Microsoft-Windows-Wired-AutoConfig

101 events across 2 channels

Event	Title	Channel	Sample
13021	A pre-logon connection was not attempted.	Operational	N
13022	A pre-logon connection was attempted.	Operational	N
13031	A post-logon connection was not attempted.	Operational	N
13032	A post-logon connection was attempted.	Operational	N
13033	The post-logon connection attempt is complete.	Operational	N
15500	The network adapter has been unplugged.	Operational	Y
15501	The network adapter has been connected.	Operational	Y
15502	The profile was applied on the network adapter.	Operational	Y
15503	Wired 802.	Operational	Y
15504	Wired 802.	Operational	N
15505	Wired 802.	Operational	Y
15506	Network authentication attempts have been temporarily suspended on this network …	Operational	N
15507	Network authentication attempts have been resumed on this network adapter.	Operational	N
15508	There has been an NDIS Port state change on this network adapter.	Operational	Y
15509	The operational state on the network adapter was identified.	Operational	N
15510	A network adapter was added to the system.	Operational	Y
15511	The Wired AutoConfig service entered the running state.	Operational	Y
15512	The Wired AutoConfig service entered the stopped state.	Operational	Y
15513	A network adapter was removed from the system.	Operational	Y
15514	Wired 802.	Operational	N
15515	The Wired AutoConfig service is starting.	Operational	Y
15516	The Wired AutoConfig service is stopping.	Operational	Y
20001	No interactive console session to send UI request	Diagnostic	N
20002	ACM: IntfCompleteTimely failed, error ErrorCode.	Diagnostic	N
20003	There are no available connections	Diagnostic	N
20004	MSM failed to initialize the interface, error ErrorCode.	Diagnostic	N
20005	Failed to load profile, error ErrorCode.	Diagnostic	N
20006	No profile found in db, error ErrorCode.	Diagnostic	N
20007	ACM: UI request could not be sent.	Diagnostic	N
20008	IntfCompletePlap failed, error ErrorCode.	Diagnostic	N
20009	Interface does not have any available networks	Diagnostic	N
20010	Invalid state of the adapter ErrorCode.	Diagnostic	N
20011	Media is disconnected, SSO can't be done	Diagnostic	N
20012	Failed to make the PLAP runtime state , error ErrorCode.	Diagnostic	N
20013	Failed to make the timely runtime state , error ErrorCode.	Diagnostic	N
20014	Interface does not have a profile	Diagnostic	N
20015	OneXSetEapUserData failed, error ErrorCode.	Diagnostic	N
20016	AcmQueryUserDataProperties failed, error ErrorCode.	Diagnostic	N
20017	Dot3AcmQueryUserDataByGuid failed, error ErrorCode.	Diagnostic	N
20018	DsRoleGetPrimaryDomainInformation failed, error ErrorCode.	Diagnostic	N
20019	Adapter is connected , we have a valid IP	Diagnostic	N
20020	Don't have time to wait for DC connectivity.	Diagnostic	N
20021	Waiting for DC connectivity	Diagnostic	N
20022	Wait for ip address change successfully completed	Diagnostic	N
20024	Wait for ip address change timed out	Diagnostic	N
20025	Wait for ip address change failed with error (Error).	Diagnostic	N
20026	Waiting for ip address change notification	Diagnostic	N
20028	Wait for 1x completion successfully completed	Diagnostic	N
20029	Adapter not connected.	Diagnostic	N
20030	1x completed with a failure Error.	Diagnostic	N
20031	Wait for 1x completion failed with return code (Error).	Diagnostic	N
20032	Wait for 1x completion timed out	Diagnostic	N
20033	IntfDoTimely took longer than our timeout allows.	Diagnostic	N
20034	IntfDoTimely completed successfully	Diagnostic	N
20035	IntfDoTimely failed, error Error.	Diagnostic	N
20036	No TIMELY profiles were found.	Diagnostic	N
20037	Timely1x - Interface InterfaceGuid, profile Start - Start Stop, Stop Duration.	Diagnostic	N
20038	FindTimelyIntfAndProfile failed, error ErrorCode.	Diagnostic	N
21001	DeviceLayerOpenHandle failed, Error ErrorCode.	Diagnostic	N
21002	DeviceLayerQueryOID failed ErrorCode, OID Context.	Diagnostic	N
21003	DeviceLayerSetOID failed ErrorCode, OID Context.	Diagnostic	N
21004	DeviceLayerSendPacket failed, ErrorCode.	Diagnostic	N
21005	DeviceLayerReceivePacket failed, ErrorCode.	Diagnostic	N
21006	Packet only Size bytes, skipped.	Diagnostic	N
21007	Invalid packet type Type, skipped.	Diagnostic	N
21008	The read request was cancelled	Diagnostic	N
21009	Receiving data error ErrorCode.	Diagnostic	N
21010	Packet skipped, error ErrorCode.	Diagnostic	N
21011	Send data failed, error ErrorCode.	Diagnostic	N
21012	Interface(InterfaceGuid): pAcmConnectionProgress failed ErrorCode.	Diagnostic	N
21013	Interface(InterfaceGuid): pAcmQueryUserData failed ErrorCode.	Diagnostic	N
21014	Interface(InterfaceGuid): pAcmSetMsmProfile failed ErrorCode.	Diagnostic	N
21015	Interface(InterfaceGuid): pAcmSetUserData failed ErrorCode.	Diagnostic	N
21016	Interface(InterfaceGuid): pAcmMsmNotify failed ErrorCode.	Diagnostic	N
21017	Interface(InterfaceGuid): pAcmMediaChange failed, error ErrorCode.	Diagnostic	N
21018	Interface(InterfaceGuid): pAcmUIRequest failed ErrorCode.	Diagnostic	N
21019	Interface(InterfaceGuid): pAcmConnectionCompletionRoutine failed ErrorCode.	Diagnostic	N
21020	Interface(InterfaceGuid): State Transition OldState --> NewState.	Diagnostic	N
21021	Interface(InterfaceGuid): Received AuthNotStarted result from 1x.	Diagnostic	N
21022	Interface(InterfaceGuid): Received AuthInvalid result from 1x.	Diagnostic	N
21023	Interface(InterfaceGuid): Start processing event: (EventId).	Diagnostic	N
21024	Interface(InterfaceGuid): Completed processing event: (EventId).	Diagnostic	N
21025	Interface(InterfaceGuid): StartOneXAuth failed ErrorCode.	Diagnostic	N
21026	Interface(InterfaceGuid): SendOneXPacket failed ErrorCode.	Diagnostic	N
21027	Interface(InterfaceGuid): TIMING OUT 802.	Diagnostic	N
21028	Interface(InterfaceGuid): NOT TIMING OUT 802.	Diagnostic	N
21029	Interface(InterfaceGuid): DeviceLayerGetCurrentMediaState failed ErrorCode.	Diagnostic	N
21030	No 1X port exists.	Diagnostic	N
21031	Interface(InterfaceGuid): Set the SWITCH MAC address to InterfaceDescription.	Diagnostic	N
21032	Interface(InterfaceGuid): OpenDeviceHandle failed ErrorCode.	Diagnostic	N
21033	Interface(InterfaceGuid): Start processing event (EventId).	Diagnostic	N
21034	Interface(InterfaceGuid): ProcessDot3MsmEvent: …	Diagnostic	N
21035	Interface(InterfaceGuid): Completed processing event (EventId).	Diagnostic	N
21036	Finished initializing a new interface with id = InterfaceGuid and friendly name …	Diagnostic	N
21037	Dot3MsmInit failed ErrorCode.	Diagnostic	N
21038	Dot3MSMInitAdapter failed ErrorCode.	Diagnostic	N
21039	Failed to parse original request ErrorCode.	Diagnostic	N
21040	Failed to parse UI Response ErrorCode.	Diagnostic	N
21041	Interface(InterfaceGuid): OneXUIResponse failed ErrorCode.	Diagnostic	N
21042	Interface(InterfaceGuid): Dot3MsmQueryPendingUIRequest failed ErrorCode.	Diagnostic	N
21043	OneXValidateProfile failed ErrorCode.	Diagnostic	N

Event ID 13021: A pre-logon connection was not attempted.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

A pre-logon connection was not attempted.

Message #

A pre-logon connection was not attempted.

Result: %1
Reason: %2

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32

Event ID 13022: A pre-logon connection was attempted.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

A pre-logon connection was attempted.

Message #

A pre-logon connection was attempted.

Result: %1
Interface GUID: %2
Requested Fields: %3

Fields #

Name	Description
`Result` UInt32
`InterfaceGuid` GUID
`RequestedFields` UnicodeString

Event ID 13031: A post-logon connection was not attempted.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

A post-logon connection was not attempted.

Message #

A post-logon connection was not attempted.

Result: %1
Reason: %2

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32

Event ID 13032: A post-logon connection was attempted.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

A post-logon connection was attempted.

Message #

A post-logon connection was attempted.

Result: %1
Interface GUID: %2

Fields #

Name	Description
`Result` UInt32
`InterfaceGuid` GUID

Event ID 13033: The post-logon connection attempt is complete.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

The post-logon connection attempt is complete.

Message #

The post-logon connection attempt is complete.

Network connection attempt result: %1
Reason: %2
Interface GUID: %3

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32
`InterfaceGuid` GUID

Event ID 15500: The network adapter has been unplugged.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The network adapter has been unplugged.

Message #

The network adapter has been unplugged.

	Network Adapter: %2
	Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15500,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:20:36.6514606+00:00",
    "event_record_id": 33,
    "correlation": {},
    "execution": {
      "process_id": 3516,
      "thread_id": 7064
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{2783d75c-7782-425b-bb72-3692e7684716}",
    "InterfaceDescription": "Hyper-V Virtual Ethernet Adapter"
  },
  "message": "The network adapter has been unplugged.\r\n\r\n\tNetwork Adapter: Hyper-V Virtual Ethernet Adapter\r\n\tInterface GUID: {2783d75c-7782-425b-bb72-3692e7684716}"
}

Event ID 15501: The network adapter has been connected.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The network adapter has been connected.

Message #

The network adapter has been connected.

	Network Adapter: %2
	Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15501,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:20:02.8681152+00:00",
    "event_record_id": 28,
    "correlation": {},
    "execution": {
      "process_id": 3516,
      "thread_id": 4048
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{2783d75c-7782-425b-bb72-3692e7684716}",
    "InterfaceDescription": "Hyper-V Virtual Ethernet Adapter"
  },
  "message": "The network adapter has been connected.\r\n\r\n\tNetwork Adapter: Hyper-V Virtual Ethernet Adapter\r\n\tInterface GUID: {2783d75c-7782-425b-bb72-3692e7684716}"
}

Event ID 15502: The profile was applied on the network adapter.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The profile was applied on the network adapter.

Message #

The profile was applied on the network adapter.

	Network Adapter: %2
	Interface GUID: %1
	Profile Type: %3
	Profile Content: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ProfileType` UInt32
`ProfileContent` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15502,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:58.4233429+00:00",
    "event_record_id": 13,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 7516
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{8a1760b6-dc99-4b90-9c4a-029698e5ae27}",
    "InterfaceDescription": "Red Hat VirtIO Ethernet Adapter",
    "ProfileType": "0",
    "ProfileContent": "\n\tAutoConfig Version: 1\n\t802.1x: Enabled\n\t802.1x: Not Enforced\n\tEAP type: Microsoft: Protected EAP (PEAP)\n\t802.1X auth credential: Not specified\n\tCache user information: Yes"
  },
  "message": "The profile was applied on the network adapter.\r\n\r\n\tNetwork Adapter: Red Hat VirtIO Ethernet Adapter\r\n\tInterface GUID: {8a1760b6-dc99-4b90-9c4a-029698e5ae27}\r\n\tProfile Type: Interface\r\n\tProfile Content: \n\tAutoConfig Version: 1\n\t802.1x: Enabled\n\t802.1x: Not Enforced\n\tEAP type: Microsoft: Protected EAP (PEAP)\n\t802.1X auth credential: Not specified\n\tCache user information: Yes"
}

Event ID 15503: Wired 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

Wired 802.1X Authentication was started.

Message #

Wired 802.1X Authentication was started.

	Network Adapter: %2
	Interface GUID: %1
	Connection ID: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionID` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15503,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:58.5921083+00:00",
    "event_record_id": 15,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 2172
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{8a1760b6-dc99-4b90-9c4a-029698e5ae27}",
    "InterfaceDescription": "Red Hat VirtIO Ethernet Adapter",
    "ConnectionID": "0x1"
  },
  "message": "Wired 802.1X Authentication was started.\r\n\r\n\tNetwork Adapter: Red Hat VirtIO Ethernet Adapter\r\n\tInterface GUID: {8a1760b6-dc99-4b90-9c4a-029698e5ae27}\r\n\tConnection ID: 0x1"
}

Event ID 15504: Wired 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

Wired 802.1X Authentication was restarted.

Message #

Wired 802.1X Authentication was restarted.

	Network Adapter: %2
	Interface GUID: %1
	Connection ID: %3
	Restart Reason: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionID` Pointer
`RestartReason` UnicodeString

Event ID 15505: Wired 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

Wired 802.1X Authentication succeeded.

Message #

Wired 802.1X Authentication succeeded.

	Network Adapter: %2
	Interface GUID: %1
	Peer Address: %3
	Local Address: %4
	Connection ID: %5
	Identity: %6
	User: %7
	Domain: %8
	Reason: %9
	Reason Text: %10
	Error Code: %11

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`SwitchMAC` UnicodeString
`LocalMAC` UnicodeString
`ConnectionID` Pointer
`Identity` UnicodeString
`User` UnicodeString
`Domain` UnicodeString
`ReasonCode` HexInt32
`ReasonText` UnicodeString
`ErrorCode` HexInt32
`ExplicitCredentials` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15505,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:03:13.6479041+00:00",
    "event_record_id": 16,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 3076
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{8a1760b6-dc99-4b90-9c4a-029698e5ae27}",
    "InterfaceDescription": "Red Hat VirtIO Ethernet Adapter",
    "SwitchMAC": "000000000000",
    "LocalMAC": "BC24119A4DC2",
    "ConnectionID": "0x1",
    "Identity": "-",
    "User": "-",
    "Domain": "-",
    "ReasonCode": "0x70003",
    "ReasonText": "The network does not support authentication",
    "ErrorCode": "0x0",
    "ExplicitCredentials": "false"
  },
  "message": "Wired 802.1X Authentication succeeded.\r\n\r\n\tNetwork Adapter: Red Hat VirtIO Ethernet Adapter\r\n\tInterface GUID: {8a1760b6-dc99-4b90-9c4a-029698e5ae27}\r\n\tPeer Address: 000000000000\r\n\tLocal Address: BC24119A4DC2\r\n\tConnection ID: 0x1\r\n\tIdentity: -\r\n\tUser: -\r\n\tDomain: -\r\n\tReason: 0x70003\r\n\tReason Text: The network does not support authentication\r\n\tError Code: 0x0"
}

Event ID 15506: Network authentication attempts have been temporarily suspended on this network adapter.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

Network authentication attempts have been temporarily suspended on this network adapter.

Message #

Network authentication attempts have been temporarily suspended on this network adapter.

	Network Adapter: %2
	Interface GUID: %1
	Reason Code: %3
	Length of block timer (seconds): %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ReasonCode` UnicodeString
`BlockingTime` UInt32

Event ID 15507: Network authentication attempts have been resumed on this network adapter.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

Network authentication attempts have been resumed on this network adapter.

Message #

Network authentication attempts have been resumed on this network adapter.

	Network Adapter: %2
	Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 15508: There has been an NDIS Port state change on this network adapter.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

There has been an NDIS Port state change on this network adapter.

Message #

There has been an NDIS Port state change on this network adapter.

	Network Adapter: %2
	Interface GUID: %1
	NDIS Control State: %3
	NDIS Auth State: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`NdisPortControlState` UInt32
`NdisPortAuthState` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15508,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:58.5005777+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 7516
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "{8a1760b6-dc99-4b90-9c4a-029698e5ae27}",
    "InterfaceDescription": "Red Hat VirtIO Ethernet Adapter",
    "NdisPortControlState": "1",
    "NdisPortAuthState": "1"
  },
  "message": "There has been an NDIS Port state change on this network adapter.\r\n\r\n\tNetwork Adapter: Red Hat VirtIO Ethernet Adapter\r\n\tInterface GUID: {8a1760b6-dc99-4b90-9c4a-029698e5ae27}\r\n\tNDIS Control State: UnControlled\r\n\tNDIS Auth State: UnAuthorized"
}

Event ID 15509: The operational state on the network adapter was identified.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

The operational state on the network adapter was identified.

Message #

The operational state on the network adapter was identified.

	Network Adapter: %2
	Interface GUID: %1
	Service State: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`AdapterState` UInt32

Event ID 15510: A network adapter was added to the system.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

A network adapter was added to the system.

Message #

A network adapter was added to the system.

	Network Adapter: %2
	Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` UnicodeString
`InterfaceDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15510,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:20:02.8672198+00:00",
    "event_record_id": 27,
    "correlation": {},
    "execution": {
      "process_id": 3516,
      "thread_id": 4192
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "\\DEVICE\\{2783D75C-7782-425B-BB72-3692E7684716}",
    "InterfaceDescription": "Hyper-V Virtual Ethernet Adapter"
  },
  "message": "A network adapter was added to the system.\r\n\r\n\tNetwork Adapter: Hyper-V Virtual Ethernet Adapter\r\n\tInterface GUID: \\DEVICE\\{2783D75C-7782-425B-BB72-3692E7684716}"
}

Event ID 15511: The Wired AutoConfig service entered the running state.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The Wired AutoConfig service entered the running state.

Message #

The Wired AutoConfig service entered the running state.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15511,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:58.1430439+00:00",
    "event_record_id": 12,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 7516
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Wired AutoConfig service entered the running state."
}

Event ID 15512: The Wired AutoConfig service entered the stopped state.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The Wired AutoConfig service entered the stopped state.

Message #

The Wired AutoConfig service entered the stopped state.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15512,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:57.8622106+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 7736,
      "thread_id": 2712
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Wired AutoConfig service entered the stopped state."
}

Event ID 15513: A network adapter was removed from the system.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

A network adapter was removed from the system.

Message #

A network adapter was removed from the system.

	Network Adapter: %2
	Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` UnicodeString
`InterfaceDescription` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15513,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:20:37.7357670+00:00",
    "event_record_id": 34,
    "correlation": {},
    "execution": {
      "process_id": 3516,
      "thread_id": 7140
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "InterfaceGuid": "",
    "InterfaceDescription": "Hyper-V Virtual Ethernet Adapter"
  },
  "message": "A network adapter was removed from the system.\r\n\r\n\tNetwork Adapter: Hyper-V Virtual Ethernet Adapter\r\n\tInterface GUID: "
}

Event ID 15514: Wired 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational

Description

Wired 802.1X Authentication failed.

Message #

Wired 802.1X Authentication failed.

	Network Adapter: %2
	Interface GUID: %1
	Peer Address: %3
	Local Address: %4
	Connection ID: %5
	Identity: %6
	User: %7
	Domain: %8
	Reason: %9
	Reason Text: %10
	Error Code: %11

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`SwitchMAC` UnicodeString
`LocalMAC` UnicodeString
`ConnectionID` Pointer
`Identity` UnicodeString
`User` UnicodeString
`Domain` UnicodeString
`ReasonCode` HexInt32
`ReasonText` UnicodeString
`ErrorCode` HexInt32
`ExplicitCredentials` Boolean

Event ID 15515: The Wired AutoConfig service is starting.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The Wired AutoConfig service is starting.

Message #

The Wired AutoConfig service is starting.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15515,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:58.0782018+00:00",
    "event_record_id": 11,
    "correlation": {},
    "execution": {
      "process_id": 7912,
      "thread_id": 7516
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Wired AutoConfig service is starting."
}

Event ID 15516: The Wired AutoConfig service is stopping.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Operational
Level: Informational

Description

The Wired AutoConfig service is stopping.

Message #

The Wired AutoConfig service is stopping.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wired-AutoConfig",
    "guid": "{B92CF7FD-DC10-4C6B-A72D-1613BF25E597}",
    "event_source_name": "",
    "event_id": 15516,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T04:02:57.7380731+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 7736,
      "thread_id": 2712
    },
    "channel": "Microsoft-Windows-Wired-AutoConfig/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Wired AutoConfig service is stopping."
}

Event ID 20001: No interactive console session to send UI request

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

No interactive console session to send UI request.

Message #

No interactive console session to send UI request

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20002: ACM: IntfCompleteTimely failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

ACM: IntfCompleteTimely failed, error ErrorCode.

Message #

ACM: IntfCompleteTimely failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20003: There are no available connections

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

There are no available connections.

Message #

There are no available connections

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20004: MSM failed to initialize the interface, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

MSM failed to initialize the interface, error ErrorCode.

Message #

MSM failed to initialize the interface, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20005: Failed to load profile, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Failed to load profile, error ErrorCode.

Message #

Failed to load profile, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20006: No profile found in db, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

No profile found in db, error ErrorCode.

Message #

No profile found in db, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20007: ACM: UI request could not be sent.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

ACM: UI request could not be sent.

Message #

ACM: UI request could not be sent.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20008: IntfCompletePlap failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

IntfCompletePlap failed, error ErrorCode.

Message #

IntfCompletePlap failed, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20009: Interface does not have any available networks

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Interface does not have any available networks.

Message #

Interface does not have any available networks

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20010: Invalid state of the adapter ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Invalid state of the adapter ErrorCode.

Message #

Invalid state of the adapter %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20011: Media is disconnected, SSO can't be done

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Media is disconnected, SSO can't be done.

Message #

Media is disconnected, SSO can't be done

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20012: Failed to make the PLAP runtime state , error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Failed to make the PLAP runtime state , error ErrorCode.

Message #

Failed to make the PLAP runtime state , error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20013: Failed to make the timely runtime state , error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Failed to make the timely runtime state , error ErrorCode.

Message #

Failed to make the timely runtime state , error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20014: Interface does not have a profile

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Interface does not have a profile.

Message #

Interface does not have a profile

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20015: OneXSetEapUserData failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

OneXSetEapUserData failed, error ErrorCode.

Message #

OneXSetEapUserData failed, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20016: AcmQueryUserDataProperties failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

AcmQueryUserDataProperties failed, error ErrorCode.

Message #

AcmQueryUserDataProperties failed, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20017: Dot3AcmQueryUserDataByGuid failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Dot3AcmQueryUserDataByGuid failed, error ErrorCode.

Message #

Dot3AcmQueryUserDataByGuid failed, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20018: DsRoleGetPrimaryDomainInformation failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

DsRoleGetPrimaryDomainInformation failed, error ErrorCode.

Message #

DsRoleGetPrimaryDomainInformation failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20019: Adapter is connected , we have a valid IP

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Adapter is connected , we have a valid IP.

Message #

Adapter is connected , we have a valid IP

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20020: Don't have time to wait for DC connectivity.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Don't have time to wait for DC connectivity. Returning now.

Message #

Don't have time to wait for DC connectivity. Returning now

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20021: Waiting for DC connectivity

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Waiting for DC connectivity.

Message #

Waiting for DC connectivity

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20022: Wait for ip address change successfully completed

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for ip address change successfully completed.

Message #

Wait for ip address change successfully completed

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20024: Wait for ip address change timed out

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for ip address change timed out.

Message #

Wait for ip address change timed out

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20025: Wait for ip address change failed with error (Error).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for ip address change failed with error (Error).

Message #

Wait for ip address change failed with error (%1)

Fields #

Name	Description
`Error` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 20026: Waiting for ip address change notification

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Waiting for ip address change notification.

Message #

Waiting for ip address change notification

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20028: Wait for 1x completion successfully completed

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for 1x completion successfully completed.

Message #

Wait for 1x completion successfully completed

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20029: Adapter not connected.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Adapter not connected. Returning now.

Message #

Adapter not connected. Returning now.

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20030: 1x completed with a failure Error.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

1x completed with a failure Error.

Message #

1x completed with a failure %1

Fields #

Name	Description
`Error` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 20031: Wait for 1x completion failed with return code (Error).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for 1x completion failed with return code (Error).

Message #

Wait for 1x completion failed with return code (%1)

Fields #

Name	Description
`Error` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 20032: Wait for 1x completion timed out

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Wait for 1x completion timed out.

Message #

Wait for 1x completion timed out

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20033: IntfDoTimely took longer than our timeout allows.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

IntfDoTimely took longer than our timeout allows. Returning now.

Message #

IntfDoTimely took longer than our timeout allows. Returning now

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20034: IntfDoTimely completed successfully

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

IntfDoTimely completed successfully.

Message #

IntfDoTimely completed successfully

Fields #

Name	Description
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 20035: IntfDoTimely failed, error Error.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

IntfDoTimely failed, error Error.

Message #

IntfDoTimely failed, error %1

Fields #

Name	Description
`Error` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 20036: No TIMELY profiles were found.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

No TIMELY profiles were found. Completing the timely processing.

Message #

No TIMELY profiles were found. Completing the timely processing

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 20037: Timely1x - Interface InterfaceGuid, profile Start - Start Stop, Stop Duration.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

Timely1x - Interface InterfaceGuid, profile Start - Start Stop, Stop Duration.

Message #

Timely1x - Interface %1, profile %3 - Start %4, Stop %5

Fields #

Name	Description
`InterfaceGuid` GUID
`Profile` UnicodeString
`Start` UInt32
`Stop` UInt32
`Duration` UInt32

Event ID 20038: FindTimelyIntfAndProfile failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: AutoConf

Description

FindTimelyIntfAndProfile failed, error ErrorCode.

Message #

FindTimelyIntfAndProfile failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21001: DeviceLayerOpenHandle failed, Error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

DeviceLayerOpenHandle failed, Error ErrorCode.

Message #

DeviceLayerOpenHandle failed, Error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceContext` Pointer

Event ID 21002: DeviceLayerQueryOID failed ErrorCode, OID Context.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

DeviceLayerQueryOID failed ErrorCode, OID Context.

Message #

DeviceLayerQueryOID failed %1, OID %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceContext` Pointer

Event ID 21003: DeviceLayerSetOID failed ErrorCode, OID Context.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

DeviceLayerSetOID failed ErrorCode, OID Context.

Message #

DeviceLayerSetOID failed %1, OID %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceContext` Pointer

Event ID 21004: DeviceLayerSendPacket failed, ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

DeviceLayerSendPacket failed, ErrorCode.

Message #

DeviceLayerSendPacket failed, %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceContext` Pointer

Event ID 21005: DeviceLayerReceivePacket failed, ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

DeviceLayerReceivePacket failed, ErrorCode.

Message #

DeviceLayerReceivePacket failed, %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceContext` Pointer

Event ID 21006: Packet only Size bytes, skipped.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

Packet only Size bytes, skipped.

Message #

Packet only %4 bytes, skipped

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer
`Size` UInt32

Event ID 21007: Invalid packet type Type, skipped.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

Invalid packet type Type, skipped.

Message #

Invalid packet type %4, skipped

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer
`Type` UInt32

Event ID 21008: The read request was cancelled

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

The read request was cancelled.

Message #

The read request was cancelled

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer

Event ID 21009: Receiving data error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

Receiving data error ErrorCode.

Message #

Receiving data error %1

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer

Event ID 21010: Packet skipped, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

Packet skipped, error ErrorCode.

Message #

Packet skipped, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer

Event ID 21011: Send data failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: DeviceLayer

Description

Send data failed, error ErrorCode.

Message #

Send data failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`InterfaceContext` Pointer
`PacketContext` Pointer

Event ID 21012: Interface(InterfaceGuid): pAcmConnectionProgress failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmConnectionProgress failed ErrorCode.

Message #

Interface(%4): pAcmConnectionProgress failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21013: Interface(InterfaceGuid): pAcmQueryUserData failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmQueryUserData failed ErrorCode.

Message #

Interface(%4): pAcmQueryUserData failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21014: Interface(InterfaceGuid): pAcmSetMsmProfile failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmSetMsmProfile failed ErrorCode.

Message #

Interface(%4): pAcmSetMsmProfile failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21015: Interface(InterfaceGuid): pAcmSetUserData failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmSetUserData failed ErrorCode.

Message #

Interface(%4): pAcmSetUserData failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21016: Interface(InterfaceGuid): pAcmMsmNotify failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmMsmNotify failed ErrorCode.

Message #

Interface(%4): pAcmMsmNotify failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21017: Interface(InterfaceGuid): pAcmMediaChange failed, error ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmMediaChange failed, error ErrorCode.

Message #

Interface(%4): pAcmMediaChange failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21018: Interface(InterfaceGuid): pAcmUIRequest failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmUIRequest failed ErrorCode.

Message #

Interface(%4): pAcmUIRequest failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21019: Interface(InterfaceGuid): pAcmConnectionCompletionRoutine failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): pAcmConnectionCompletionRoutine failed ErrorCode.

Message #

Interface(%4): pAcmConnectionCompletionRoutine failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21020: Interface(InterfaceGuid): State Transition OldState --> NewState.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): State Transition OldState --> NewState.

Message #

Interface(%1): State Transition %3 --> %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`OldState` UInt32
`NewState` UInt32

Event ID 21021: Interface(InterfaceGuid): Received AuthNotStarted result from 1x.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Received AuthNotStarted result from 1x.

Message #

Interface(%4): Received AuthNotStarted result from 1x

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21022: Interface(InterfaceGuid): Received AuthInvalid result from 1x.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Received AuthInvalid result from 1x.

Message #

Interface(%4): Received AuthInvalid result from 1x

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21023: Interface(InterfaceGuid): Start processing event: (EventId).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Start processing event: (EventId).

Message #

Interface(%1): Start processing event: (%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`EventId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 21024: Interface(InterfaceGuid): Completed processing event: (EventId).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Completed processing event: (EventId).

Message #

Interface(%1): Completed processing event: (%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`EventId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 21025: Interface(InterfaceGuid): StartOneXAuth failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): StartOneXAuth failed ErrorCode.

Message #

Interface(%4): StartOneXAuth failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21026: Interface(InterfaceGuid): SendOneXPacket failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): SendOneXPacket failed ErrorCode.

Message #

Interface(%4): SendOneXPacket failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21027: Interface(InterfaceGuid): TIMING OUT 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): TIMING OUT 802.1x Authentication.

Message #

Interface(%4): TIMING OUT 802.1x Authentication

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21028: Interface(InterfaceGuid): NOT TIMING OUT 802.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): NOT TIMING OUT 802.1x authentication, next timer in Context msec.

Message #

Interface(%4): NOT TIMING OUT 802.1x authentication, next timer in %3 msec

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21029: Interface(InterfaceGuid): DeviceLayerGetCurrentMediaState failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): DeviceLayerGetCurrentMediaState failed ErrorCode.

Message #

Interface(%4): DeviceLayerGetCurrentMediaState failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21030: No 1X port exists.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

No 1X port exists. Ignoring the packet received.

Message #

No 1X port exists. Ignoring the packet received

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21031: Interface(InterfaceGuid): Set the SWITCH MAC address to InterfaceDescription.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Set the SWITCH MAC address to InterfaceDescription.

Message #

Interface(%1): Set the SWITCH MAC address to %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`MACAddr` Binary

Event ID 21032: Interface(InterfaceGuid): OpenDeviceHandle failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): OpenDeviceHandle failed ErrorCode.

Message #

Interface(%4): OpenDeviceHandle failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21033: Interface(InterfaceGuid): Start processing event (EventId).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Start processing event (EventId).

Message #

Interface(%1): Start processing event (%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`EventId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 21034: Interface(InterfaceGuid): ProcessDot3MsmEvent: Dot3MsmPerformStateMachineProcessing FAILed (Status), Event=EventId.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): ProcessDot3MsmEvent: Dot3MsmPerformStateMachineProcessing FAILed (Status), Event=EventId.

Message #

Interface(%1): ProcessDot3MsmEvent:  Dot3MsmPerformStateMachineProcessing FAILed (%4), Event=%3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`EventId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 21035: Interface(InterfaceGuid): Completed processing event (EventId).

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Completed processing event (EventId).

Message #

Interface(%1): Completed processing event (%3)

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`EventId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 21036: Finished initializing a new interface with id = InterfaceGuid and friendly name = InterfaceDescription.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Finished initializing a new interface with id = InterfaceGuid and friendly name = InterfaceDescription.

Message #

Finished initializing a new interface with id = %1 and friendly name = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Location` UInt32
`Context` UInt32

Event ID 21037: Dot3MsmInit failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Dot3MsmInit failed ErrorCode.

Message #

Dot3MsmInit failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21038: Dot3MSMInitAdapter failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Dot3MSMInitAdapter failed ErrorCode.

Message #

Dot3MSMInitAdapter failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21039: Failed to parse original request ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Failed to parse original request ErrorCode.

Message #

Failed to parse original request %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21040: Failed to parse UI Response ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Failed to parse UI Response ErrorCode.

Message #

Failed to parse UI Response %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21041: Interface(InterfaceGuid): OneXUIResponse failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): OneXUIResponse failed ErrorCode.

Message #

Interface(%4): OneXUIResponse failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21042: Interface(InterfaceGuid): Dot3MsmQueryPendingUIRequest failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

Interface(InterfaceGuid): Dot3MsmQueryPendingUIRequest failed ErrorCode.

Message #

Interface(%4): Dot3MsmQueryPendingUIRequest failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 21043: OneXValidateProfile failed ErrorCode.

Provider: Microsoft-Windows-Wired-AutoConfig
Channel: Diagnostic
Task: MSM

Description

OneXValidateProfile failed ErrorCode.

Message #

OneXValidateProfile failed %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b92cf7fd-dc10-4c6b-a72d-1613bf25e597

Defined in dot3svc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)