detection.wiki

Microsoft-Windows-CoreSystem-InitMachineConfig

6 events across 1 channel

Event IDTitleChannel
1An error with reference Id=evtErrorId was encountered while processing the hive …System
2Initial Machine Configuration processing of hive 'evtHiveName' has completed.System
3Initial Machine Configuration was unable to unload the IMC hive once processing …System
4Initial Machine Configuration was unable to update the system BCD to prevent …System
5Value blocked: evtValueNameLength under the key, evtKeyPathLength, was NOT set …System
6Value set: evtValueNameLength under the key, evtKeyPathLength, was set after …System

Event ID 1 — An error with reference Id=evtErrorId was encountered while processing the hive 'evtHiveName'.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

An error with reference Id=evtErrorId was encountered while processing the hive 'evtHiveName'. The status was: evtStatus. The additional information was evtAdditionalInfo.

Message #

An error with reference Id=%1 was encountered while processing the hive '%3'. The status was: %4.  The additional information was %5.

Fields #

NameDescription
evtErrorId UInt64—
evtHiveNameLength UInt16—
evtHiveName UnicodeString—
evtStatus HexInt32—
evtAdditionalInfo HexInt64—

Event ID 2 — Initial Machine Configuration processing of hive 'evtHiveName' has completed.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

Initial Machine Configuration processing of hive 'evtHiveName' has completed.

Message #

Initial Machine Configuration processing of hive '%2' has completed.

Fields #

NameDescription
evtHiveNameLength UInt16—
evtHiveName UnicodeString—

Event ID 3 — Initial Machine Configuration was unable to unload the IMC hive once processing was completed.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

Initial Machine Configuration was unable to unload the IMC hive once processing was completed. The status was evtStatus.

Message #

Initial Machine Configuration was unable to unload the IMC hive once processing was completed.  The status was %1.

Fields #

NameDescription
evtStatus HexInt32—

Event ID 4 — Initial Machine Configuration was unable to update the system BCD to prevent future execution.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

Initial Machine Configuration was unable to update the system BCD to prevent future execution. The status was evtStatus.

Message #

Initial Machine Configuration was unable to update the system BCD to prevent future execution.  The status was %1.

Fields #

NameDescription
evtStatus HexInt32—

Event ID 5 — Value blocked: evtValueNameLength under the key, evtKeyPathLength, was NOT set after failing validation.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

Value blocked: evtValueNameLength under the key, evtKeyPathLength, was NOT set after failing validation.

Message #

Value blocked: %4 under the key, %2, was NOT set after failing validation.

Fields #

NameDescription
Value_blocked—
evtKeyPathLength UInt16—
evtKeyPath UnicodeString—
evtValueNameLength UInt16—
evtValueName UnicodeString—

Event ID 6 — Value set: evtValueNameLength under the key, evtKeyPathLength, was set after passing validation.

Provider
Microsoft-Windows-CoreSystem-InitMachineConfig
Channel
System

Description

Value set: evtValueNameLength under the key, evtKeyPathLength, was set after passing validation.

Message #

Value set: %4 under the key, %2, was set after passing validation.

Fields #

NameDescription
Value_set—
evtKeyPathLength UInt16—
evtKeyPath UnicodeString—
evtValueNameLength UInt16—
evtValueName UnicodeString—