Microsoft-Windows-VIRTDISK

Event	Title	Channel	Sample	Rule
1	Opening backing store VhdFileName as type VhdVirtualStorageType.	Microsoft-Windows-VIRTDISK-Analytic	N	N
2	Opened backing store, returning handle VhdHandle, status VhdStatus.	Microsoft-Windows-VIRTDISK-Analytic	N	N
3	Attaching using handle VhdHandle.	Microsoft-Windows-VIRTDISK-Analytic	N	N
4	Attached with status VhdStatus.	Microsoft-Windows-VIRTDISK-Analytic	N	N
5	Detaching using handle VhdHandle.	Microsoft-Windows-VIRTDISK-Analytic	N	N
6	Detached with status VhdStatus.	Microsoft-Windows-VIRTDISK-Analytic	N	N
1000	TraceData.	Microsoft-Windows-VIRTDISK-Analytic	N	N
1001	TraceData.	Microsoft-Windows-VIRTDISK-Analytic	N	N
1002	TraceData.	Microsoft-Windows-VIRTDISK-Analytic	N	N
1003	TraceData.	Microsoft-Windows-VIRTDISK-Analytic	N	N

Event ID 1: Opening backing store VhdFileName as type VhdVirtualStorageType.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Openvirtualdisk.
Opcode: Start

Message #

Opening backing store %1 as type %2.

Fields #

Name	Description
`VhdFileName` UnicodeString
`VhdVirtualStorageType` UInt32

Event ID 2: Opened backing store, returning handle VhdHandle, status VhdStatus.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Openvirtualdisk.
Opcode: Stop

Message #

Opened backing store, returning handle %1, status %2.

Fields #

Name	Description
`VhdHandle` Pointer
`VhdStatus` UInt32

Event ID 3: Attaching using handle VhdHandle.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Attachvirtualdisk.
Opcode: Start

Message #

Attaching using handle %1.

Fields #

Name	Description
`VhdHandle` Pointer

Event ID 4: Attached with status VhdStatus.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Attachvirtualdisk.
Opcode: Stop

Message #

Attached with status %1.

Fields #

Name	Description
`VhdStatus` UInt32

Event ID 5: Detaching using handle VhdHandle.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Detachvirtualdisk.
Opcode: Start

Message #

Detaching using handle %1.

Fields #

Name	Description
`VhdHandle` Pointer

Event ID 6: Detached with status VhdStatus.

Channel: Microsoft-Windows-VIRTDISK-Analytic
Task: Detachvirtualdisk.
Opcode: Stop

Message #

Detached with status %1.

Fields #

Name	Description
`VhdStatus` UInt32

Event ID 1000: TraceData.

Channel: Microsoft-Windows-VIRTDISK-Analytic

Message #

%1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1001: TraceData.

Channel: Microsoft-Windows-VIRTDISK-Analytic

Message #

%1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1002: TraceData.

Channel: Microsoft-Windows-VIRTDISK-Analytic

Message #

%1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Event ID 1003: TraceData.

Channel: Microsoft-Windows-VIRTDISK-Analytic

Message #

%1

Fields #

Name	Description
`TraceData` UnicodeString
`VmName` UnicodeString
`VmId` UnicodeString
`StackFrameCount` UInt32
`StackFrame` Pointer
`ModuleCount` UInt32
`Module` Int32

Provenance

ETW provider GUID 4d20df22-e177-4514-a369-f1759feedeb3

Defined in virtdisk.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB