detection.wiki

Microsoft-Windows-VPN-Client

EventTitleChannelSampleRule
10001VPN Profile VpnConnectionName has been created with the following properties.OperationalYN
10002VPN Profile VpnConnectionName could not be created.OperationalYN
10003VPN Profile VpnConnectionName has been deleted.OperationalYN
10004VPN Profile VpnConnectionName could not be deleted.OperationalYN
10005VPN Connection VpnConnectionName has been modified with the following …OperationalNN
10006VPN Profile VpnConnectionName could not be modified.OperationalNN
10007VPN Profile VpnConnectionName has been created with the following input …OperationalNN
10008VPN Connection VpnConnectionName has been modified with the following input …OperationalNN

Event ID 10001: VPN Profile VpnConnectionName has been created with the following properties.

#
Channel
Operational
Level
Informational
Task
VPNWmiCreate
Opcode
Success

Message #

VPN Profile %1 has been created with the following properties: 
%2

Fields #

NameDescription
VpnConnectionName UnicodeString
PropertiesString UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VPN-Client",
    "guid": "3C088E51-65BE-40D1-9B90-62BFEC076737",
    "event_source_name": "",
    "event_id": 10001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 11,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-22T09:29:46.308409+00:00",
    "event_record_id": 27,
    "correlation": {
      "ActivityID": "A004E6CE-1D85-4F42-BDFB-3D527F0D38F3"
    },
    "execution": {
      "process_id": 6836,
      "thread_id": 12004
    },
    "channel": "Microsoft-Windows-VPN-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Name": "VPNCLIENTPSPROVIDER_CREATE_SUCCESS",
    "VpnConnectionName": "dwh_vpn_test",
    "PropertiesString": "ServerAddress: 127.0.0.1\nRememberCredential: false\nSplitTunneling: false\nDnsSuffix: \nVpnServerList: null\nIdleDisconnectSeconds: 0\nAllUserConnection: false\nEncryptionLevel: \nTunnelType: Pptp\nEapConfiguration: false\nUseWinlogonCredential: false\nL2tpPsk: false\nMachineCertificateIssuerFilter: \nMachineCertificateEKUFilter: null\n"
  },
  "message": ""
}

Example keys not documented in the fields table: Name

Event ID 10002: VPN Profile VpnConnectionName could not be created.

#
Channel
Operational
Level
Error
Task
VPNWmiCreate
Opcode
Failure

Message #

VPN Profile %1 could not be created. 
Error: (%2). 
Properties: 
%3

Fields #

NameDescription
VpnConnectionName UnicodeString
ErrorCode UInt32
PropertiesString UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VPN-Client",
    "guid": "{3C088E51-65BE-40D1-9B90-62BFEC076737}",
    "event_source_name": "",
    "event_id": 10002,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 12,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:54.1757171+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "{40C6824D-23F8-4502-A9C1-BEC64FB97E8F}"
    },
    "execution": {
      "process_id": 4544,
      "thread_id": 12792
    },
    "channel": "Microsoft-Windows-VPN-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "VpnConnectionName": "LabVPN",
    "ErrorCode": "87",
    "PropertiesString": "ServerAddress: 10.99.99.99\nRememberCredential: true\nSplitTunneling: false\nDnsSuffix: \nVpnServerList: null\nIdleDisconnectSeconds: 0\nAllUserConnection: false\nEncryptionLevel: \nTunnelType: Ikev2\nEapConfiguration: false\nUseWinlogonCredential: false\nL2tpPsk: false\nAuthenticationMethod: MSChapv2\nMachineCertificateIssuerFilter: \nMachineCertificateEKUFilter: null\n"
  },
  "message": "VPN Profile LabVPN could not be created. \r\nError: (87). \r\nProperties: \r\nServerAddress: 10.99.99.99\nRememberCredential: true\nSplitTunneling: false\nDnsSuffix: \nVpnServerList: null\nIdleDisconnectSeconds: 0\nAllUserConnection: false\nEncryptionLevel: \nTunnelType: Ikev2\nEapConfiguration: false\nUseWinlogonCredential: false\nL2tpPsk: false\nAuthenticationMethod: MSChapv2\nMachineCertificateIssuerFilter: \nMachineCertificateEKUFilter: null\n"
}

Event ID 10003: VPN Profile VpnConnectionName has been deleted.

#
Channel
Operational
Level
Informational
Task
VPNWmiDelete
Opcode
Success

Message #

VPN Profile %1 has been deleted.

Fields #

NameDescription
VpnConnectionName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VPN-Client",
    "guid": "3C088E51-65BE-40D1-9B90-62BFEC076737",
    "event_source_name": "",
    "event_id": 10003,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 11,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-22T09:29:51.156434+00:00",
    "event_record_id": 28,
    "correlation": {
      "ActivityID": "050205BC-E0C7-40F3-8946-651308AC8A28"
    },
    "execution": {
      "process_id": 6836,
      "thread_id": 12004
    },
    "channel": "Microsoft-Windows-VPN-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Name": "VPNCLIENTPSPROVIDER_DELETE_SUCCESS",
    "VpnConnectionName": "dwh_vpn_test"
  },
  "message": ""
}

Example keys not documented in the fields table: Name

Event ID 10004: VPN Profile VpnConnectionName could not be deleted.

#
Channel
Operational
Level
Error
Task
VPNWmiDelete
Opcode
Failure

Message #

VPN Profile %1 could not be deleted. 
Error: (%2).

Fields #

NameDescription
VpnConnectionName UnicodeString
ErrorCode UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-VPN-Client",
    "guid": "3C088E51-65BE-40D1-9B90-62BFEC076737",
    "event_source_name": "",
    "event_id": 10004,
    "version": 0,
    "level": 2,
    "task": 2,
    "opcode": 12,
    "keywords": 9223372036854775808,
    "time_created": "2026-07-22T09:29:46.104717+00:00",
    "event_record_id": 26,
    "correlation": {
      "ActivityID": "C21903C4-D0A7-497A-9BA8-45B708FFF952"
    },
    "execution": {
      "process_id": 6836,
      "thread_id": 7988
    },
    "channel": "Microsoft-Windows-VPN-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Name": "VPNCLIENTPSPROVIDER_DELETE_FAILED",
    "VpnConnectionName": "dwh_vpn_test",
    "ErrorCode": 623
  },
  "message": ""
}

Example keys not documented in the fields table: Name

Event ID 10005: VPN Connection VpnConnectionName has been modified with the following properties.

#
Channel
Operational
Task
VPNWmiModify
Opcode
Success

Message #

VPN Connection %1 has been modified with the following properties: 
%2

Fields #

NameDescription
VpnConnectionName UnicodeString
PropertiesString UnicodeString

Event ID 10006: VPN Profile VpnConnectionName could not be modified.

#
Channel
Operational
Task
VPNWmiModify
Opcode
Failure

Message #

VPN Profile %1 could not be modified. 
Error: (%2). 
Properties: 
%3

Fields #

NameDescription
VpnConnectionName UnicodeString
ErrorCode UInt32
PropertiesString UnicodeString

Event ID 10007: VPN Profile VpnConnectionName has been created with the following input properties.

#
Channel
Operational
Task
VPNWmiCreate
Opcode
Success

Message #

VPN Profile %1 has been created with the following input properties: 
%2
The following properties could not be updated:
%3

Fields #

NameDescription
VpnConnectionName UnicodeString
PropertiesString UnicodeString
PropertiesNotUpdatedString UnicodeString

Event ID 10008: VPN Connection VpnConnectionName has been modified with the following input properties.

#
Channel
Operational
Task
VPNWmiModify
Opcode
Success

Message #

VPN Connection %1 has been modified with the following input properties: 
%2
The following properties could not be updated:
%3

Fields #

NameDescription
VpnConnectionName UnicodeString
PropertiesString UnicodeString
PropertiesNotUpdatedString UnicodeString

Provenance

ETW provider GUID 3c088e51-65be-40d1-9b90-62bfec076737

Defined in VpnClientPSProvider.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB