detection.wiki

Microsoft-Windows-WPD-CompositeClassDriver

EventTitleChannelSampleRule
100Transport Arrival Begin: TransportSymbolicLink.AnalyticNN
101Transport Arrival End: TransportSymbolicLink.AnalyticNN
102Transport Departure Begin: TransportSymbolicLink.AnalyticNN
103Transport Departure End: TransportSymbolicLink.AnalyticNN
104OnCreateFile Begin: ReferenceString.AnalyticNN
105OnCreateFile End: ReferenceString.AnalyticNN
106DeviceIoControl BeginAnalyticNN
107DeviceIoControl EndAnalyticNN
108Transport Look-Up BeginAnalyticNN
109Transport Look-Up EndAnalyticNN
110Custom Event Relay BeginAnalyticNN
111Custom Event Relay EndAnalyticNN
112Commit Transport Interface States BeginAnalyticNN
113Commit Transport Interface States EndAnalyticNN
200Transport Arrival: TransportSymbolicLink.OperationalNN
201Transport Departure: TransportSymbolicLink.OperationalNN
202Enabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.OperationalNN
203Disabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.OperationalNN
300No Multi-Transport support with the current version of the User Mode Driver …OperationalNN
301Unable to create remote interface for transport: TransportSymbolicLink.OperationalNN
302Unable to open IoTarget for transport: TransportSymbolicLink.OperationalNN
303Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.OperationalNN
304Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE …OperationalNN
305Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.OperationalNN
306MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference …OperationalNN
307Reference string not expected for specified action …OperationalNN
308Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: …OperationalNN
309Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: …OperationalNN
310Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value Interface state …OperationalNN
311Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value Interface state …OperationalNN
312Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.OperationalNN
313Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.OperationalNN
314MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string …OperationalNN
315MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated stringOperationalNN
316Could not extract properties for interface state request.OperationalNN

Event ID 100: Transport Arrival Begin: TransportSymbolicLink.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Message #

Transport Arrival Begin: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 101: Transport Arrival End: TransportSymbolicLink.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Message #

Transport Arrival End: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 102: Transport Departure Begin: TransportSymbolicLink.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Message #

Transport Departure Begin: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 103: Transport Departure End: TransportSymbolicLink.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Message #

Transport Departure End: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 104: OnCreateFile Begin: ReferenceString.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Message #

OnCreateFile Begin: %1

Fields #

NameDescription
ReferenceString UnicodeString

Event ID 105: OnCreateFile End: ReferenceString.

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Message #

OnCreateFile End: %1

Fields #

NameDescription
ReferenceString UnicodeString

Event ID 106: DeviceIoControl Begin

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Event ID 107: DeviceIoControl End

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Event ID 108: Transport Look-Up Begin

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Event ID 109: Transport Look-Up End

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Event ID 110: Custom Event Relay Begin

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Event ID 111: Custom Event Relay End

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Event ID 112: Commit Transport Interface States Begin

#
Channel
Analytic
Task
DriverPerformance
Opcode
Start

Event ID 113: Commit Transport Interface States End

#
Channel
Analytic
Task
DriverPerformance
Opcode
Stop

Event ID 200: Transport Arrival: TransportSymbolicLink.

#
Channel
Operational
Task
TransportManagement

Message #

Transport Arrival: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 201: Transport Departure: TransportSymbolicLink.

#
Channel
Operational
Task
TransportManagement

Message #

Transport Departure: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 202: Enabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

#
Channel
Operational
Task
TransportManagement

Message #

Enabled Interface GUID: %1, ReferenceString: %2

Fields #

NameDescription
InterfaceGUID GUID
ReferenceString UnicodeString

Event ID 203: Disabled Interface GUID: InterfaceGUID, ReferenceString: ReferenceString.

#
Channel
Operational
Task
TransportManagement

Message #

Disabled Interface GUID: %1, ReferenceString: %2

Fields #

NameDescription
InterfaceGUID GUID
ReferenceString UnicodeString

Event ID 300: No Multi-Transport support with the current version of the User Mode Driver Framework

#
Channel
Operational
Task
DriverFailure

Event ID 301: Unable to create remote interface for transport: TransportSymbolicLink.

#
Channel
Operational
Task
DriverFailure

Message #

Unable to create remote interface for transport: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 302: Unable to open IoTarget for transport: TransportSymbolicLink.

#
Channel
Operational
Task
DriverFailure

Message #

Unable to open IoTarget for transport: %1

Fields #

NameDescription
TransportSymbolicLink UnicodeString

Event ID 303: Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.

#
Channel
Operational
Task
TransportManagement

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_BANDWIDTH structure.
Expected Size: %1, Actual Size: %2

Fields #

NameDescription
ExpectedSize UInt64
ActualSize UInt64

Event ID 304: Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE structure.

#
Channel
Operational
Task
TransportManagement

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_INTERFACE_STATE structure.
Expected Size: >= %1, Actual Size: %2

Fields #

NameDescription
ExpectedSize UInt64
ActualSize UInt64

Event ID 305: Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.

#
Channel
Operational
Task
TransportManagement

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_HDR structure.
Expected Size: >= %1, Actual Size: %2

Fields #

NameDescription
ExpectedSize UInt64
ActualSize UInt64

Event ID 306: MULTI_TRANSPORT_INTERFACE_STATE structure too short for provided reference string, or reference string not NULL-terminated

#
Channel
Operational
Task
TransportManagement

Event ID 307: Reference string not expected for specified action (MULTI_TRANSPORT_INTERFACE_STATE)

#
Channel
Operational
Task
TransportManagement

Event ID 308: Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: FUNCTION_MULTI_TRANSPORT_BANDWIDTH FUNCTION_MULTI_TRANSPORT_INTERFACE_S...

#
Channel
Operational
Task
TransportManagement

Description

Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: Value.

Message #

Unexpected function for MULTI_TRANSPORT_INTERFACE_STATE: %1

Must be one of:
  FUNCTION_MULTI_TRANSPORT_BANDWIDTH
  FUNCTION_MULTI_TRANSPORT_INTERFACE_STATE

Fields #

NameDescription
Value UInt32

Event ID 309: Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value Must be one of: ACTION_MULTI_TRANSPORT_ENABLE ACTION_MULTI_TRANSPORT_DISABLE ACTION_MULTI...

#
Channel
Operational
Task
TransportManagement

Description

Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: Value.

Message #

Unexpected action for MULTI_TRANSPORT_INTERFACE_STATE: %1

Must be one of:
  ACTION_MULTI_TRANSPORT_ENABLE
  ACTION_MULTI_TRANSPORT_DISABLE
  ACTION_MULTI_TRANSPORT_ENDOFSET
  ACTION_MULTI_TRANSPORT_DISABLEALL

Fields #

NameDescription
Value UInt32

Event ID 310: Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value Interface state discovery has stopped.

#
Channel
Operational
Task
TransportManagement

Description

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: Value.

Message #

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST initiation: %1
Interface state discovery has stopped.

Fields #

NameDescription
Value UInt32

Event ID 311: Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value Interface state discovery has stopped.

#
Channel
Operational
Task
TransportManagement

Description

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: Value.

Message #

Unexpected HRESULT for IOCTL_TRANSPORT_REQUEST completion: %1
Interface state discovery has stopped.

Fields #

NameDescription
Value UInt32

Event ID 312: Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.

#
Channel
Operational
Task
TransportManagement

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_STATE structure.
Expected Size: >= %1, Actual Size: %2

Fields #

NameDescription
ExpectedSize UInt64
ActualSize UInt64

Event ID 313: Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.

#
Channel
Operational
Task
TransportManagement

Message #

Transport driver returned an incorrect MULTI_TRANSPORT_FRIENDLYNAME structure.
Expected Size: >= %1, Actual Size: %2

Fields #

NameDescription
ExpectedSize UInt64
ActualSize UInt64

Event ID 314: MULTI_TRANSPORT_FRIENDLYNAME structure too short for provided string, or string not NULL-terminated

#
Channel
Operational
Task
TransportManagement

Event ID 315: MULTI_TRANSPORT_FRIENDLYNAME structure must provide a NULL-terminated string

#
Channel
Operational
Task
TransportManagement

Event ID 316: Could not extract properties for interface state request.

#
Channel
Operational
Task
TransportManagement

Description

Could not extract properties for interface state request. The data may be invalid.

Message #

Could not extract properties for interface state request. The data may be invalid.

Provenance

ETW provider GUID 355c44fe-0c8e-4bf8-be28-8bc7b5a42720

Defined in wpd_ci.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB