Microsoft-Windows-WPD-MTPClassDriver

77 events across 2 channels

Event	Title	Channel	Sample
1000	MTP Driver started successfully.	Operational	N
1001	Device will enter the suspend state if idle for Seconds seconds.	Operational	N
1002	Device is entering the idle state (Idle state: State; Return code: hr).	Operational	N
1003	Device is resuming operation from idle state (Idle state: State; Return code: …	Operational	N
1004	Driver has cancelled the operation Code.	Operational	N
1005	Customizing for 'Manufacturer, Model, Version' (HackModel).	Operational	N
1006	Driver has failed to start, HRESULT hr.	Operational	N
1007	Device has failed to respond to the operation Code in 5 minutes, attempted to …	Operational	N
1008	Device has failed to communicate its status when processing operation Code.	Operational	N
1009	Bluetooth transport driver has detected a data discontinuity error: (expected …	Operational	N
1010	Bluetooth transport driver has detected a data integrity error in a bulk data …	Operational	N
1011	Error in ServicePropList Dataset: Service ID Code, Property ID Prop, DataSet …	Operational	N
1012	FixedArray form flag used with non-array type	Operational	N
1013	ByteArray form flag used with non-AUINT8 type	Operational	N
1014	LongString form flag used with non-AUINT16 type	Operational	N
1015	Error in ObjectPropDesc Dataset: Format ID Code, Property ID Prop, DataSet …	Operational	N
1016	Error in InterdependentPropDesc Dataset: Format ID Code, DataSet Offset Offset.	Operational	N
1017	Error in ServiceCapabilities Dataset: Service ID Code, Format ID Prop, DataSet …	Operational	N
1018	FixedArray form flag used with non-array type	Operational	N
1019	ByteArray form flag used with non-AUINT8 type	Operational	N
1020	LongString form flag used with non-AUINT16 type	Operational	N
1021	Dataset not large enough for expected data	Operational	N
1022	Error in DeviceInfo Dataset: DataSet Offset Offset.	Operational	N
1023	Error in StorageInfo Dataset: Storage ID ID, DataSet Offset Offset.	Operational	N
1024	Error in ServiceInfo Dataset: Service ID ID, DataSet Offset Offset.	Operational	N
1025	Error in ObjectInfo Dataset: Object ID ID, DataSet Offset Offset.	Operational	N
1026	Error in DevicePropDesc Dataset: Property ID ID, DataSet Offset Offset.	Operational	N
1027	Invalid string specification	Operational	N
1028	Unable to parse value for MTP DataType Code.	Operational	N
1029	Error in ServiceIDs: declared Expected elements, but only space to hold Actual …	Operational	N
1030	Warning in ServiceIDs: declared Expected elements, but space to hold Actual …	Operational	N
1031	Error in ServiceIDs: count of Offset exceeds system limits.	Operational	N
1032	Error in StorageIDs: declared Expected elements, but only space to hold Actual …	Operational	N
1033	Warning in StorageIDs: declared Expected elements, but space to hold Actual …	Operational	N
1034	Error in StorageIDs: count of Offset exceeds system limits.	Operational	N
1035	Error in ObjectHandles: declared Expected elements, but only space to hold …	Operational	N
1036	Warning in ObjectHandles: declared Expected elements, but space to hold Actual …	Operational	N
1037	Error in ObjectHandles: count of Offset exceeds system limits.	Operational	N
1038	Error in ObjectReferences: declared Expected elements, but only space to hold …	Operational	N
1039	Warning in ObjectReferences: declared Expected elements, but space to hold …	Operational	N
1040	Error in ObjectReferences: count of Offset exceeds system limits.	Operational	N
1041	Duplicate Namespace and ID PKeyGuid.	Operational	N
1042	Duplicate Format ID Guid (ignored).	Operational	N
1043	Duplicate Method ID Guid (ignored).	Operational	N
1044	Duplicate Event ID Guid (ignored).	Operational	N
1045	Duplicate PropCode ID Prop for Service Format Code (ignored).	Operational	N
1046	Ambiguous mapping of Namespace and ID PKeyGuid.	Operational	N
1047	Empty Hints Service data block	Operational	N
1048	Hints Service data block is of invalid size	Operational	N
1049	Unrecognized MTP DataType Code.	Operational	N
1050	MaxLength of Offset is too large for associated MTP DataType.	Operational	N
1051	Unrecognized MTP FormFlag Code.	Operational	N
1052	Abstract property PKeyGuid.	Operational	N
1053	Abstract format PKeyGuid redefined by service ID.	Operational	N
1054	Abstract method PKeyGuid redefined by service ID.	Operational	N
1055	Abstract event PKeyGuid redefined by service ID.	Operational	N
1056	Warning in ServiceInfo Dataset: Service ID Code, left-over bytes ignored at end …	Operational	N
1057	Ignoring reference by Service ID ID to concrete service PKeyGuid.	Operational	N
1058	Service ID ID referencing unknown service PKeyGuid.	Operational	N
1059	Service ID ID specifies unknown service flag Code (expecting Standard or …	Operational	N
1060	Error in Dataset: count of Offset exceeds system limits.	Operational	N
1061	Device does not support bulk version of GetServiceCapabilities	Operational	N
1062	Device does not support bulk version of GetServiceProperties	Operational	N
1063	Method ID PKeyGuid referencing unknown association format ID.	Operational	N
1064	Device does not support bulk version of GetFormatCapabilities	Operational	N
1065	Error in FormatCapabilities Dataset: Format ID Code, DataSet Offset Offset.	Operational	N
1066	Bluetooth transport driver has terminated an MTP Bluetooth connection due to …	Operational	N
1067	Error in GetObjectPropsSupported Dataset: DataSet Offset Offset.	Operational	N
1068	Error in GetObjectPropList Dataset: DataSet Offset Offset.	Operational	N
2000	MTP Request	Analytic	N
2001	MTP Data(in) and Response	Analytic	N
2002	MTP Data(in) and Response for GetDevice/ObjectPropValue	Analytic	N
2003	MTP Response	Analytic	N
2004	MTP Event received from device	Analytic	N
2005	MTP Bulk GetObjectProperties by Object Format	Analytic	N
2006	MTP Request and Data(out)	Analytic	N
2007	MTP Request and Data(out) for SetDevice/ObjectPropValue	Analytic	N

Event ID 1000: MTP Driver started successfully.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverInitialization

Description

MTP Driver started successfully.

Message #

MTP Driver started successfully.

Event ID 1001: Device will enter the suspend state if idle for Seconds seconds.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverInitialization

Description

Device will enter the suspend state if idle for Seconds seconds.

Message #

Device will enter the suspend state if idle for %1 seconds.

Fields #

Name	Description
`Seconds` UInt32

Event ID 1002: Device is entering the idle state (Idle state: State; Return code: hr).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Device is entering the idle state (Idle state: State; Return code: hr).

Message #

Device is entering the idle state (Idle state: %1; Return code: %2).

Fields #

Name	Description
`State` UInt32
`hr` UInt32

Event ID 1003: Device is resuming operation from idle state (Idle state: State; Return code: hr).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Device is resuming operation from idle state (Idle state: State; Return code: hr).

Message #

Device is resuming operation from idle state (Idle state: %1; Return code: %2).

Fields #

Name	Description
`State` UInt32
`hr` UInt32

Event ID 1004: Driver has cancelled the operation Code.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Driver has cancelled the operation Code.

Message #

Driver has cancelled the operation %1

Fields #

Name	Description
`Code` UInt32

Event ID 1005: Customizing for 'Manufacturer, Model, Version' (HackModel).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverInitialization

Description

Customizing for 'Manufacturer, Model, Version' (HackModel).

Message #

Customizing for '%1, %2, %3' (%4).

Fields #

Name	Description
`Manufacturer` UnicodeString
`Model` UnicodeString
`Version` UnicodeString
`HackModel` UInt32

Event ID 1006: Driver has failed to start, HRESULT hr.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverInitialization

Description

Driver has failed to start, HRESULT hr.

Message #

Driver has failed to start, HRESULT %1.

Fields #

Name	Description
`hr` UInt32

Event ID 1007: Device has failed to respond to the operation Code in 5 minutes, attempted to cancel the operationm HRESULT hr.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Device has failed to respond to the operation Code in 5 minutes, attempted to cancel the operationm HRESULT hr.

Message #

Device has failed to respond to the operation %1 in 5 minutes, attempted to cancel the operationm HRESULT %2.

Fields #

Name	Description
`Code` UInt32
`hr` UInt32

Event ID 1008: Device has failed to communicate its status when processing operation Code.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Device has failed to communicate its status when processing operation Code.

Message #

Device has failed to communicate its status when processing operation %1.

Fields #

Name	Description
`Code` UInt32

Event ID 1009: Bluetooth transport driver has detected a data discontinuity error: (expected sequence ID ExpectedValue, but recevied ActualValue).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Bluetooth transport driver has detected a data discontinuity error: (expected sequence ID ExpectedValue, but recevied ActualValue).

Message #

Bluetooth transport driver has detected a data discontinuity error: (expected sequence ID %1, but recevied %2).

Fields #

Name	Description
`ExpectedValue` UInt32
`ActualValue` UInt32

Event ID 1010: Bluetooth transport driver has detected a data integrity error in a bulk data transfer operation: (expected CRC-32 value ExpectedValue, but received ActualValue).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Bluetooth transport driver has detected a data integrity error in a bulk data transfer operation: (expected CRC-32 value ExpectedValue, but received ActualValue).

Message #

Bluetooth transport driver has detected a data integrity error in a bulk data transfer operation: (expected CRC-32 value %1, but received %2).

Fields #

Name	Description
`ExpectedValue` UInt32
`ActualValue` UInt32

Event ID 1011: Error in ServicePropList Dataset: Service ID Code, Property ID Prop, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ServicePropList Dataset: Service ID Code, Property ID Prop, DataSet Offset Offset.

Message #

Error in ServicePropList Dataset: Service ID %1, Property ID %2, DataSet Offset %3

Fields #

Name	Description
`Code` UInt32
`Prop` UInt32
`Offset` UInt32

Event ID 1012: FixedArray form flag used with non-array type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

FixedArray form flag used with non-array type.

Message #

FixedArray form flag used with non-array type

Event ID 1013: ByteArray form flag used with non-AUINT8 type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

ByteArray form flag used with non-AUINT8 type.

Message #

ByteArray form flag used with non-AUINT8 type

Event ID 1014: LongString form flag used with non-AUINT16 type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

LongString form flag used with non-AUINT16 type.

Message #

LongString form flag used with non-AUINT16 type

Event ID 1015: Error in ObjectPropDesc Dataset: Format ID Code, Property ID Prop, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectPropDesc Dataset: Format ID Code, Property ID Prop, DataSet Offset Offset.

Message #

Error in ObjectPropDesc Dataset: Format ID %1, Property ID %2, DataSet Offset %3

Fields #

Name	Description
`Code` UInt32
`Prop` UInt32
`Offset` UInt32

Event ID 1016: Error in InterdependentPropDesc Dataset: Format ID Code, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in InterdependentPropDesc Dataset: Format ID Code, DataSet Offset Offset.

Message #

Error in InterdependentPropDesc Dataset: Format ID %1, DataSet Offset %2

Fields #

Name	Description
`Code` UInt32
`Offset` UInt32

Event ID 1017: Error in ServiceCapabilities Dataset: Service ID Code, Format ID Prop, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ServiceCapabilities Dataset: Service ID Code, Format ID Prop, DataSet Offset Offset.

Message #

Error in ServiceCapabilities Dataset: Service ID %1, Format ID %2, DataSet Offset %3

Fields #

Name	Description
`Code` UInt32
`Prop` UInt32
`Offset` UInt32

Event ID 1018: FixedArray form flag used with non-array type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

FixedArray form flag used with non-array type.

Message #

FixedArray form flag used with non-array type

Event ID 1019: ByteArray form flag used with non-AUINT8 type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

ByteArray form flag used with non-AUINT8 type.

Message #

ByteArray form flag used with non-AUINT8 type

Event ID 1020: LongString form flag used with non-AUINT16 type

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

LongString form flag used with non-AUINT16 type.

Message #

LongString form flag used with non-AUINT16 type

Event ID 1021: Dataset not large enough for expected data

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Dataset not large enough for expected data.

Message #

Dataset not large enough for expected data

Event ID 1022: Error in DeviceInfo Dataset: DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in DeviceInfo Dataset: DataSet Offset Offset.

Message #

Error in DeviceInfo Dataset: DataSet Offset %1

Fields #

Name	Description
`Offset` UInt32

Event ID 1023: Error in StorageInfo Dataset: Storage ID ID, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in StorageInfo Dataset: Storage ID ID, DataSet Offset Offset.

Message #

Error in StorageInfo Dataset: Storage ID %1, DataSet Offset %2

Fields #

Name	Description
`ID` UInt32
`Offset` UInt32

Event ID 1024: Error in ServiceInfo Dataset: Service ID ID, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ServiceInfo Dataset: Service ID ID, DataSet Offset Offset.

Message #

Error in ServiceInfo Dataset: Service ID %1, DataSet Offset %2

Fields #

Name	Description
`ID` UInt32
`Offset` UInt32

Event ID 1025: Error in ObjectInfo Dataset: Object ID ID, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectInfo Dataset: Object ID ID, DataSet Offset Offset.

Message #

Error in ObjectInfo Dataset: Object ID %1, DataSet Offset %2

Fields #

Name	Description
`ID` UInt32
`Offset` UInt32

Event ID 1026: Error in DevicePropDesc Dataset: Property ID ID, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in DevicePropDesc Dataset: Property ID ID, DataSet Offset Offset.

Message #

Error in DevicePropDesc Dataset: Property ID %1, DataSet Offset %2

Fields #

Name	Description
`ID` UInt32
`Offset` UInt32

Event ID 1027: Invalid string specification

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Invalid string specification.

Message #

Invalid string specification

Event ID 1028: Unable to parse value for MTP DataType Code.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Unable to parse value for MTP DataType Code.

Message #

Unable to parse value for MTP DataType %1

Fields #

Name	Description
`Code` UInt32

Event ID 1029: Error in ServiceIDs: declared Expected elements, but only space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ServiceIDs: declared Expected elements, but only space to hold Actual elements.

Message #

Error in ServiceIDs: declared %1 elements, but only space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1030: Warning in ServiceIDs: declared Expected elements, but space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Warning in ServiceIDs: declared Expected elements, but space to hold Actual elements.

Message #

Warning in ServiceIDs: declared %1 elements, but space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1031: Error in ServiceIDs: count of Offset exceeds system limits.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ServiceIDs: count of Offset exceeds system limits.

Message #

Error in ServiceIDs: count of %1 exceeds system limits

Fields #

Name	Description
`Offset` UInt32

Event ID 1032: Error in StorageIDs: declared Expected elements, but only space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in StorageIDs: declared Expected elements, but only space to hold Actual elements.

Message #

Error in StorageIDs: declared %1 elements, but only space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1033: Warning in StorageIDs: declared Expected elements, but space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Warning in StorageIDs: declared Expected elements, but space to hold Actual elements.

Message #

Warning in StorageIDs: declared %1 elements, but space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1034: Error in StorageIDs: count of Offset exceeds system limits.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in StorageIDs: count of Offset exceeds system limits.

Message #

Error in StorageIDs: count of %1 exceeds system limits

Fields #

Name	Description
`Offset` UInt32

Event ID 1035: Error in ObjectHandles: declared Expected elements, but only space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectHandles: declared Expected elements, but only space to hold Actual elements.

Message #

Error in ObjectHandles: declared %1 elements, but only space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1036: Warning in ObjectHandles: declared Expected elements, but space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Warning in ObjectHandles: declared Expected elements, but space to hold Actual elements.

Message #

Warning in ObjectHandles: declared %1 elements, but space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1037: Error in ObjectHandles: count of Offset exceeds system limits.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectHandles: count of Offset exceeds system limits.

Message #

Error in ObjectHandles: count of %1 exceeds system limits

Fields #

Name	Description
`Offset` UInt32

Event ID 1038: Error in ObjectReferences: declared Expected elements, but only space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectReferences: declared Expected elements, but only space to hold Actual elements.

Message #

Error in ObjectReferences: declared %1 elements, but only space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1039: Warning in ObjectReferences: declared Expected elements, but space to hold Actual elements.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Warning in ObjectReferences: declared Expected elements, but space to hold Actual elements.

Message #

Warning in ObjectReferences: declared %1 elements, but space to hold %2 elements

Fields #

Name	Description
`Expected` UInt32
`Actual` UInt32

Event ID 1040: Error in ObjectReferences: count of Offset exceeds system limits.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in ObjectReferences: count of Offset exceeds system limits.

Message #

Error in ObjectReferences: count of %1 exceeds system limits

Fields #

Name	Description
`Offset` UInt32

Event ID 1041: Duplicate Namespace and ID PKeyGuid.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Duplicate Namespace and ID PKeyGuid.PKeyId (ignored).

Message #

Duplicate Namespace and ID %1.%2 (ignored)

Fields #

Name	Description
`PKeyGuid` UnicodeString
`PKeyId` UInt32

Event ID 1042: Duplicate Format ID Guid (ignored).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Duplicate Format ID Guid (ignored).

Message #

Duplicate Format ID %1 (ignored)

Fields #

Name	Description
`Guid` UnicodeString

Event ID 1043: Duplicate Method ID Guid (ignored).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Duplicate Method ID Guid (ignored).

Message #

Duplicate Method ID %1 (ignored)

Fields #

Name	Description
`Guid` UnicodeString

Event ID 1044: Duplicate Event ID Guid (ignored).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Duplicate Event ID Guid (ignored).

Message #

Duplicate Event ID %1 (ignored)

Fields #

Name	Description
`Guid` UnicodeString

Event ID 1045: Duplicate PropCode ID Prop for Service Format Code (ignored).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Duplicate PropCode ID Prop for Service Format Code (ignored).

Message #

Duplicate PropCode ID %2 for Service Format %1 (ignored)

Fields #

Name	Description
`Code` UInt32
`Prop` UInt32

Event ID 1046: Ambiguous mapping of Namespace and ID PKeyGuid.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Ambiguous mapping of Namespace and ID PKeyGuid.PKeyId to both PropCodes CurrentCode and OriginalCode (ignored).

Message #

Ambiguous mapping of Namespace and ID %1.%2 to both PropCodes %3 and %4 (ignored)

Fields #

Name	Description
`PKeyGuid` UnicodeString
`PKeyId` UInt32
`CurrentCode` UInt32
`OriginalCode` UInt32

Event ID 1047: Empty Hints Service data block

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Empty Hints Service data block.

Message #

Empty Hints Service data block

Event ID 1048: Hints Service data block is of invalid size

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Hints Service data block is of invalid size.

Message #

Hints Service data block is of invalid size

Event ID 1049: Unrecognized MTP DataType Code.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Unrecognized MTP DataType Code.

Message #

Unrecognized MTP DataType %1

Fields #

Name	Description
`Code` UInt32

Event ID 1050: MaxLength of Offset is too large for associated MTP DataType.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

MaxLength of Offset is too large for associated MTP DataType.

Message #

MaxLength of %1 is too large for associated MTP DataType

Fields #

Name	Description
`Offset` UInt32

Event ID 1051: Unrecognized MTP FormFlag Code.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Unrecognized MTP FormFlag Code.

Message #

Unrecognized MTP FormFlag %1

Fields #

Name	Description
`Code` UInt32

Event ID 1052: Abstract property PKeyGuid.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Abstract property PKeyGuid.PKeyId redefined by service ID.

Message #

Abstract property %1.%2 redefined by service %3

Fields #

Name	Description
`PKeyGuid` UnicodeString
`PKeyId` UInt32
`ID` UInt32

Event ID 1053: Abstract format PKeyGuid redefined by service ID.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Abstract format PKeyGuid redefined by service ID.

Message #

Abstract format %1 redefined by service %2

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1054: Abstract method PKeyGuid redefined by service ID.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Abstract method PKeyGuid redefined by service ID.

Message #

Abstract method %1 redefined by service %2

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1055: Abstract event PKeyGuid redefined by service ID.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Abstract event PKeyGuid redefined by service ID.

Message #

Abstract event %1 redefined by service %2

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1056: Warning in ServiceInfo Dataset: Service ID Code, left-over bytes ignored at end of dataset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Warning in ServiceInfo Dataset: Service ID Code, left-over bytes ignored at end of dataset.

Message #

Warning in ServiceInfo Dataset: Service ID %1, left-over bytes ignored at end of dataset

Fields #

Name	Description
`Code` UInt32

Event ID 1057: Ignoring reference by Service ID ID to concrete service PKeyGuid.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Ignoring reference by Service ID ID to concrete service PKeyGuid.

Message #

Ignoring reference by Service ID %2 to concrete service %1

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1058: Service ID ID referencing unknown service PKeyGuid.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Service ID ID referencing unknown service PKeyGuid.

Message #

Service ID %2 referencing unknown service %1

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1059: Service ID ID specifies unknown service flag Code (expecting Standard or Abstract).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Service ID ID specifies unknown service flag Code (expecting Standard or Abstract).

Message #

Service ID %1 specifies unknown service flag %2 (expecting Standard or Abstract)

Fields #

Name	Description
`ID` UInt32
`Code` UInt32

Event ID 1060: Error in Dataset: count of Offset exceeds system limits.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in Dataset: count of Offset exceeds system limits.

Message #

Error in Dataset: count of %1 exceeds system limits

Fields #

Name	Description
`Offset` UInt32

Event ID 1061: Device does not support bulk version of GetServiceCapabilities

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Device does not support bulk version of GetServiceCapabilities.

Message #

Device does not support bulk version of GetServiceCapabilities

Event ID 1062: Device does not support bulk version of GetServiceProperties

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Device does not support bulk version of GetServiceProperties.

Message #

Device does not support bulk version of GetServiceProperties

Event ID 1063: Method ID PKeyGuid referencing unknown association format ID.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Method ID PKeyGuid referencing unknown association format ID.

Message #

Method ID %1 referencing unknown association format %2

Fields #

Name	Description
`PKeyGuid` UnicodeString
`ID` UInt32

Event ID 1064: Device does not support bulk version of GetFormatCapabilities

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Device does not support bulk version of GetFormatCapabilities.

Message #

Device does not support bulk version of GetFormatCapabilities

Event ID 1065: Error in FormatCapabilities Dataset: Format ID Code, DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in FormatCapabilities Dataset: Format ID Code, DataSet Offset Offset.

Message #

Error in FormatCapabilities Dataset: Format ID %1, DataSet Offset %2

Fields #

Name	Description
`Code` UInt32
`Offset` UInt32

Event ID 1066: Bluetooth transport driver has terminated an MTP Bluetooth connection due to failure to recover from a transport error (MTP OpCode Code).

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DriverOperation

Description

Bluetooth transport driver has terminated an MTP Bluetooth connection due to failure to recover from a transport error (MTP OpCode Code).

Message #

Bluetooth transport driver has terminated an MTP Bluetooth connection due to failure to recover from a transport error (MTP OpCode %1).

Fields #

Name	Description
`Code` UInt32

Event ID 1067: Error in GetObjectPropsSupported Dataset: DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in GetObjectPropsSupported Dataset: DataSet Offset Offset.

Message #

Error in GetObjectPropsSupported Dataset: DataSet Offset %1

Fields #

Name	Description
`Offset` UInt32

Event ID 1068: Error in GetObjectPropList Dataset: DataSet Offset Offset.

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Operational
Task: DeviceError

Description

Error in GetObjectPropList Dataset: DataSet Offset Offset.

Message #

Error in GetObjectPropList Dataset: DataSet Offset %1

Fields #

Name	Description
`Offset` UInt32

Event ID 2000: MTP Request

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Request.

Message #

MTP Request

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Opcode` UInt16
`MTP_Command_Param_count` UInt32
`MTP_Command_Params` UInt32

Event ID 2001: MTP Data(in) and Response

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Data(in) and Response.

Message #

MTP Data(in) and Response

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Opcode` UInt16
`MTP_Command_Param_count` UInt32
`MTP_Command_Params` UInt32
`MTP_Response_Retrieval_HR_From_Transport` UInt32
`MTP_Response_Code` UInt16
`MTP_Response_Param_count` UInt32
`MTP_Response_Params` UInt32
`MTP_Data_Length` UInt32
`MTP_Data_Buffer` Binary

Event ID 2002: MTP Data(in) and Response for GetDevice/ObjectPropValue

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Data(in) and Response for GetDevice/ObjectPropValue.

Message #

MTP Data(in) and Response for GetDevice/ObjectPropValue

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Opcode` UInt16
`MTP_Command_Param_count` UInt32
`MTP_Command_Params` UInt32
`MTP_Response_Code` UInt16
`MTP_Response_Param_count` UInt32
`MTP_Response_Params` UInt32
`MTP_DatatypeOfPropValue` UInt16
`MTP_Data_Length` UInt32
`MTP_Data_Buffer` Binary

Event ID 2003: MTP Response

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Response.

Message #

MTP Response

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Response_Retrieval_HR_From_Transport` UInt32
`MTP_Response_Code` UInt16
`MTP_Response_Param_count` UInt32
`MTP_Response_Params` UInt32

Event ID 2004: MTP Event received from device

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Event received from device.

Message #

MTP Event received from device

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Event_Retrieval_HR_From_Transport` UInt32
`MTP_Event_Code` UInt16
`MTP_Event_Param_count` UInt32
`MTP_Event_Params` UInt32

Event ID 2005: MTP Bulk GetObjectProperties by Object Format

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Bulk GetObjectProperties by Object Format.

Message #

MTP Bulk GetObjectProperties by Object Format

Fields #

Name	Description
`MTPBulkGetObjProps_size` UInt32
`MTPBulkGetObjProps_buffer` Binary

Event ID 2006: MTP Request and Data(out)

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Request and Data(out).

Message #

MTP Request and Data(out)

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Opcode` UInt16
`MTP_Command_Param_count` UInt32
`MTP_Command_Params` UInt32
`MTP_Data_Length` UInt32
`MTP_Data_Buffer` Binary

Event ID 2007: MTP Request and Data(out) for SetDevice/ObjectPropValue

Provider: Microsoft-Windows-WPD-MTPClassDriver
Channel: Analytic
Opcode: Info

Description

MTP Request and Data(out) for SetDevice/ObjectPropValue.

Message #

MTP Request and Data(out) for SetDevice/ObjectPropValue

Fields #

Name	Description
`SessionID` UInt32
`TransactionID` UInt32
`MTP_Opcode` UInt16
`MTP_Command_Param_count` UInt32
`MTP_Command_Params` UInt32
`MTP_DatatypeOfPropValue` UInt16
`MTP_Data_Length` UInt32
`MTP_Data_Buffer` Binary

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 21b7c16e-c5af-4a69-a74a-7245481c1b97

Defined in wpd_ci.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)