Microsoft-Windows-WLAN-AutoConfig

255 events across 3 channels

Event	Title	Channel	Sample
4000	WLAN AutoConfig service has successfully started.	System	N
4001	WLAN AutoConfig service has successfully stopped.	System	N
4002	WLAN AutoConfig service has failed to start.	System	N
4003	WLAN AutoConfig detected limited connectivity, attempting automatic recovery.	System	N
8000	WLAN AutoConfig service started a connection to a wireless network.	Operational	N
8001	WLAN AutoConfig service has successfully connected to a wireless network.	Operational	N
8002	WLAN AutoConfig service failed to connect to a wireless network.	Operational	N
8003	WLAN AutoConfig service has successfully disconnected from a wireless network.	Operational	N
8004	Wireless network is blocked due to connection failure.	Operational	N
8005	WLAN AutoConfig service has begun starting the hosted network.	Operational	N
8006	WLAN AutoConfig service has finished starting the hosted network.	Operational	N
8007	WLAN AutoConfig service has failed to start the hosted network.	Operational	N
8008	AutoConfig service has begun to stop the hosted network.	Operational	N
8009	WLAN AutoConfig service has finished stopping the hosted network.	Operational	N
8010	WLAN AutoConfig service has failed to stop the hosted network.	Operational	N
8011	Connect to last good network.	Operational	N
8012	NLO discovery Network Adapter: Interface GUID: InterfaceGuid …	Operational	N
10000	WLAN Extensibility Module has failed to start.	System	N
10001	WLAN Extensibility Module has successfully started.	System	N
10002	WLAN Extensibility Module has stopped.	System	N
10003	WLAN Extensibility Module has stopped unexpectedly.	System	N
10004	WLAN Extensibility Module has timed out.	System	N
11000	Wireless network association started.	Operational	N
11001	Wireless network association succeeded.	Operational	N
11002	Wireless network association failed.	Operational	N
11003	Wireless security started.	Operational	N
11004	Wireless security stopped.	Operational	N
11005	Wireless security succeeded.	Operational	N
11006	Wireless security failed.	Operational	N
11007	Wireless IHV security started.	Operational	N
11008	Wireless IHV security succeeded.	Operational	N
11009	Wireless IHV security failed.	Operational	N
11010	Wireless security started.	Operational	N
12011	Wireless 802.	Operational	N
12012	Wireless 802.	Operational	N
12013	Wireless 802.	Operational	N
12014	Wireless 802.	Operational	N
13001	A pre-logon connection was not attempted.	Operational	N
13002	A pre-logon connection was attempted.	Operational	N
13011	A post-logon connection was not attempted.	Operational	N
13012	A post-logon connection was attempted.	Operational	N
13013	The post-logon connection attempt is complete.	Operational	N
13014	A post-logon connection was attempted.	Operational	N
13100	CostSource Cost is changed to CostValue for profile ProfileName on interface …	Operational	N
13101	Group Policy Cost is changed to CostValue.	Operational	N
13102	CostSource Cost is cleared for profile ProfileName on interface InterfaceGuid.	Operational	N
13103	Group Policy Cost is cleared	Operational	N
14000	Media notification received.	Diagnostic	N
14001	Peer notification received.	Diagnostic	N
14002	Enable AutoConfig.	Diagnostic	N
14003	Set media streaming mode.	Diagnostic	N
14004	Set BSS type.	Diagnostic	N
14005	Set radio state.	Diagnostic	N
14006	Start auto config.	Diagnostic	N
14007	Stop auto config.	Diagnostic	N
14008	Power setting = PowerSetting.	Diagnostic	N
14009	Change session to ConnectionId.	Diagnostic	N
14010	Radio is off.	Diagnostic	N
14011	Change radio state for interface = InterfaceDescription : PHY = PHY, software …	Diagnostic	N
14012	The connection is not healthy.	Diagnostic	N
14013	Profile Profile is updated.	Diagnostic	N
14014	ConnectionResetReason, need to disconnect.	Diagnostic	N
14015	Set current operation mode.	Diagnostic	N
14016	Got connection request, mode = ConnectionMode, flags = Flags, profile name = …	Diagnostic	N
14017	Connection cancelled by user.	Diagnostic	N
14018	Connection failed.	Diagnostic	N
14019	Stop all connection attempts for interface InterfaceDescription.	Diagnostic	N
14020	Connection succeeded on interface InterfaceDescription.	Diagnostic	N
14021	Connection complete on interface InterfaceDescription, session = ConnectionId, …	Diagnostic	N
14022	Got disconnect request.	Diagnostic	N
14023	Set profile Profile to manual temporarily.	Diagnostic	N
14024	Disconnecting.	Diagnostic	N
14025	Interface InterfaceDescription state is set to State.	Diagnostic	N
14026	UI request for interface InterfaceDescription result = Result.	Diagnostic	N
14027	Profile Profile HealthCheckResult.	Diagnostic	N
14028	Profile name change.	Diagnostic	N
14029	Interface InterfaceGuid (InterfaceDescription) is successfully initialized.	Diagnostic	N
14030	The current operation mode for interface InterfaceDescription is OpMode.	Diagnostic	N
14031	Interface InterfaceGuid type = Type.	Diagnostic	N
14032	Interface InterfaceGuid cannot be queried, error ErrorCode.	Diagnostic	N
14033	Failed to query physical medium for interface InterfaceGuid, because the device …	Diagnostic	N
14034	Found name FriendlyName for interface DeviceGuid.	Diagnostic	N
14035	Network SSID is not permitted.	Diagnostic	N
14036	Power setting = Setting.	Diagnostic	N
14037	Disconnect the temporary connection Profile for interface InterfaceDescription, …	Diagnostic	N
14038	Clear runtime state because the user who initiated the manual connection logged …	Diagnostic	N
14039	WTS session change.	Diagnostic	N
14040	Scan for networks.	Diagnostic	N
14041	Scan request is ignored because radio is off.	Diagnostic	N
14042	Scan results are not queried because raido is off.	Diagnostic	N
14043	The scan state machine is stopped.	Diagnostic	N
14044	No auto switch for the current connection (Profile).	Diagnostic	N
14045	Connection (auto = Auto) to SSID (multiple=Multiple) using profile ProfileName.	Diagnostic	N
14046	The session id=ConnectionId, active=Active, console=Console is added.	Diagnostic	N
14047	The state of session id=ConnectionId is refreshed to active=Active, …	Diagnostic	N
14048	Active Console User state = ActiveConsole.	Diagnostic	N
14049	The session id=ConnectionId is removed.	Diagnostic	N
14050	Discovery module has taken care of the UI request.	Diagnostic	N
14051	UI request not sent because the network is suppressed and the UI request is …	Diagnostic	N
14052	IntfCompleteTimely failed, error ErrorCode.	Diagnostic	N
14053	Session ConnectionId, Network suppressed status for Network is Suppressed.	Diagnostic	N
14054	Enable AutoConfig background scan.	Diagnostic	N
14055	Discard this round of background scan because a connection process is in …	Diagnostic	N
14056	Discard this round of background scan because the current connection does not …	Diagnostic	N
14057	Discard this round of background scan because the current connection is the most …	Diagnostic	N
14058	Connect to SSID with profile ProfileName.	Diagnostic	N
14059	Set operational state.	Diagnostic	N
14060	Profile State changed.	Diagnostic	N
14061	Profile State changed.	Diagnostic	N
14062	RpcCall WlanRpcCallType from client ClientProcessId.	Diagnostic	N
14063	SetAutoConfigParameterRpcCall for OpCode from process ClientProcessId.	Diagnostic	N
14064	SetInterfaceRpcCall for OpCode from process ClientProcessId.	Diagnostic	N
14065	PrivateSetInterfaceRpcCall for OpCode from process ClientProcessId on Interface …	Diagnostic	N
14066	InternalPrivateQuerySetInterfaceCall for OpCode on Interface InterfaceGuid.	Diagnostic	N
14067	Screen Power State changed.	Diagnostic	N
14068	Low Power State changed.	Diagnostic	N
14069	Adding WLAN Interface InterfaceGuid for InterfaceDescription.	Diagnostic	N
14070	Removing WLAN Interface Interface InterfaceGuid.	Diagnostic	N
14071	Expedited scan triggered on InterfaceGuid because ExpeditedScanTrigger.	Diagnostic	N
14072	Disconnect triggered on InterfaceGuid Reason: DisconnectTrigger.	Diagnostic	N
14073	Limited Connectivity Recovery Type: RecoveryType Event: EventType Data: …	Diagnostic	N
14074	Gateway Reachability State changed.	Diagnostic	N
14075	Update allowed connectivity token - AutoConnect=[Enabled: IsAutoConnectEnabled, …	Diagnostic	N
14076	Connectivity token update - AutoConnect=[Enabled: IsAutoConnectEnabled], …	Diagnostic	N
20000	Begin Connect API	Diagnostic	N
20001	Begin Disconnect API	Diagnostic	N
20002	Calling MSMSecPerformPreAssociateSecurity	Diagnostic	N
20003	Calling MSMSecStopSecurity	Diagnostic	N
20004	Connect completion reason Reason, session Session, adhoc formed AdHocFormed.	Diagnostic	N
20005	Received CONNECT COMPLETION, status Status, assocStatus AssocStatus.	Diagnostic	N
20006	FSM Current state CurrState, event EventId.	Diagnostic	N
20007	FSM Transition from State: CurrState to State: NewState.	Diagnostic	N
20008	Phy Type not compatible	Diagnostic	N
20009	Link Quality: Quality.	Diagnostic	N
20010	Received IHV PORT DOWN, peer BSSID.	Diagnostic	N
20011	Received IHV PORT UP, peer BSSID.	Diagnostic	N
20012	Post Connect Security has Completed Successfully	Diagnostic	N
20013	Post Connect Security has FAILED with reason code: ErrorCode.	Diagnostic	N
20014	Received Security Packet: PacketType.	Diagnostic	N
20015	Security PreConnect Completion, security reason: Reason, error Error.	Diagnostic	N
20016	Send Security Packet Length = Length and Completion Handle = Handle.	Diagnostic	N
20017	Send Security Packet Length = Length and Completion Handle = Handle.	Diagnostic	N
20018	SSID = SSID BSSIDCount = BSSIDCount.	Diagnostic	N
20019	A client has associated with the hosted network.	Operational	N
20020	A client has successfully authenticated with the hosted network.	Operational	N
20021	A client has failed to authenticate with the hosted network.	Operational	N
20022	Begin Scan	Diagnostic	N
20023	Scan completion Status Status.	Diagnostic	N
20024	Number of Unique Wlan Networks Count.	Diagnostic	N
20025	Visible Network: Ssid, BssidCount BSSIDS, AuthAlgoId/CipherAlgoId, Rssi RSSI.	Diagnostic	N
21001	Adapter(InterfaceGuid) New Adapter FriendlyName (PKMIDs).	Diagnostic	N
21002	Adapter(InterfaceGuid) IntfSecState Transition OldState --> NewState.	Diagnostic	N
21003	Adapter(InterfaceGuid) Received StopSecurity.	Diagnostic	N
21004	Pre-Associate Failure Auth AuthAlgoId, Cipher CipherAlgoId, OneX …	Diagnostic	N
21005	Received MSMSec UI Response, but already have key material!	Diagnostic	N
21006	Received UI response ResponseType.	Diagnostic	N
21007	TIMING OUT 802.	Diagnostic	N
21008	NOT TIMING OUT 802.	Diagnostic	N
21009	802.	Diagnostic	N
21010	Port (PortId) Peer PeerAddr AuthMgr Transition OldState --> NewState.	Diagnostic	N
21011	Sending UI response to 802.	Diagnostic	N
21012	KeyExt Transition OldState --> NewState.	Diagnostic	N
21013	Explicit failure from 802.	Diagnostic	N
21014	802.	Diagnostic	N
21015	Port(PortId) Peer PeerAddr KeyMgr transition OldState --> NewState.	Diagnostic	N
21016	Auth sent M1(PortId), self LocalAddr, peer PeerAddr.	Diagnostic	N
21017	Auth sent M3(PortId), self LocalAddr, peer PeerAddr.	Diagnostic	N
21018	Auth sent G1(PortId), self LocalAddr, peer PeerAddr.	Diagnostic	N
21019	Port(PortId) Peer PeerAddr KeyMgrAuth Transition OldState --> NewState.	Diagnostic	N
21020	CONNECTION SECURED by OFFLOADED key exchange	Diagnostic	N
21021	Port(PortId) Notify Key Exchange Status: Authenticator(Authenticator) reason …	Diagnostic	N
21022	Default Key: Idx Index, Algo CipherAlgoId, Direction= Direction, Len Len.	Diagnostic	N
21023	Pairwise Key (Addr): Algo CipherAlgoId, Direction= Direction, Len Len.	Diagnostic	N
21024	Adapter(AdapterId) Connect Completion, Reason Reason, Error Error.	Diagnostic	N
21025	Port(PortId) Indicate Security Result, Peer PeerAddr, Reason Reason Error Error.	Diagnostic	N
21026	Adapter(Context) Tx to PeerAddr, Ethertype EtherType, size Size.	Diagnostic	N
21027	Sending UI request to MSM (SessionId).	Diagnostic	N
21028	Adapter(InterfaceGuid) MSM Connect notification, Network "SSID".	Diagnostic	N
21029	Adapter(InterfaceGuid) MSM Disconnect notification.	Diagnostic	N
21030	Adapter(InterfaceGuid) Port up for peer PeerAddr.	Diagnostic	N
21031	Adapter(InterfaceGuid) Port down for peer PeerAddr.	Diagnostic	N
21032	Adapter(InterfaceGuid) Rx from PeerAddr, Ethertype EtherType, size Size.	Diagnostic	N
21033	Adapter(InterfaceGuid) UI Response, request type RequestType, response type …	Diagnostic	N
21034	Adapter(InterfaceGuid) Create discovery profiles, SSID SSID, BSS type BSSType, …	Diagnostic	N
21035	Tx pkt completion, pkt Context.	Diagnostic	N
21036	Adapter(InterfaceGuid) MSM Redo security request.	Diagnostic	N
21037	Connection health status is AdapterId (InterfaceGuid), HealthyHint Healthy.	Diagnostic	N
21038	Transition network suspected	Diagnostic	N
21039	UI Response - Valid = Valid, Cancelled = Cancelled.	Diagnostic	N
21040	Port(Context) MSMSendPacket failed, Error ErrorCode.	Diagnostic	N
21041	Can't do fast roaming when PMK Cache is not valid	Diagnostic	N
21042	PreAuthMgr Transition OldState --> NewState.	Diagnostic	N
21043	PreAuth: 802.	Diagnostic	N
21044	PreAuth: Explicit failure from 802.	Diagnostic	N
21045	PreAuth: 802.	Diagnostic	N
21046	Received unicast key material in EAPOL-Key (Rapid rekey RapidRekey).	Diagnostic	N
21047	CONNECTION SECURED by RC4 key exchange	Diagnostic	N
21048	CONNECTION SECURED by RSN key exchange	Diagnostic	N
21049	RSN Key Receive: Key Message M1	Diagnostic	N
21050	RSN Key Receive: Key Message M3	Diagnostic	N
21051	RSN Key Receive: Key Message M2	Diagnostic	N
21052	RSN Key Receive: Key Message M4	Diagnostic	N
21053	RSN Key Receive: Key Message G1	Diagnostic	N
21054	RSN Key Receive: Key Message G2	Diagnostic	N
21055	FAST ROAMING is FastRoam.	Diagnostic	N
21056	Unknown transition into Failure, EventType Context.	Diagnostic	N
21057	Port(PortId) Peer PeerAddr SecMgr Transition OldState --> NewState.	Diagnostic	N
21058	CONNECTION SECURED by WPA key exchange	Diagnostic	N
21059	WPA Key Receive: Key Message M1	Diagnostic	N
21060	WPA Key Receive: Key Message M3	Diagnostic	N
21061	WPA Key Receive: Key Message G1	Diagnostic	N
21062	Eapol Key packet cache OVERFLOW	Diagnostic	N
21063	PMK Cache overflowed, current Current, limit Max.	Diagnostic	N
21064	WLAN Security Settings: BSS Type BSSType, Authentication AuthAlgoId, Encryption …	Diagnostic	N
21065	Received multicast key material in EAPOL-Key (Rapid rekey RapidRekey).	Diagnostic	N
21066	Default Key ID set to Index Index.	Diagnostic	N
30000	Connection started 1	Diagnostic	N
30001	Connection timeout threshold reached 1	Diagnostic	N
30002	Connection succeeded	Diagnostic	N
30003	Connection started 2	Diagnostic	N
30004	Connection timeout threshold reached 2	Diagnostic	N
30005	Connection started 3	Diagnostic	N
30006	Connection timeout threshold reached 3	Diagnostic	N
30007	Manual connect initiated, end running reconnect scenarios	Diagnostic	N
30008	Manual connect initiated, end running reconnect scenarios	Diagnostic	N
30009	Manual connect initiated, end running reconnect scenarios	Diagnostic	N
30010	UI interaction requested 1	Diagnostic	N
30011	UI interaction requested 2	Diagnostic	N
30012	UI interaction requested 3	Diagnostic	N
30013	Connection succeeded - Hidden network 1	Diagnostic	N
30014	Connection succeeded - Hidden network 2	Diagnostic	N
30015	Connection succeeded - Hidden network 3	Diagnostic	N
30016	Selection list exhausted 1	Diagnostic	N
30017	Selection list exhausted 2	Diagnostic	N
30018	Selection list exhausted 3	Diagnostic	N
30019	Connection succeeded to previous network - expected roaming	Diagnostic	N
30020	task_0Start30020	Diagnostic	N
30021	task_0Stop30021	Diagnostic	N
30022	task_0Stop30022	Diagnostic	N
30100	Perftrack_WfdDiscoverStart	Diagnostic	N
30101	Perftrack_WfdDiscoverStop	Diagnostic	N
30102	Perftrack_WfdPairStart	Diagnostic	N
30103	Perftrack_WfdPairStop	Diagnostic	N
30104	Cancel WLAN Resume-Reconnect Interface GUID: InterfaceGuid.	Diagnostic	N
30105	task_030105	Diagnostic	N
40001	Connect Diagnostic Information.	Diagnostic	N
40002	Limited Recovery Diagnostic Statistics.	Diagnostic	N
40003	Diagnostic Statistics Difference.	Diagnostic	N
60001	Error: ErrorCode Location: Location Context: Context.	Operational	N
60002	Warning: WarningCode Location: Location Context: Context.	Operational	N
60003	Transitioned to State: NextState Context: Context.	Operational	N
60004	Updated Context: Context Update Reason: UpdateReasonCode.	Operational	N
60101	SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: …	Operational	N
60102	SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: …	Operational	N
60103	Interface Guid: IfGuid IfIndex: IfIndex Interface Luid: IfLuid ReferenceContext: …	Operational	N

Event ID 4000: WLAN AutoConfig service has successfully started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Start

Description

WLAN AutoConfig service has successfully started.

Message #

WLAN AutoConfig service has successfully started.

Event ID 4001: WLAN AutoConfig service has successfully stopped.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Stop

Description

WLAN AutoConfig service has successfully stopped.

Message #

WLAN AutoConfig service has successfully stopped.

Event ID 4002: WLAN AutoConfig service has failed to start.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN AutoConfig service has failed to start.

Message #

WLAN AutoConfig service has failed to start.

Error Code: %1

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 4003: WLAN AutoConfig detected limited connectivity, attempting automatic recovery.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN AutoConfig detected limited connectivity, attempting automatic recovery.

Message #

WLAN AutoConfig detected limited connectivity, attempting automatic recovery.

Recovery Type: %1
Error Code: %2
Trigger Reason: %3
IP Family: %4

Fields #

Name	Description
`Event` UInt32
`ErrorCode` HexInt32
`ChangeReason` UInt32
`IpFamily` UInt32

Event ID 8000: WLAN AutoConfig service started a connection to a wireless network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: AcmConnection
Opcode: Start_24010_189

Description

WLAN AutoConfig service started a connection to a wireless network.

Message #

WLAN AutoConfig service started a connection to a wireless network.

Network Adapter: %2
Interface GUID: %1
Connection Mode: %3
Profile Name: %4
SSID: %5
BSS Type: %6

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionMode` UnicodeString
`ProfileName` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`ConnectionId` Pointer

Event ID 8001: WLAN AutoConfig service has successfully connected to a wireless network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Collection Priority: Recommended (NSA)
Task: AcmConnection
Opcode: Success

Description

WLAN AutoConfig service has successfully connected to a wireless network.

Message #

WLAN AutoConfig service has successfully connected to a wireless network.

Network Adapter: %2
Interface GUID: %1
Connection Mode: %3
Profile Name: %4
SSID: %5
BSS Type: %6
PHY Type: %7
Authentication: %8
Encryption: %9
802.1x Enabled: %10
Hidden: %12

Fields #

Name	Description
`InterfaceGuid` GUID	Interface GUID of the wireless adapter
`InterfaceDescription` UnicodeString	Name of the wireless adapter
`ConnectionMode` UnicodeString	Whether the connection was automatic ("Automatic connection with a profile") or manual ("Connection to a secure network without a profile")
`ProfileName` UnicodeString
`SSID` UnicodeString	SSID of the wireless network that was connected to
`BSSType` UnicodeString
`PHYType` UnicodeString
`AuthenticationAlgorithm` UnicodeString	Security protocol used to connect (e.g. WEP, WPA2-Personal)
`CipherAlgorithm` UnicodeString
`OnexEnabled` UInt32
`ConnectionId` Pointer
`NonBroadcast` Boolean

References #

Windows Forensic Artifacts https://github.com/Psmths/windows-forensic-artifacts/blob/main/network/evtx-8001-wlan-connect.md

Event ID 8002: WLAN AutoConfig service failed to connect to a wireless network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Collection Priority: Recommended (NSA)
Task: AcmConnection
Opcode: Failure

Description

WLAN AutoConfig service failed to connect to a wireless network.

Message #

WLAN AutoConfig service failed to connect to a wireless network.

Network Adapter: %2
Interface GUID: %1
Connection Mode: %3
Profile Name: %4
SSID: %5
BSS Type: %6
Failure Reason:%7
RSSI: %10

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionMode` UnicodeString
`ProfileName` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`FailureReason` UnicodeString	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`ReasonCode` UInt32
`ConnectionId` Pointer
`RSSI` Int32

Event ID 8003: WLAN AutoConfig service has successfully disconnected from a wireless network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Collection Priority: Recommended (NSA)
Task: AcmConnection
Opcode: Disconnect

Description

WLAN AutoConfig service has successfully disconnected from a wireless network.

Message #

WLAN AutoConfig service has successfully disconnected from a wireless network.

Network Adapter: %2
Interface GUID: %1
Connection Mode: %3
Profile Name: %4
SSID: %5
BSS Type: %6
Reason: %7

Fields #

Name	Description
`InterfaceGuid` GUID	Interface GUID of the wireless adapter
`InterfaceDescription` UnicodeString	Name of the wireless adapter
`ConnectionMode` UnicodeString
`ProfileName` UnicodeString
`SSID` UnicodeString	SSID of the wireless network that was disconnected from
`BSSType` UnicodeString
`Reason` UnicodeString	Reason the wireless network was disconnected
`ConnectionId` Pointer
`ReasonCode` UInt32

References #

Windows Forensic Artifacts https://github.com/Psmths/windows-forensic-artifacts/blob/main/network/evtx-8003-wlan-disconnect.md

Event ID 8004: Wireless network is blocked due to connection failure.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Wireless network is blocked due to connection failure.

Message #

Wireless network is blocked due to connection failure.

Network Adapter: %1
Interface GUID: %2
Connection Mode: %5
Profile Name: %4
SSID(s): %3
BSS Type: %6
Failure Reason:%7
Length of block timer (minutes): %8

Fields #

Name	Description
`InterfaceDescription` UnicodeString
`InterfaceGuid` GUID
`SSIDs` UnicodeString
`ProfileName` UnicodeString
`ConnectionMode` UnicodeString
`BSSType` UnicodeString
`FailureReason` UnicodeString	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`BlockTime` UInt32
`ReasonCode` UInt32
`ConnectionId` Pointer

Event ID 8005: WLAN AutoConfig service has begun starting the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Startthedevicenetwork
Opcode: Start

Description

WLAN AutoConfig service has begun starting the hosted network.

Message #

WLAN AutoConfig service has begun starting the hosted network.

Interface GUID: %1
SSID: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`SSID` AnsiString

Event ID 8006: WLAN AutoConfig service has finished starting the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Startthedevicenetwork
Opcode: Stop

Description

WLAN AutoConfig service has finished starting the hosted network.

Message #

WLAN AutoConfig service has finished starting the hosted network.

Interface GUID: %1
SSID: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`SSID` AnsiString

Event ID 8007: WLAN AutoConfig service has failed to start the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Startthedevicenetwork
Opcode: Stop

Description

WLAN AutoConfig service has failed to start the hosted network.

Message #

WLAN AutoConfig service has failed to start the hosted network.

Error Code: %2
Error Message: %3
Interface GUID: %1
SSID: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`ErrorCode` UInt32
`ErrorMsg` UnicodeString
`SSID` AnsiString

Event ID 8008: AutoConfig service has begun to stop the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Stopthedevicenetwork
Opcode: Start

Description

AutoConfig service has begun to stop the hosted network.

Message #

AutoConfig service has begun to stop the hosted network.

Interface GUID: %1
SSID: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`SSID` AnsiString

Event ID 8009: WLAN AutoConfig service has finished stopping the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Stopthedevicenetwork
Opcode: Stop

Description

WLAN AutoConfig service has finished stopping the hosted network.

Message #

WLAN AutoConfig service has finished stopping the hosted network.

Interface GUID: %1
SSID: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`SSID` AnsiString

Event ID 8010: WLAN AutoConfig service has failed to stop the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Stopthedevicenetwork
Opcode: Stop

Description

WLAN AutoConfig service has failed to stop the hosted network.

Message #

WLAN AutoConfig service has failed to stop the hosted network.

Error Code: %2
Error Message: %3
Interface GUID: %1
SSID: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`ErrorCode` UInt32
`ErrorMsg` UnicodeString
`SSID` AnsiString

Event ID 8011: Connect to last good network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: AcmConnection

Description

Connect to last good network.

Message #

Connect to last good network 

Network Adapter: %2
Interface GUID: %1
 Profile Name: %3
SSID: %4
BSS type: %5

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ProfileName` UnicodeString
`SSID` UnicodeString
`BSSType` UInt32

Event ID 8012: NLO discovery Network Adapter: Interface GUID: InterfaceGuid InterfaceDescription.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: AcmConnection

Description

NLO discovery Network Adapter: Interface GUID: InterfaceGuid InterfaceDescription.

Message #

NLO discovery Network Adapter: Interface GUID: %1 %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 10000: WLAN Extensibility Module has failed to start.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN Extensibility Module has failed to start.

Message #

WLAN Extensibility Module has failed to start.

Module Path: %1
Error Code: %2

Fields #

Name	Description
`ExtensibleModulePath` UnicodeString
`ErrorCode` UInt32

Event ID 10001: WLAN Extensibility Module has successfully started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN Extensibility Module has successfully started.

Message #

WLAN Extensibility Module has successfully started.

Module Path: %1

Fields #

Name	Description
`ExtensibleModulePath` UnicodeString

Event ID 10002: WLAN Extensibility Module has stopped.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN Extensibility Module has stopped.

Message #

WLAN Extensibility Module has stopped.

Module Path: %1

Fields #

Name	Description
`ExtensibleModulePath` UnicodeString

Event ID 10003: WLAN Extensibility Module has stopped unexpectedly.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN Extensibility Module has stopped unexpectedly.

Message #

WLAN Extensibility Module has stopped unexpectedly.

Module Path: %1

Fields #

Name	Description
`ExtensibleModulePath` UnicodeString

Event ID 10004: WLAN Extensibility Module has timed out.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: System
Opcode: Info

Description

WLAN Extensibility Module has timed out.

Message #

WLAN Extensibility Module has timed out.

Module Path: %1

Fields #

Name	Description
`ExtensibleModulePath` UnicodeString

Event ID 11000: Wireless network association started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmAssociation
Opcode: Start_24011_193

Description

Wireless network association started.

Message #

Wireless network association started.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Authentication: %6
Encryption: %7
802.1X Enabled: %8

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`Auth` UnicodeString
`Cipher` UnicodeString
`OnexEnabled` UInt32
`IhvConnectivitySetting` UnicodeString
`ConnectionId` Pointer

Event ID 11001: Wireless network association succeeded.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmAssociation
Opcode: Success_24011_194

Description

Wireless network association succeeded.

Message #

Wireless network association succeeded.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Management Frame Protection Enabled: %6

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`ConnectionId` Pointer
`MgmtFrameProtection` Boolean

Event ID 11002: Wireless network association failed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmAssociation
Opcode: Failure_24011_195

Description

Wireless network association failed.

Message #

Wireless network association failed.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Failure Reason: %6
Dot11 Status Code: %8
RSSI: %10

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`FailureReason` UnicodeString	Known values `%%2304` An Error occured during Logon. `%%2305` The specified user account has expired. `%%2306` The NetLogon component is not active. `%%2307` Account locked out. `%%2308` The user has not been granted the requested logon type at this machine. `%%2309` The specified account's password has expired. `%%2310` Account currently disabled. `%%2311` Account logon time restriction violation. `%%2312` User not allowed to logon at this computer. `%%2313` Unknown user name or bad password. `%%2314` Domain sid inconsistent. `%%2315` Smartcard logon is required and was not used.
`ReasonCode` UInt32
`Dot11StatusCode` UInt32
`ConnectionId` Pointer
`RSSI` Int32

Event ID 11003: Wireless security started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmSecurity
Opcode: Start_24012_196

Description

Wireless security started.

Message #

Wireless security started.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Authentication: %6
Encryption: %8
802.1x Enabled: %10

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`Auth` UnicodeString
`AuthVal` UInt32
`Cipher` UnicodeString
`CipherVal` UInt32
`FIPSMode` UInt32
`OnexEnabled` UInt32
`ConnectionId` Pointer

Event ID 11004: Wireless security stopped.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmSecurity
Opcode: Stop_24012_197

Description

Wireless security stopped.

Message #

Wireless security stopped.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Security Hint: %6

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`SecurityHint` UnicodeString
`SecurityHintCode` UInt32
`ConnectionId` Pointer

Event ID 11005: Wireless security succeeded.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmSecurity
Opcode: Success_24012_198

Description

Wireless security succeeded.

Message #

Wireless security succeeded.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`ConnectionId` Pointer

Event ID 11006: Wireless security failed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmSecurity
Opcode: Failure_24012_199

Description

Wireless security failed.

Message #

Wireless security failed.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Peer MAC Address: %6
Reason: %7
Error: %9

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`PeerMac` UnicodeString
`ReasonText` UnicodeString
`ReasonCode` HexInt32
`ErrorCode` HexInt32
`ConnectionId` Pointer

Event ID 11007: Wireless IHV security started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Wireless IHV security started.

Message #

Wireless IHV security started.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`IhvSecuritySetting` UnicodeString
`ConnectionId` Pointer

Event ID 11008: Wireless IHV security succeeded.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: IhvSecurity
Opcode: Success_24013_201

Description

Wireless IHV security succeeded.

Message #

Wireless IHV security succeeded.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`ConnectionId` Pointer

Event ID 11009: Wireless IHV security failed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: IhvSecurity
Opcode: Failure_24013_202

Description

Wireless IHV security failed.

Message #

Wireless IHV security failed.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Peer MAC Address: %6
Reason: %7
Additional Data Length: %8

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`PeerMac` UnicodeString
`IhvReasonCode` HexInt32
`IhvDataLength` UInt32
`IhvData` Binary
`ConnectionId` Pointer

Event ID 11010: Wireless security started.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: MsmSecurity
Opcode: Start_24012_200

Description

Wireless security started.

Message #

Wireless security started.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Authentication: %6
Encryption: %8
FIPS Mode: %10
802.1x Enabled: %11

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`Auth` UnicodeString
`AuthVal` UInt32
`Cipher` UnicodeString
`CipherVal` UInt32
`FIPSMode` UInt32
`OnexEnabled` UInt32
`ConnectionId` Pointer

Event ID 12011: Wireless 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: OneXAuthentication
Opcode: Start_24014_203

Description

Wireless 802.1x authentication started.

Message #

Wireless 802.1x authentication started.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Eap Information: Type %6, Vendor ID %7, Vendor Type %8, Author ID %9

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`EapType` UInt32
`VendorID` UInt32
`VendorType` UInt32
`AuthorID` UInt32
`ConnectionId` Pointer

Event ID 12012: Wireless 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: OneXAuthentication
Opcode: Success_24014_204

Description

Wireless 802.1x authentication succeeded.

Message #

Wireless 802.1x authentication succeeded.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Identity: %6
User: %8
Domain: %8

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`Identity` UnicodeString
`User` UnicodeString
`Domain` UnicodeString
`ConnectionId` Pointer
`ExplicitCredentials` Boolean

Event ID 12013: Wireless 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: OneXAuthentication
Opcode: Failure_24014_205

Description

Wireless 802.1x authentication failed.

Message #

Wireless 802.1x authentication failed.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Peer MAC Address: %6
Identity: %7
User: %8
Domain: %9
Reason: %10
Error: %12
EAP Reason: %13
EAP Root cause String: %14
EAP Error: %15

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`PeerMac` UnicodeString
`Identity` UnicodeString
`User` UnicodeString
`Domain` UnicodeString
`ReasonText` UnicodeString
`ReasonCode` HexInt32
`ErrorCode` HexInt32
`EAPReasonCode` HexInt32
`EAPRootCauseString` UnicodeString
`EAPErrorCode` HexInt32
`ConnectionId` Pointer
`ExplicitCredentials` Boolean

Event ID 12014: Wireless 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: OneXAuthentication
Opcode: Restart

Description

Wireless 802.1x authentication was restarted.

Message #

Wireless 802.1x authentication was restarted.

Network Adapter: %1
Interface GUID: %2
Local MAC Address: %3
Network SSID: %4
BSS Type: %5
Eap Information: Type %6, Vendor ID %7, Vendor Type %8, Author ID %9
Restart Reason: %10

Fields #

Name	Description
`Adapter` UnicodeString
`DeviceGuid` GUID
`LocalMac` UnicodeString
`SSID` UnicodeString
`BSSType` UnicodeString
`EapType` UInt32
`VendorID` UInt32
`VendorType` UInt32
`AuthorID` UInt32
`RestartReason` UnicodeString
`ConnectionId` Pointer

Event ID 13001: A pre-logon connection was not attempted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

A pre-logon connection was not attempted.

Message #

A pre-logon connection was not attempted.

Result: %1
Reason: %2

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32

Event ID 13002: A pre-logon connection was attempted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

A pre-logon connection was attempted.

Message #

A pre-logon connection was attempted.

Result: %1
Interface GUID: %2
Profile Name: %3
Requested Fields: %4

Fields #

Name	Description
`Result` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString
`RequestedFields` UnicodeString

Event ID 13011: A post-logon connection was not attempted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

A post-logon connection was not attempted.

Message #

A post-logon connection was not attempted.

Result: %1
Reason: %2

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32

Event ID 13012: A post-logon connection was attempted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

A post-logon connection was attempted.

Message #

A post-logon connection was attempted.

Result: %1
Interface GUID: %2
Profile Name: %3

Fields #

Name	Description
`Result` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 13013: The post-logon connection attempt is complete.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

The post-logon connection attempt is complete.

Message #

The post-logon connection attempt is complete.

Network connection attempt result: %1
Reason: %2
Interface GUID: %3
Profile Name: %4

Fields #

Name	Description
`Result` UInt32
`Reason` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 13014: A post-logon connection was attempted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

A post-logon connection was attempted.

Message #

A post-logon connection was attempted.

Result: %1
Interface GUID: %2
Profile Name: %3

Fields #

Name	Description
`Result` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 13100: CostSource Cost is changed to CostValue for profile ProfileName on interface InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: ConnectionCost

Description

CostSource Cost is changed to CostValue for profile ProfileName on interface InterfaceGuid.

Message #

%1 Cost is changed to %2 for profile %4 on interface %3

Fields #

Name	Description
`CostSource` UInt32
`CostValue` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 13101: Group Policy Cost is changed to CostValue.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: ConnectionCost

Description

Group Policy Cost is changed to CostValue.

Message #

Group Policy Cost is changed to %1

Fields #

Name	Description
`CostValue` UInt32

Event ID 13102: CostSource Cost is cleared for profile ProfileName on interface InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: ConnectionCost

Description

CostSource Cost is cleared for profile ProfileName on interface InterfaceGuid.

Message #

%1 Cost is cleared for profile %3 on interface %2

Fields #

Name	Description
`CostSource` UInt32
`InterfaceGuid` GUID
`ProfileName` UnicodeString

Event ID 13103: Group Policy Cost is cleared

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: ConnectionCost

Description

Group Policy Cost is cleared.

Message #

Group Policy Cost is cleared

Event ID 14000: Media notification received.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Media notification received. Interface = InterfaceDescription, Connected = Connected.

Message #

Media notification received. Interface = %2, Connected = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Connected` Boolean

Event ID 14001: Peer notification received.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Peer notification received. Interface = InterfaceDescription, Joined = Joined.

Message #

Peer notification received. Interface = %2, Joined = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Joined` Boolean

Event ID 14002: Enable AutoConfig.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Enable AutoConfig. Interface = InterfaceDescription, Enabled = Enabled.

Message #

Enable AutoConfig. Interface = %2, Enabled = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Enabled` Boolean

Event ID 14003: Set media streaming mode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set media streaming mode. Interface = InterfaceDescription, Enable = Enabled, Result = Result.

Message #

Set media streaming mode. Interface = %2, Enable = %3, Result = %4.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Enabled` Boolean
`Result` UInt32

Event ID 14004: Set BSS type.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set BSS type. Interface = InterfaceDescription, BSS type = BSSType.

Message #

Set BSS type. Interface = %2, BSS type = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`BSSType` UInt32

Event ID 14005: Set radio state.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set radio state. Interface = InterfaceDescription, PHY = PHY, State = RadioState, Result = Result.

Message #

Set radio state. Interface = %2, PHY = %3, State = %4, Result = %5.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`PHY` UInt32
`RadioState` UInt32
`Result` UInt32
`PHYCount` UInt32

Event ID 14006: Start auto config.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Start auto config. Interface = InterfaceDescription.

Message #

Start auto config. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14007: Stop auto config.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Stop auto config. Interface = InterfaceDescription.

Message #

Stop auto config. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14008: Power setting = PowerSetting.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Power setting = PowerSetting. Interface = InterfaceDescription.

Message #

Power setting = %3. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`PowerSetting` UInt32

Event ID 14009: Change session to ConnectionId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Change session to ConnectionId. Interface = InterfaceDescription.

Message #

Change session to %3. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionId` Pointer

Event ID 14010: Radio is off.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Radio is off. Interface = InterfaceDescription.

Message #

Radio is off. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14011: Change radio state for interface = InterfaceDescription : PHY = PHY, software state = SoftwareState, hardware state = HardwareState).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Change radio state for interface = InterfaceDescription : PHY = PHY, software state = SoftwareState, hardware state = HardwareState).

Message #

Change radio state for interface = %2 :  PHY = %3, software state = %4, hardware state = %5)

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`PHY` UInt32
`SoftwareState` UInt32
`HardwareState` UInt32
`PHYCount` UInt32

Event ID 14012: The connection is not healthy.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The connection is not healthy. Pending profile update is ignored. Interface = InterfaceDescription.

Message #

The connection is not healthy. Pending profile update is ignored. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14013: Profile Profile is updated.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Profile Profile is updated. Interface = InterfaceDescription.

Message #

Profile %3 is updated. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Profile` UnicodeString

Event ID 14014: ConnectionResetReason, need to disconnect.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

ConnectionResetReason, need to disconnect. Interface = InterfaceDescription.

Message #

%3, need to disconnect. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionResetReason` UInt32

Event ID 14015: Set current operation mode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set current operation mode. Interface = InterfaceDescription, OpMode = OpMode, Result = Result.

Message #

Set current operation mode. Interface = %2, OpMode = %3, Result = %4.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`OpMode` UInt32
`Result` UInt32

Event ID 14016: Got connection request, mode = ConnectionMode, flags = Flags, profile name = Profile, session = ConnectionId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Got connection request, mode = ConnectionMode, flags = Flags, profile name = Profile, session = ConnectionId. Interface = InterfaceDescription.

Message #

Got connection request, mode = %3, flags = %4, profile name = %5, session = %6. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionMode` UInt32
`Flags` UInt32
`Profile` UnicodeString
`ConnectionId` Pointer

Event ID 14017: Connection cancelled by user.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection cancelled by user. Interface = InterfaceDescription.

Message #

Connection cancelled by user. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14018: Connection failed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection failed. Interface = InterfaceDescription, Reason code = ErrorCode.

Message #

Connection failed. Interface = %5, Reason code = %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14019: Stop all connection attempts for interface InterfaceDescription.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Stop all connection attempts for interface InterfaceDescription.

Message #

Stop all connection attempts for interface %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14020: Connection succeeded on interface InterfaceDescription.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection succeeded on interface InterfaceDescription.

Message #

Connection succeeded on interface %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14021: Connection complete on interface InterfaceDescription, session = ConnectionId, status = Status, ad hoc network formed = Adhoc.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection complete on interface InterfaceDescription, session = ConnectionId, status = Status, ad hoc network formed = Adhoc.

Message #

Connection complete on interface %2, session = %3, status = %4, ad hoc network formed = %5

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionId` Pointer
`Status` UInt32	NTSTATUS reference
`Adhoc` Boolean

Event ID 14022: Got disconnect request.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Got disconnect request. Interface = InterfaceDescription.

Message #

Got disconnect request. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14023: Set profile Profile to manual temporarily.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set profile Profile to manual temporarily.

Message #

Set profile %3 to manual temporarily.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Profile` UnicodeString

Event ID 14024: Disconnecting.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Disconnecting. Interface = InterfaceDescription.

Message #

Disconnecting. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14025: Interface InterfaceDescription state is set to State.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Interface InterfaceDescription state is set to State.

Message #

Interface %2 state is set to %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`State` UInt32

Event ID 14026: UI request for interface InterfaceDescription result = Result.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

UI request for interface InterfaceDescription result = Result.

Message #

UI request for interface %2 result = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Result` Boolean

Event ID 14027: Profile Profile HealthCheckResult.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Profile Profile HealthCheckResult.

Message #

Profile %3 %4.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Profile` UnicodeString
`HealthCheckResult` UInt32

Event ID 14028: Profile name change.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Profile name change. Interface = InterfaceDescription, old profile name = OldProfileName, new profile name = NewProfileName.

Message #

Profile name change. Interface = %2, old profile name = %3, new profile name = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`OldProfileName` UnicodeString
`NewProfileName` UnicodeString

Event ID 14029: Interface InterfaceGuid (InterfaceDescription) is successfully initialized.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Interface InterfaceGuid (InterfaceDescription) is successfully initialized.

Message #

Interface %1 (%2) is successfully initialized.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14030: The current operation mode for interface InterfaceDescription is OpMode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The current operation mode for interface InterfaceDescription is OpMode.

Message #

The current operation mode for interface %2 is %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`OpMode` UInt32

Event ID 14031: Interface InterfaceGuid type = Type.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Interface InterfaceGuid type = Type.

Message #

Interface %1 type = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`Type` UInt32

Event ID 14032: Interface InterfaceGuid cannot be queried, error ErrorCode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Interface InterfaceGuid cannot be queried, error ErrorCode.

Message #

Interface %4 cannot be queried, error %1.

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14033: Failed to query physical medium for interface InterfaceGuid, because the device is not ready.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Failed to query physical medium for interface InterfaceGuid, because the device is not ready. Need to retry.

Message #

Failed to query physical medium for interface %1, because the device is not ready. Need to retry.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14034: Found name FriendlyName for interface DeviceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Found name FriendlyName for interface DeviceGuid.

Message #

Found name %2 for interface %1

Fields #

Name	Description
`DeviceGuid` UnicodeString
`FriendlyName` UnicodeString

Event ID 14035: Network SSID is not permitted.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Network SSID is not permitted.

Message #

Network %1 is not permitted.

Fields #

Name	Description
`SSID` UnicodeString

Event ID 14036: Power setting = Setting.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Power setting = Setting.

Message #

Power setting = %1.

Fields #

Name	Description
`Setting` UInt8

Event ID 14037: Disconnect the temporary connection Profile for interface InterfaceDescription, Reason = Reason.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Disconnect the temporary connection Profile for interface InterfaceDescription, Reason = Reason.

Message #

Disconnect the temporary connection %3 for interface %2, Reason = %4.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Profile` UnicodeString
`Reason` UInt8

Event ID 14038: Clear runtime state because the user who initiated the manual connection logged off.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Clear runtime state because the user who initiated the manual connection logged off.

Message #

Clear runtime state because the user who initiated the manual connection logged off.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14039: WTS session change.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

WTS session change. Type = Type, session id = ConnectionId.

Message #

WTS session change. Type = %1, session id = %2.

Fields #

Name	Description
`Type` UInt32
`ConnectionId` Pointer

Event ID 14040: Scan for networks.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Scan for networks. Interface = InterfaceDescription, scan type = ScanType, flush BSS list = FlushBSSList.

Message #

Scan for networks. Interface = %2, scan type = %3, flush BSS list = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ScanType` UInt32
`FlushBSSList` Boolean

Event ID 14041: Scan request is ignored because radio is off.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Scan request is ignored because radio is off. Interface = InterfaceDescription.

Message #

Scan request is ignored because radio is off. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14042: Scan results are not queried because raido is off.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Scan results are not queried because raido is off. Interface = InterfaceDescription.

Message #

Scan results are not queried because raido is off. Interface = %2.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14043: The scan state machine is stopped.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The scan state machine is stopped.

Message #

The scan state machine is stopped.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14044: No auto switch for the current connection (Profile).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

No auto switch for the current connection (Profile).

Message #

No auto switch for the current connection (%3).

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Profile` UnicodeString

Event ID 14045: Connection (auto = Auto) to SSID (multiple=Multiple) using profile ProfileName.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection (auto = Auto) to SSID (multiple=Multiple) using profile ProfileName.

Message #

Connection (auto = %4) to %5 (multiple=%6) using profile %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ProfileName` UnicodeString
`Auto` Boolean
`SSID` UnicodeString
`Multiple` Boolean
`SSIDListSize` UInt16
`SSIDList` Binary

Event ID 14046: The session id=ConnectionId, active=Active, console=Console is added.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The session id=ConnectionId, active=Active, console=Console is added.

Message #

The session id=%1, active=%2, console=%3 is added.

Fields #

Name	Description
`ConnectionId` Pointer
`Active` Boolean
`Console` Boolean

Event ID 14047: The state of session id=ConnectionId is refreshed to active=Active, console=Console.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The state of session id=ConnectionId is refreshed to active=Active, console=Console.

Message #

The state of session id=%1 is refreshed to active=%2, console=%3.

Fields #

Name	Description
`ConnectionId` Pointer
`Active` Boolean
`Console` Boolean

Event ID 14048: Active Console User state = ActiveConsole.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Active Console User state = ActiveConsole.

Message #

Active Console User state = %1

Fields #

Name	Description
`ActiveConsole` Boolean

Event ID 14049: The session id=ConnectionId is removed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

The session id=ConnectionId is removed.

Message #

The session id=%1 is removed.

Fields #

Name	Description
`ConnectionId` Pointer

Event ID 14050: Discovery module has taken care of the UI request.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Discovery module has taken care of the UI request.

Message #

Discovery module has taken care of the UI request.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14051: UI request not sent because the network is suppressed and the UI request is notification type.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

UI request not sent because the network is suppressed and the UI request is notification type.

Message #

UI request not sent because the network is suppressed and the UI request is notification type.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14052: IntfCompleteTimely failed, error ErrorCode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

IntfCompleteTimely failed, error ErrorCode.

Message #

IntfCompleteTimely failed, error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14053: Session ConnectionId, Network suppressed status for Network is Suppressed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Session ConnectionId, Network suppressed status for Network is Suppressed.

Message #

Session %1, Network suppressed status for %2 is %3.

Fields #

Name	Description
`ConnectionId` Pointer
`Network` GUID
`Suppressed` Boolean

Event ID 14054: Enable AutoConfig background scan.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Enable AutoConfig background scan. Interface = InterfaceDescription, Enabled = Enabled.

Message #

Enable AutoConfig background scan. Interface = %2, Enabled = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Enabled` Boolean

Event ID 14055: Discard this round of background scan because a connection process is in progress.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Discard this round of background scan because a connection process is in progress. Interface = InterfaceDescription.

Message #

Discard this round of background scan because a connection process is in progress. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14056: Discard this round of background scan because the current connection does not allow auto switch.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Discard this round of background scan because the current connection does not allow auto switch. Interface = InterfaceDescription.

Message #

Discard this round of background scan because the current connection does not allow auto switch. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14057: Discard this round of background scan because the current connection is the most preferred auto connection.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Discard this round of background scan because the current connection is the most preferred auto connection. Interface = InterfaceDescription.

Message #

Discard this round of background scan because the current connection is the most preferred auto connection. Interface = %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14058: Connect to SSID with profile ProfileName.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: AcmConnection
Opcode: ActivityContext

Description

Connect to SSID with profile ProfileName.

Message #

Connect to %2 with profile %1

Fields #

Name	Description
`ProfileName` UnicodeString
`SSID` UnicodeString

Event ID 14059: Set operational state.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Set operational state. Interface = InterfaceDescription, Enabled = Enabled.

Message #

Set operational state. Interface = %2, Enabled = %3.

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Enabled` Boolean

Event ID 14060: Profile State changed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Profile State changed. Profile: Profile Blocked for BlockTimeMs milliseconds (Single SSID: SingleSSID).

Message #

Profile State changed. Profile: %1 Blocked for %2 milliseconds (Single SSID: %3)

Fields #

Name	Description
`Profile` UnicodeString
`BlockTimeMs` UInt32
`SingleSSID` Boolean

Event ID 14061: Profile State changed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Profile State changed. Profile: Profile Update State: Update (Single SSID: SingleSSID).

Message #

Profile State changed. Profile: %1 Update State: %2 (Single SSID: %3)

Fields #

Name	Description
`Profile` UnicodeString
`Update` UInt8
`SingleSSID` Boolean

Event ID 14062: RpcCall WlanRpcCallType from client ClientProcessId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RpcCall WlanRpcCallType from client ClientProcessId.

Message #

RpcCall %1 from client %2

Fields #

Name	Description
`WlanRpcCallType` UInt8
`ClientProcessId` UInt32

Event ID 14063: SetAutoConfigParameterRpcCall for OpCode from process ClientProcessId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

SetAutoConfigParameterRpcCall for OpCode from process ClientProcessId.

Message #

SetAutoConfigParameterRpcCall for %1 from process %2

Fields #

Name	Description
`OpCode` UInt32
`ClientProcessId` UInt32

Event ID 14064: SetInterfaceRpcCall for OpCode from process ClientProcessId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

SetInterfaceRpcCall for OpCode from process ClientProcessId.

Message #

SetInterfaceRpcCall for %1 from process %2

Fields #

Name	Description
`OpCode` UInt32
`ClientProcessId` UInt32

Event ID 14065: PrivateSetInterfaceRpcCall for OpCode from process ClientProcessId on Interface InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PrivateSetInterfaceRpcCall for OpCode from process ClientProcessId on Interface InterfaceGuid.

Message #

PrivateSetInterfaceRpcCall for %1 from process %2 on Interface %3

Fields #

Name	Description
`OpCode` UInt32
`ClientProcessId` UInt32
`InterfaceGuid` GUID

Event ID 14066: InternalPrivateQuerySetInterfaceCall for OpCode on Interface InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

InternalPrivateQuerySetInterfaceCall for OpCode on Interface InterfaceGuid.

Message #

InternalPrivateQuerySetInterfaceCall for %1 on Interface %2

Fields #

Name	Description
`OpCode` UInt32
`InterfaceGuid` GUID

Event ID 14067: Screen Power State changed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Screen Power State changed. Screen ON = IsOn.

Message #

Screen Power State changed. Screen ON = %1

Fields #

Name	Description
`IsOn` Boolean

Event ID 14068: Low Power State changed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Low Power State changed. Low Power = IsEnabled.

Message #

Low Power State changed. Low Power = %1

Fields #

Name	Description
`IsEnabled` Boolean

Event ID 14069: Adding WLAN Interface InterfaceGuid for InterfaceDescription.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adding WLAN Interface InterfaceGuid for InterfaceDescription.

Message #

Adding WLAN Interface %1 for %2

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 14070: Removing WLAN Interface Interface InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Removing WLAN Interface Interface InterfaceGuid.

Message #

Removing WLAN Interface Interface %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 14071: Expedited scan triggered on InterfaceGuid because ExpeditedScanTrigger.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Expedited scan triggered on InterfaceGuid because ExpeditedScanTrigger.

Message #

Expedited scan triggered on %1 because %2

Fields #

Name	Description
`InterfaceGuid` GUID
`ExpeditedScanTrigger` UInt8

Event ID 14072: Disconnect triggered on InterfaceGuid Reason: DisconnectTrigger.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Disconnect triggered on InterfaceGuid Reason: DisconnectTrigger.

Message #

Disconnect triggered on %1 Reason: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`DisconnectTrigger` UInt8

Event ID 14073: Limited Connectivity Recovery Type: RecoveryType Event: EventType Data: EventData.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Limited Connectivity Recovery Type: RecoveryType Event: EventType Data: EventData.

Message #

Limited Connectivity Recovery Type: %1 Event: %2 Data: %3

Fields #

Name	Description
`RecoveryType` UInt8
`EventType` UInt8
`EventData` HexInt32

Event ID 14074: Gateway Reachability State changed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Gateway Reachability State changed. Interface GUID: InterfaceGuid Reachable: IsReachable.

Message #

Gateway Reachability State changed. Interface GUID: %1 Reachable: %2

Fields #

Name	Description
`InterfaceGuid` GUID
`IsReachable` Boolean

Event ID 14075: Update allowed connectivity token - AutoConnect=[Enabled: IsAutoConnectEnabled, Count: AutoConnectProfileCount, FilterControl: AutoConnectFilterControl], ManualConnect=[Enabled: IsManualConnectEnab...

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Update allowed connectivity token - AutoConnect=[Enabled: , Count: , FilterControl: ], ManualConnect=[Enabled: , Count: , FilterControl: ], Interface.

Message #

Update allowed connectivity token - AutoConnect=[Enabled: %1, Count: %2, FilterControl: %3], ManualConnect=[Enabled: %4, Count: %5, FilterControl: %6], Interface: %7

Fields #

Name	Description
`IsAutoConnectEnabled` Boolean
`AutoConnectProfileCount` UInt32
`AutoConnectFilterControl` UInt32
`IsManualConnectEnabled` Boolean
`ManualConnectProfileCount` UInt32
`ManualConnectFilterControl` UInt32
`InterfaceDescription` UnicodeString

Event ID 14076: Connectivity token update - AutoConnect=[Enabled: IsAutoConnectEnabled], ManualConnect=[Enabled: IsManualConnectEnabled], Interface: InterfaceDescription.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connectivity token update - AutoConnect=[Enabled: IsAutoConnectEnabled], ManualConnect=[Enabled: IsManualConnectEnabled], Interface: InterfaceDescription.

Message #

Connectivity token update - AutoConnect=[Enabled: %1], ManualConnect=[Enabled: %2], Interface: %3

Fields #

Name	Description
`IsAutoConnectEnabled` Boolean
`IsManualConnectEnabled` Boolean
`InterfaceDescription` UnicodeString
`ConnectivityBlockReason` UInt32

Event ID 20000: Begin Connect API

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Begin Connect API.

Message #

Begin Connect API

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Session` Pointer

Event ID 20001: Begin Disconnect API

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Begin Disconnect API.

Message #

Begin Disconnect API

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20002: Calling MSMSecPerformPreAssociateSecurity

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Calling MSMSecPerformPreAssociateSecurity.

Message #

Calling MSMSecPerformPreAssociateSecurity

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20003: Calling MSMSecStopSecurity

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Calling MSMSecStopSecurity.

Message #

Calling MSMSecStopSecurity

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20004: Connect completion reason Reason, session Session, adhoc formed AdHocFormed.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connect completion reason Reason, session Session, adhoc formed AdHocFormed.

Message #

Connect completion reason %1, session %2, adhoc formed %3

Fields #

Name	Description
`Reason` UInt32
`Session` Pointer
`AdHocFormed` Boolean

Event ID 20005: Received CONNECT COMPLETION, status Status, assocStatus AssocStatus.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received CONNECT COMPLETION, status Status, assocStatus AssocStatus.

Message #

Received CONNECT COMPLETION, status %3, assocStatus %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Status` UInt32	NTSTATUS reference
`AssocStatus` UInt32

Event ID 20006: FSM Current state CurrState, event EventId.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

FSM Current state CurrState, event EventId.

Message #

FSM Current state %3, event %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`CurrState` UInt32
`EventId` UInt32

Event ID 20007: FSM Transition from State: CurrState to State: NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

FSM Transition from State: CurrState to State: NewState.

Message #

FSM Transition from State: %3 to State: %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`CurrState` UInt32
`NewState` UInt32

Event ID 20008: Phy Type not compatible

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Phy Type not compatible.

Message #

Phy Type not compatible

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20009: Link Quality: Quality.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Link Quality: Quality.

Message #

Link Quality: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Quality` UInt32

Event ID 20010: Received IHV PORT DOWN, peer BSSID.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received IHV PORT DOWN, peer BSSID.

Message #

Received IHV PORT DOWN, peer %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`BSSID` Binary

Event ID 20011: Received IHV PORT UP, peer BSSID.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received IHV PORT UP, peer BSSID.

Message #

Received IHV PORT UP, peer %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`BSSID` Binary

Event ID 20012: Post Connect Security has Completed Successfully

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Post Connect Security has Completed Successfully.

Message #

Post Connect Security has Completed Successfully

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20013: Post Connect Security has FAILED with reason code: ErrorCode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Post Connect Security has FAILED with reason code: ErrorCode.

Message #

Post Connect Security has FAILED with reason code: %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString

Event ID 20014: Received Security Packet: PacketType.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received Security Packet: PacketType.

Message #

Received Security Packet: %3

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`PacketType` UInt32

Event ID 20015: Security PreConnect Completion, security reason: Reason, error Error.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Security PreConnect Completion, security reason: Reason, error Error.

Message #

Security PreConnect Completion, security reason: %1, error %2

Fields #

Name	Description
`Reason` UInt32
`Error` UInt32

Event ID 20016: Send Security Packet Length = Length and Completion Handle = Handle.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Send Security Packet Length = Length and Completion Handle = Handle.

Message #

Send Security Packet Length = %3 and Completion Handle = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Length` UInt32
`Handle` Pointer

Event ID 20017: Send Security Packet Length = Length and Completion Handle = Handle.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Send Security Packet Length = Length and Completion Handle = Handle.

Message #

Send Security Packet Length = %3 and Completion Handle = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`Length` UInt32
`Handle` Pointer

Event ID 20018: SSID = SSID BSSIDCount = BSSIDCount.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

SSID = SSID BSSIDCount = BSSIDCount.

Message #

SSID = %3 BSSIDCount = %4

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`SSID` UnicodeString
`BSSIDCount` UInt32
`BSSIDList` Binary

Event ID 20019: A client has associated with the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Authenticatethepeersassociatedtothehostednetwork
Opcode: Start

Description

A client has associated with the hosted network.

Message #

A client has associated with the hosted network. 

Interface GUID: %1
Interface description:%2
Network SSID: %3
Local MAC address: %4
Peer MAC address: %5

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`SSID` UnicodeString
`LocalMAC` UnicodeString
`PeerMAC` UnicodeString

Event ID 20020: A client has successfully authenticated with the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Authenticatethepeersassociatedtothehostednetwork
Opcode: Stop

Description

A client has successfully authenticated with the hosted network.

Message #

A client has successfully authenticated with the hosted network. 

Interface GUID: %1
Interface description:%2
Network SSID: %3
Local MAC address: %4
Peer MAC address: %5

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`SSID` UnicodeString
`LocalMAC` UnicodeString
`PeerMAC` UnicodeString

Event ID 20021: A client has failed to authenticate with the hosted network.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Task: Authenticatethepeersassociatedtothehostednetwork
Opcode: Stop

Description

A client has failed to authenticate with the hosted network.

Message #

A client has failed to authenticate with the hosted network. 

Error code: %2
Error Message: %3
Interface GUID: %1
Interface description:%4
Network SSID: %5
Local MAC address: %6

Fields #

Name	Description
`InterfaceGuid` GUID
`ErrorCode` UInt32
`ErrorMsg` UnicodeString
`InterfaceDescription` UnicodeString
`SSID` UnicodeString
`LocalMAC` UnicodeString

Event ID 20022: Begin Scan

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Begin Scan.

Message #

Begin Scan

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 20023: Scan completion Status Status.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Scan completion Status Status.

Message #

Scan completion Status %2

Fields #

Name	Description
`InterfaceGuid` GUID
`Status` UInt32	NTSTATUS reference

Event ID 20024: Number of Unique Wlan Networks Count.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Number of Unique Wlan Networks Count.

Message #

Number of Unique Wlan Networks %2

Fields #

Name	Description
`InterfaceGuid` GUID
`Count` UInt32

Event ID 20025: Visible Network: Ssid, BssidCount BSSIDS, AuthAlgoId/CipherAlgoId, Rssi RSSI.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Visible Network: Ssid, BssidCount BSSIDS, AuthAlgoId/CipherAlgoId, Rssi RSSI.

Message #

Visible Network: %1, %2 BSSIDS, %3/%4, %5 RSSI

Fields #

Name	Description
`Ssid` UnicodeString
`BssidCount` UInt32
`AuthAlgoId` UInt32
`CipherAlgoId` UInt32
`Rssi` UInt32

Event ID 21001: Adapter(InterfaceGuid) New Adapter FriendlyName (PKMIDs).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) New Adapter FriendlyName (PKMIDs).

Message #

Adapter(%2) New Adapter %4 (%5)

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`LocalAddr` Binary
`FriendlyName` UnicodeString
`PKMIDs` UInt32
`FourWayOffloadSupported` Boolean
`SafeModeSupported` Boolean
`SafeModeCertified` Boolean

Event ID 21002: Adapter(InterfaceGuid) IntfSecState Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) IntfSecState Transition OldState --> NewState.

Message #

Adapter(%2) IntfSecState Transition %3 --> %4

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`OldState` UInt32
`NewState` UInt32

Event ID 21003: Adapter(InterfaceGuid) Received StopSecurity.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) Received StopSecurity.

Message #

Adapter(%2) Received StopSecurity

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID

Event ID 21004: Pre-Associate Failure Auth AuthAlgoId, Cipher CipherAlgoId, OneX Enabled(OneXEnabled), UICancelled(UICancelled).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Pre-Associate Failure Auth AuthAlgoId, Cipher CipherAlgoId, OneX Enabled(OneXEnabled), UICancelled(UICancelled).

Message #

Pre-Associate Failure Auth %3, Cipher %4, OneX Enabled(%5), UICancelled(%6)

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`AuthAlgoId` UInt32
`CipherAlgoId` UInt32
`OneXEnabled` Boolean
`UICancelled` Boolean

Event ID 21005: Received MSMSec UI Response, but already have key material!

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received MSMSec UI Response, but already have key material!

Message #

Received MSMSec UI Response, but already have key material!

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID

Event ID 21006: Received UI response ResponseType.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received UI response ResponseType.

Message #

Received UI response %3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`ResponseType` UInt32

Event ID 21007: TIMING OUT 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

TIMING OUT 802.1x Authentication.

Message #

TIMING OUT 802.1x Authentication

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`PeerAddr` Binary
`Context` UInt32

Event ID 21008: NOT TIMING OUT 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

NOT TIMING OUT 802.1x authentication, next timer in Context msec.

Message #

NOT TIMING OUT 802.1x authentication, next timer in %6 msec

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`PeerAddr` Binary
`Context` UInt32

Event ID 21009: 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

802.1x veto-ed FAST ROAMING (Error ErrorCode), performing full authentication.

Message #

802.1x veto-ed FAST ROAMING (Error %1), performing full authentication

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21010: Port (PortId) Peer PeerAddr AuthMgr Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port (PortId) Peer PeerAddr AuthMgr Transition OldState --> NewState.

Message #

Port (%4) Peer %6 AuthMgr Transition %7 --> %8

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`OldState` UInt32
`NewState` UInt32

Event ID 21011: Sending UI response to 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Sending UI response to 802.1x.

Message #

Sending UI response to 802.1x

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`PeerAddr` Binary
`Context` UInt32

Event ID 21012: KeyExt Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

KeyExt Transition OldState --> NewState.

Message #

KeyExt Transition %2 --> %3

Fields #

Name	Description
`SessionId` UInt32
`OldState` UInt32
`NewState` UInt32

Event ID 21013: Explicit failure from 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Explicit failure from 802.1x, (Reason Reason, Error Error).

Message #

Explicit failure from 802.1x, (Reason %2, Error %3)

Fields #

Name	Description
`SessionId` UInt32
`Reason` UInt32
`Error` UInt32

Event ID 21014: 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

802.1x success.

Message #

802.1x success

Fields #

Name	Description
`SessionId` UInt32

Event ID 21015: Port(PortId) Peer PeerAddr KeyMgr transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(PortId) Peer PeerAddr KeyMgr transition OldState --> NewState.

Message #

Port(%4) Peer %6 KeyMgr transition %7 --> %8

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`OldState` UInt32
`NewState` UInt32

Event ID 21016: Auth sent M1(PortId), self LocalAddr, peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Auth sent M1(PortId), self LocalAddr, peer PeerAddr.

Message #

Auth sent M1(%4), self %5, peer %6

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21017: Auth sent M3(PortId), self LocalAddr, peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Auth sent M3(PortId), self LocalAddr, peer PeerAddr.

Message #

Auth sent M3(%4), self %5, peer %6

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21018: Auth sent G1(PortId), self LocalAddr, peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Auth sent G1(PortId), self LocalAddr, peer PeerAddr.

Message #

Auth sent G1(%4), self %5, peer %6

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21019: Port(PortId) Peer PeerAddr KeyMgrAuth Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(PortId) Peer PeerAddr KeyMgrAuth Transition OldState --> NewState.

Message #

Port(%4) Peer %6 KeyMgrAuth Transition %7 --> %8

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`OldState` UInt32
`NewState` UInt32

Event ID 21020: CONNECTION SECURED by OFFLOADED key exchange

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

CONNECTION SECURED by OFFLOADED key exchange.

Message #

CONNECTION SECURED by OFFLOADED key exchange

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21021: Port(PortId) Notify Key Exchange Status: Authenticator(Authenticator) reason Reason , self LocalAddr, peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(PortId) Notify Key Exchange Status: Authenticator(Authenticator) reason Reason , self LocalAddr, peer PeerAddr.

Message #

Port(%4) Notify Key Exchange Status: Authenticator(%7) reason %8 , self %5, peer %6

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Authenticator` Boolean
`Reason` UInt32

Event ID 21022: Default Key: Idx Index, Algo CipherAlgoId, Direction= Direction, Len Len.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Default Key: Idx Index, Algo CipherAlgoId, Direction= Direction, Len Len.

Message #

Default Key: Idx %1, Algo %2, Direction= %3, Len %4

Fields #

Name	Description
`Index` UInt32
`CipherAlgoId` UInt32
`Direction` UInt8	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Len` UInt32

Event ID 21023: Pairwise Key (Addr): Algo CipherAlgoId, Direction= Direction, Len Len.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Pairwise Key (Addr): Algo CipherAlgoId, Direction= Direction, Len Len.

Message #

Pairwise Key (%1): Algo %2, Direction= %3, Len %4

Fields #

Name	Description
`Addr` Binary
`CipherAlgoId` UInt32
`Direction` UInt8	Known values `%%14592` Inbound `%%14593` Outbound `%%14594` Forward `%%14595` Bidirectional
`Len` UInt32

Event ID 21024: Adapter(AdapterId) Connect Completion, Reason Reason, Error Error.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(AdapterId) Connect Completion, Reason Reason, Error Error.

Message #

Adapter(%1) Connect Completion, Reason %2, Error %3

Fields #

Name	Description
`AdapterId` UInt32
`Reason` UInt32
`Error` UInt32

Event ID 21025: Port(PortId) Indicate Security Result, Peer PeerAddr, Reason Reason Error Error.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(PortId) Indicate Security Result, Peer PeerAddr, Reason Reason Error Error.

Message #

Port(%1) Indicate Security Result, Peer %2, Reason %3 Error %4

Fields #

Name	Description
`PortId` UInt32
`PeerAddr` Binary
`Reason` UInt32
`Error` UInt32

Event ID 21026: Adapter(Context) Tx to PeerAddr, Ethertype EtherType, size Size.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(Context) Tx to PeerAddr, Ethertype EtherType, size Size.

Message #

Adapter(%4) Tx to %1, Ethertype %2, size %3

Fields #

Name	Description
`PeerAddr` Binary
`EtherType` UInt32
`Size` UInt32
`Context` UInt32

Event ID 21027: Sending UI request to MSM (SessionId).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Sending UI request to MSM (SessionId).

Message #

Sending UI request to MSM (%1)

Fields #

Name	Description
`SessionId` UInt32
`PageClsId` GUID
`RequestType` UInt32

Event ID 21028: Adapter(InterfaceGuid) MSM Connect notification, Network "SSID".

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) MSM Connect notification, Network "SSID".

Message #

Adapter(%2) MSM Connect notification, Network "%4"

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`LocalAddr` Binary
`SSID` UnicodeString

Event ID 21029: Adapter(InterfaceGuid) MSM Disconnect notification.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) MSM Disconnect notification.

Message #

Adapter(%2) MSM Disconnect notification

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID

Event ID 21030: Adapter(InterfaceGuid) Port up for peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) Port up for peer PeerAddr.

Message #

Adapter(%2) Port up for peer %3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`PeerAddr` Binary

Event ID 21031: Adapter(InterfaceGuid) Port down for peer PeerAddr.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) Port down for peer PeerAddr.

Message #

Adapter(%2) Port down for peer %3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`PeerAddr` Binary

Event ID 21032: Adapter(InterfaceGuid) Rx from PeerAddr, Ethertype EtherType, size Size.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) Rx from PeerAddr, Ethertype EtherType, size Size.

Message #

Adapter(%2) Rx from %3, Ethertype %4, size %5

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`PeerAddr` Binary
`EtherType` UInt32
`Size` UInt32
`Context` UInt32

Event ID 21033: Adapter(InterfaceGuid) UI Response, request type RequestType, response type ResponseType, cancelled = Cancelled.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) UI Response, request type RequestType, response type ResponseType, cancelled = Cancelled.

Message #

Adapter(%2) UI Response, request type %3, response type %4, cancelled = %5

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`RequestType` UInt32
`ResponseType` UInt32
`Cancelled` Boolean

Event ID 21034: Adapter(InterfaceGuid) Create discovery profiles, SSID SSID, BSS type BSSType, secure Secure.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) Create discovery profiles, SSID SSID, BSS type BSSType, secure Secure.

Message #

Adapter(%2) Create discovery profiles, SSID %3, BSS type %4, secure %5

Fields #

Name	Description
`AdapterID` UInt32
`InterfaceGuid` GUID
`SSID` AnsiString
`BSSType` UInt32
`Secure` Boolean

Event ID 21035: Tx pkt completion, pkt Context.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Tx pkt completion, pkt Context.

Message #

Tx pkt completion, pkt %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21036: Adapter(InterfaceGuid) MSM Redo security request.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Adapter(InterfaceGuid) MSM Redo security request.

Message #

Adapter(%2) MSM Redo security request

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID

Event ID 21037: Connection health status is AdapterId (InterfaceGuid), HealthyHint Healthy.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Connection health status is AdapterId (InterfaceGuid), HealthyHint Healthy.

Message #

Connection health status is %1 (%2), HealthyHint %3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`Healthy` Boolean
`HealthStatus` UInt32
`Hint` Boolean

Event ID 21038: Transition network suspected

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Transition network suspected.

Message #

Transition network suspected

Fields #

Name	Description
`BSSID` Binary

Event ID 21039: UI Response - Valid = Valid, Cancelled = Cancelled.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

UI Response - Valid = Valid, Cancelled = Cancelled.

Message #

UI Response - Valid = %1, Cancelled = %2

Fields #

Name	Description
`Valid` Boolean
`Cancelled` Boolean

Event ID 21040: Port(Context) MSMSendPacket failed, Error ErrorCode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(Context) MSMSendPacket failed, Error ErrorCode.

Message #

Port(%3) MSMSendPacket failed, Error %1

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21041: Can't do fast roaming when PMK Cache is not valid

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Can't do fast roaming when PMK Cache is not valid.

Message #

Can't do fast roaming when PMK Cache is not valid

Event ID 21042: PreAuthMgr Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PreAuthMgr Transition OldState --> NewState.

Message #

PreAuthMgr Transition %4 --> %5

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`OldState` UInt32
`NewState` UInt32

Event ID 21043: PreAuth: 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PreAuth: 802.1X Success, Received keys by Pre-Authentication for PeerAddr.

Message #

PreAuth: 802.1X Success, Received keys by Pre-Authentication for %6

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21044: PreAuth: Explicit failure from 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PreAuth: Explicit failure from 802.1x, (Reason Reason, Error Error).

Message #

PreAuth: Explicit failure from 802.1x, (Reason %2, Error %3)

Fields #

Name	Description
`SessionId` UInt32
`Reason` UInt32
`Error` UInt32

Event ID 21045: PreAuth: 802.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PreAuth: 802.1x success.

Message #

PreAuth: 802.1x success

Fields #

Name	Description
`SessionId` UInt32

Event ID 21046: Received unicast key material in EAPOL-Key (Rapid rekey RapidRekey).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received unicast key material in EAPOL-Key (Rapid rekey RapidRekey).

Message #

Received unicast key material in EAPOL-Key (Rapid rekey %7)

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`RapidRekey` Boolean

Event ID 21047: CONNECTION SECURED by RC4 key exchange

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

CONNECTION SECURED by RC4 key exchange.

Message #

CONNECTION SECURED by RC4 key exchange

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21048: CONNECTION SECURED by RSN key exchange

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

CONNECTION SECURED by RSN key exchange.

Message #

CONNECTION SECURED by RSN key exchange

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21049: RSN Key Receive: Key Message M1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message M1.

Message #

RSN Key Receive: Key Message M1

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21050: RSN Key Receive: Key Message M3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message M3.

Message #

RSN Key Receive: Key Message M3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21051: RSN Key Receive: Key Message M2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message M2.

Message #

RSN Key Receive: Key Message M2

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21052: RSN Key Receive: Key Message M4

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message M4.

Message #

RSN Key Receive: Key Message M4

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21053: RSN Key Receive: Key Message G1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message G1.

Message #

RSN Key Receive: Key Message G1

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21054: RSN Key Receive: Key Message G2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

RSN Key Receive: Key Message G2.

Message #

RSN Key Receive: Key Message G2

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21055: FAST ROAMING is FastRoam.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

FAST ROAMING is FastRoam.

Message #

FAST ROAMING is %7

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`FastRoam` Boolean

Event ID 21056: Unknown transition into Failure, EventType Context.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Unknown transition into Failure, EventType Context.

Message #

Unknown transition into Failure, EventType %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21057: Port(PortId) Peer PeerAddr SecMgr Transition OldState --> NewState.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Port(PortId) Peer PeerAddr SecMgr Transition OldState --> NewState.

Message #

Port(%4) Peer %6 SecMgr Transition %7 --> %8

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`OldState` UInt32
`NewState` UInt32

Event ID 21058: CONNECTION SECURED by WPA key exchange

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

CONNECTION SECURED by WPA key exchange.

Message #

CONNECTION SECURED by WPA key exchange

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21059: WPA Key Receive: Key Message M1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

WPA Key Receive: Key Message M1.

Message #

WPA Key Receive: Key Message M1

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21060: WPA Key Receive: Key Message M3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

WPA Key Receive: Key Message M3.

Message #

WPA Key Receive: Key Message M3

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21061: WPA Key Receive: Key Message G1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

WPA Key Receive: Key Message G1.

Message #

WPA Key Receive: Key Message G1

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`Timeout` UInt32

Event ID 21062: Eapol Key packet cache OVERFLOW

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Eapol Key packet cache OVERFLOW.

Message #

Eapol Key packet cache OVERFLOW

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 21063: PMK Cache overflowed, current Current, limit Max.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

PMK Cache overflowed, current Current, limit Max.

Message #

PMK Cache overflowed, current %4, limit %5

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32
`Current` UInt32
`Max` UInt32

Event ID 21064: WLAN Security Settings: BSS Type BSSType, Authentication AuthAlgoId, Encryption CipherAlgoId, OneX Enabled OnexEnabled, Eap Information - Type EapType, Vendor ID VendorID, Vendor Type VendorType, A...

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

WLAN Security Settings: BSS Type BSSType, Authentication AuthAlgoId, Encryption CipherAlgoId, OneX Enabled OnexEnabled, Eap Information - Type EapType, Vendor ID VendorID, Vendor Type VendorType, Author ID AuthorID.

Message #

WLAN Security Settings: BSS Type %1, Authentication %2, Encryption %3, OneX Enabled %4, Eap Information - Type %5, Vendor ID %6, Vendor Type %7, Author ID %8

Fields #

Name	Description
`BSSType` UInt32
`AuthAlgoId` UInt32
`CipherAlgoId` UInt32
`OnexEnabled` UInt32
`EapType` UInt32
`VendorID` UInt32
`VendorType` UInt32
`AuthorID` UInt32

Event ID 21065: Received multicast key material in EAPOL-Key (Rapid rekey RapidRekey).

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Received multicast key material in EAPOL-Key (Rapid rekey RapidRekey).

Message #

Received multicast key material in EAPOL-Key (Rapid rekey %7)

Fields #

Name	Description
`AdapterId` UInt32
`InterfaceGuid` GUID
`SessionId` UInt32
`PortId` UInt32
`LocalAddr` Binary
`PeerAddr` Binary
`RapidRekey` Boolean

Event ID 21066: Default Key ID set to Index Index.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Description

Default Key ID set to Index Index.

Message #

Default Key ID set to Index %1

Fields #

Name	Description
`Index` UInt32

Event ID 30000: Connection started 1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttosamenetworkonresume
Opcode: Stop

Description

Connection started 1.

Message #

Connection started 1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30001: Connection timeout threshold reached 1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection timeout threshold reached 1.

Message #

Connection timeout threshold reached 1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30002: Connection succeeded

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection succeeded.

Message #

Connection succeeded

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30003: Connection started 2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttosamenetworkonresume
Opcode: Stop

Description

Connection started 2.

Message #

Connection started 2

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30004: Connection timeout threshold reached 2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection timeout threshold reached 2.

Message #

Connection timeout threshold reached 2

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30005: Connection started 3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttosamenetworkonresume
Opcode: Stop

Description

Connection started 3.

Message #

Connection started 3

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30006: Connection timeout threshold reached 3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection timeout threshold reached 3.

Message #

Connection timeout threshold reached 3

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30007: Manual connect initiated, end running reconnect scenarios

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Manual connect initiated, end running reconnect scenarios.

Message #

Manual connect initiated, end running reconnect scenarios

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30008: Manual connect initiated, end running reconnect scenarios

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Manual connect initiated, end running reconnect scenarios.

Message #

Manual connect initiated, end running reconnect scenarios

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30009: Manual connect initiated, end running reconnect scenarios

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Manual connect initiated, end running reconnect scenarios.

Message #

Manual connect initiated, end running reconnect scenarios

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30010: UI interaction requested 1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

UI interaction requested 1.

Message #

UI interaction requested 1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30011: UI interaction requested 2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

UI interaction requested 2.

Message #

UI interaction requested 2

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30012: UI interaction requested 3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

UI interaction requested 3.

Message #

UI interaction requested 3

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30013: Connection succeeded - Hidden network 1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection succeeded - Hidden network 1.

Message #

Connection succeeded - Hidden network 1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30014: Connection succeeded - Hidden network 2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection succeeded - Hidden network 2.

Message #

Connection succeeded - Hidden network 2

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30015: Connection succeeded - Hidden network 3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection succeeded - Hidden network 3.

Message #

Connection succeeded - Hidden network 3

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30016: Selection list exhausted 1

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Selection list exhausted 1.

Message #

Selection list exhausted 1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30017: Selection list exhausted 2

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Selection list exhausted 2.

Message #

Selection list exhausted 2

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30018: Selection list exhausted 3

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Selection list exhausted 3.

Message #

Selection list exhausted 3

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30019: Connection succeeded to previous network - expected roaming

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Connecttonetworkonresumeafterinterveningdisconnect
Opcode: Stop

Description

Connection succeeded to previous network - expected roaming.

Message #

Connection succeeded to previous network - expected roaming

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30020: task_0Start30020

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Start

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30021: task_0Stop30021

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Stop

Fields #

Name	Description
`InterfaceGuid` GUID
`WLANStatusCode` UInt32
`DetailedStatusCode` UInt32
`ConnectionInformation` UInt32
`DeviceID` UnicodeString

Event ID 30022: task_0Stop30022

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Stop

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30100: Perftrack_WfdDiscoverStart

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Perftrack_WfdDiscover
Opcode: Start

Fields #

Name	Description
`RequestId` UInt32

Event ID 30101: Perftrack_WfdDiscoverStop

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Perftrack_WfdDiscover
Opcode: Stop

Fields #

Name	Description
`RequestId` UInt32

Event ID 30102: Perftrack_WfdPairStart

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Perftrack_WfdPair
Opcode: Start

Fields #

Name	Description
`RequestId` UInt32

Event ID 30103: Perftrack_WfdPairStop

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: Perftrack_WfdPair
Opcode: Stop

Fields #

Name	Description
`RequestId` UInt32
`WFDPairReturnCode` UInt32

Event ID 30104: Cancel WLAN Resume-Reconnect Interface GUID: InterfaceGuid.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: WLANConnecttonetwork
Opcode: Stop

Description

Cancel WLAN Resume-Reconnect Interface GUID: InterfaceGuid.

Message #

Cancel WLAN Resume-Reconnect Interface GUID: %1

Fields #

Name	Description
`InterfaceGuid` GUID

Event ID 30105: task_030105

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Opcode: Info

Fields #

Name	Description
`ReturnValue` UInt32
`ReasonCode` UInt32

Event ID 40001: Connect Diagnostic Information.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: AcmConnection

Description

Connect Diagnostic Information.

Message #

Connect Diagnostic Information
Interface GUID: %1
Network Adapter: %2
Connection Mode: %3
SSID: %4
BSS Type: %5
Authentication: %6
Encryption: %7
802.1X Enabled: %8
IHV Bitmap: %9
Hidden: %10
Peer MAC: %11
WLAN Status Code: %12
Dot11 Status Code: %13
Assoc Time: %14
Assoc Restart Count: %15
Auth Time: %16
Auth Restart Count: %17
Device ID: %18
Device Manufacturer: %38
Driver Service: %20
Driver Version: %19
Driver Date: %42
RSSI: %21
Signal Quality: %22%%
Channel: %23
Interfering AP Count: %24
Total Visible AP Count: %25
Max AP Phy Type: %26
Max AP Channel Width: %27
AP Description: %28
AP Manufacturer: %29
AP Model Name: %30
AP Model Number: %31
Detailed Status On Roam: %32
Rx Rate:%33
Tx Rate: %34
EAP Type: %35
802.1x Auth Mode: %36
HotSpot 2.0: %37
Profile Type %39
System MAC Randomization: %40
Profile MAC Randomization: %41
Connection Flags: %42

Fields #

Name	Description
`InterfaceGuid` GUID
`InterfaceDescription` UnicodeString
`ConnectionMode` UInt32
`SSID` UnicodeString
`BSSType` UInt32
`AuthAlgo` UInt32
`CipherAlgo` UInt32
`OnexEnabled` UInt32
`IHVBitmap` UInt32
`NonBroadcast` Boolean
`PeerMAC` UnicodeString
`WLANStatusCode` UInt32
`DetailedStatusCode` UInt32
`AssocDuration` UInt32
`AssocRestartCount` UInt32
`AuthDuration` UInt32
`AuthRestartCount` UInt32
`DeviceID` UnicodeString
`DriverVersion` UnicodeString
`DriverService` UnicodeString
`RSSI` Int32
`SignalQualityPercentage` Int32
`Channel` Int32
`InterferingAPCount` Int32
`TotalVisibleAPCount` Int32
`APPhyType` UnicodeString
`APMaxChannelWidth` Int32
`APDescription` AnsiString
`APManufacturer` AnsiString
`APModelName` AnsiString
`APModelNum` AnsiString
`DetailedStatusCodeOnRoam` UInt32
`RxRate` Int32
`TxRate` Int32
`EAPType` Int32
`OneXAuthMode` UnicodeString
`HotSpot20IEPresent` Boolean
`DeviceMfg` UnicodeString
`ProfileTypeUsed` Int32
`SystemRandomizationStatus` UInt32
`ProfileRandomizationStatus` UInt32
`ConnectionFlags` UInt64
`DriverDate` SYSTEMTIME

Event ID 40002: Limited Recovery Diagnostic Statistics.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: AcmConnection

Description

Limited Recovery Diagnostic Statistics.

Message #

Limited Recovery Diagnostic Statistics
Interface GUID: %1
Disconnect Extensions: %2
Roam Extensions: %3
Suspect Duration: %4 ms
Bssid Changed: %5
Detection Link Quality: %6
Current Link Quality: %7
MacTxUnicastCount: %8
MacRxUnicastCount: %9
MacRxMulticastCount: %10
MacRxUnicastDecryptSuccess: %11
MacRxUnicastDecryptFailure: %12
PhyTxFailedCount: %13
PhyTxFrameCount: %14
PhyTxRetryCount: %15
PhyRxFrameCount: %16
PhyRxFcsErrorCount: %17
Current Tx Rate: %18
Current Rx Rate:%19

Fields #

Name	Description
`InterfaceGuid` GUID
`DisconnectExtensions` UInt32
`RoamExtensions` UInt32
`SuspectDurationMs` UInt32
`BssidChanged` Boolean
`DetectionLinkQuality` UInt32
`CurrentLinkQuality` UInt32
`MacTxUnicastCount` Int32
`MacRxUnicastCount` Int32
`MacRxMulticastCount` Int32
`MacRxUnicastDecryptSuccess` Int32
`MacRxUnicastDecryptFailure` Int32
`PhyTxFailedCount` Int32
`PhyTxFrameCount` Int32
`PhyTxRetryCount` Int32
`PhyRxFrameCount` Int32
`PhyRxFcsErrorCount` Int32
`CurrentTxRate` UInt32
`CurrentRxRate` UInt32

Event ID 40003: Diagnostic Statistics Difference.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Diagnostic
Task: AcmConnection

Description

Diagnostic Statistics Difference.

Message #

Diagnostic Statistics Difference
Interface GUID: %1
Event: %2
MacTxUnicastCount: %3
MacRxUnicastCount: %4
MacRxMulticastCount: %5
MacRxUnicastDecryptSuccess: %6
MacRxUnicastDecryptFailure: %7
PhyTxFailedCount: %8
PhyTxFrameCount: %9
PhyTxRetryCount: %10
PhyRxFrameCount: %11
PhyRxFcsErrorCount: %12
TimeDiffMs: %13

Fields #

Name	Description
`InterfaceGuid` GUID
`DiagnosticStatsDifferenceTrigger` UInt32
`MacTxUnicastCount` Int32
`MacRxUnicastCount` Int32
`MacRxMulticastCount` Int32
`MacRxUnicastDecryptSuccess` Int32
`MacRxUnicastDecryptFailure` Int32
`PhyTxFailedCount` Int32
`PhyTxFrameCount` Int32
`PhyTxRetryCount` Int32
`PhyRxFrameCount` Int32
`PhyRxFcsErrorCount` Int32
`TimeDiffMs` UInt64

Event ID 60001: Error: ErrorCode Location: Location Context: Context.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Error: ErrorCode Location: Location Context: Context.

Message #

Error: %1 Location: %2 Context: %3

Fields #

Name	Description
`ErrorCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 60002: Warning: WarningCode Location: Location Context: Context.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Warning: WarningCode Location: Location Context: Context.

Message #

Warning: %1 Location: %2 Context: %3

Fields #

Name	Description
`WarningCode` UInt32
`Location` UInt32
`Context` UInt32

Event ID 60003: Transitioned to State: NextState Context: Context.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Transitioned to State: NextState Context: Context.

Message #

Transitioned to State: %1 Context: %2

Fields #

Name	Description
`NextState` UInt8
`Context` UInt32

Event ID 60004: Updated Context: Context Update Reason: UpdateReasonCode.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Updated Context: Context Update Reason: UpdateReasonCode.

Message #

Updated Context: %1 Update Reason: %2

Fields #

Name	Description
`Context` UInt32
`UpdateReasonCode` UInt32

Event ID 60101: SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: DestinationAddress DestinationPort: DestinationPort Protocol: Protocol ReferenceContext: ReferenceContext.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: DestinationAddress DestinationPort: DestinationPort Protocol: Protocol ReferenceContext: ReferenceContext.

Message #

SourceAddress: %1 SourcePort: %2 DestinationAddress: %3 DestinationPort: %4 Protocol: %5 ReferenceContext: %6

Fields #

Name	Description
`SourceAddress` UInt32
`SourcePort` UInt32
`DestinationAddress` UInt32
`DestinationPort` UInt32
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`ReferenceContext` UInt32

Event ID 60102: SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: DestinationAddress DestinationPort: DestinationPort Protocol: Protocol ReferenceContext: ReferenceContext.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

SourceAddress: SourceAddress SourcePort: SourcePort DestinationAddress: DestinationAddress DestinationPort: DestinationPort Protocol: Protocol ReferenceContext: ReferenceContext.

Message #

SourceAddress: %1 SourcePort: %2 DestinationAddress: %3 DestinationPort: %4 Protocol: %5 ReferenceContext: %6

Fields #

Name	Description
`SourceAddress` Binary
`SourcePort` UInt32
`DestinationAddress` Binary
`DestinationPort` UInt32
`Protocol` UInt32	Known values `0` HOPOPT `1` ICMP `2` IGMP `6` TCP `17` UDP `41` IPv6 `43` IPv6-Route `44` IPv6-Frag `47` GRE `50` ESP `51` AH `58` ICMPv6 `89` OSPF `103` PIM `132` SCTP
`ReferenceContext` UInt32

Event ID 60103: Interface Guid: IfGuid IfIndex: IfIndex Interface Luid: IfLuid ReferenceContext: ReferenceContext.

Provider: Microsoft-Windows-WLAN-AutoConfig
Channel: Operational
Opcode: Info

Description

Interface Guid: IfGuid IfIndex: IfIndex Interface Luid: IfLuid ReferenceContext: ReferenceContext.

Message #

Interface Guid: %1 IfIndex: %2 Interface Luid: %3 ReferenceContext: %4

Fields #

Name	Description
`IfGuid` GUID
`IfIndex` UInt32
`IfLuid` UInt64
`ReferenceContext` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9580d7dd-0379-4658-9870-d5be7d52d6de

Defined in wlansvc.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

Downloads

Microsoft-Windows-WLAN-AutoConfig registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)