Task
USBDeviceIOCTL_INTERNAL_USB_RESET_PORT
Opcode
Complete

Fields #

NameDescription
fid_USBHUB_HC Int8
fid_USBHUB_Device UInt32
fid_Status UInt32

Event ID 233: Request for Microsoft OS 2.

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Description

Request for Microsoft OS 2.0 Descriptor Set Failed.

Message #

Request for Microsoft OS 2.0 Descriptor Set Failed

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Event ID 234: Validation of Microsoft OS 2.

#
Channel
Diagnostic
Task
USBHubEnumerate
Opcode
Error

Description

Validation of Microsoft OS 2.0 Descriptor Set Failed.

Message #

Validation of Microsoft OS 2.0 Descriptor Set Failed

Fields #

NameDescription
fid_USBHUB_HC UInt8
fid_USBHUB_Hub Int64
fid_PortNumber UInt32
fid_Status UInt32

Provenance

ETW provider GUID {7426A56B-E2D5-4B30-BDEF-B31815C1A74A}

Defined in usbhub.sys, the binary that emits these events.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB