Microsoft-Windows-VDRVROOT
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | The VHD HBA driver is registered with the root enumerator. | Operational | N | N |
| 2 | The VHD HBA driver is unregistered with the root enumerator. | Operational | N | N |
Event ID 1: The VHD HBA driver is registered with the root enumerator.
#Event ID 2: The VHD HBA driver is unregistered with the root enumerator.
#Provenance
ETW provider GUID e4480490-85b6-11dd-ad8b-0800200c9a66
Defined in vdrvroot.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1591, captured 2026-06-02 — Manifest XML pack, 2.0 MB