Microsoft-Windows-Bluetooth-MTPEnum

9 events across 1 channel

Event	Title	Channel
100	MTP Bluetooth enumerator driver is operational with status code (StatusCode).	Operational
101	MTP Bluetooth enumerator driver has failed to operate with error code …	Operational
102	MTP Bluetooth enumerator driver has created a device object with status code …	Operational
103	MTP Bluetooth enumerator driver has failed to create a device object with error …	Operational
200	An MTP Bluetooth Link between PC and an MTP Bluetooth device has been …	Operational
201	An MTP Bluetooth Link between PC and an MTP Bluetooth device has been …	Operational
202	An MTP Bluetooth Link connection is being initiated by (Name).	Operational
203	An MTP Bluetooth Link connection is being disassociated by (Name).	Operational
204	An MTP Bluetooth Link between PC and an MTP Bluetooth device has been …	Operational

Event ID 100: MTP Bluetooth enumerator driver is operational with status code (StatusCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: DriverHealth

Description

MTP Bluetooth enumerator driver is operational with status code (StatusCode).

Message #

MTP Bluetooth enumerator driver is operational with status code (%1).

Fields #

Name	Description
`StatusCode` UInt32	NTSTATUS reference

Event ID 101: MTP Bluetooth enumerator driver has failed to operate with error code (StatusCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: DriverHealth

Description

MTP Bluetooth enumerator driver has failed to operate with error code (StatusCode).

Message #

MTP Bluetooth enumerator driver has failed to operate with error code (%1).

Fields #

Name	Description
`StatusCode` UInt32	NTSTATUS reference

Event ID 102: MTP Bluetooth enumerator driver has created a device object with status code (StatusCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: DriverHealth

Description

MTP Bluetooth enumerator driver has created a device object with status code (StatusCode).

Message #

MTP Bluetooth enumerator driver has created a device object with status code (%1).

Fields #

Name	Description
`StatusCode` UInt32	NTSTATUS reference

Event ID 103: MTP Bluetooth enumerator driver has failed to create a device object with error code (StatusCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: DriverHealth

Description

MTP Bluetooth enumerator driver has failed to create a device object with error code (StatusCode).

Message #

MTP Bluetooth enumerator driver has failed to create a device object with error code (%1).

Fields #

Name	Description
`StatusCode` UInt32	NTSTATUS reference

Event ID 200: An MTP Bluetooth Link between PC and an MTP Bluetooth device has been established (ResultCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: LinkState

Description

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been established (ResultCode).

Message #

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been established (%1).

Fields #

Name	Description
`ResultCode` UInt32

Event ID 201: An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (ResultCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: LinkState

Description

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (ResultCode).

Message #

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (%1).

Fields #

Name	Description
`ResultCode` UInt32

Event ID 202: An MTP Bluetooth Link connection is being initiated by (Name).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: LinkState

Description

An MTP Bluetooth Link connection is being initiated by (Name).

Message #

An MTP Bluetooth Link connection is being initiated by (%1).

Fields #

Name	Description
`Name` UnicodeString

Event ID 203: An MTP Bluetooth Link connection is being disassociated by (Name).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: LinkState

Description

An MTP Bluetooth Link connection is being disassociated by (Name).

Message #

An MTP Bluetooth Link connection is being disassociated by (%1).

Fields #

Name	Description
`Name` UnicodeString

Event ID 204: An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (ResultCode).

Provider: Microsoft-Windows-Bluetooth-MTPEnum
Channel: Operational
Task: LinkState

Description

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (ResultCode).

Message #

An MTP Bluetooth Link between PC and an MTP Bluetooth device has been disassociated (%1).

Fields #

Name	Description
`ResultCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 04268430-d489-424d-b914-0cff741d6684

Defined in wpd_ci.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.2849 · captured 2026-06-02
Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02

Downloads

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)