Microsoft-Windows-DHCPv6-Client
127 events across 3 channels
Event ID 1000 — Your computer has lost the lease to its IP address %1 on the Network Card with network address %3.
Message
Fields
| Name | Description |
|---|---|
InterfaceGUID | — |
HWLength | — |
HWAddress | — |
Event ID 1003 — Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address %2.
Message
Fields
| Name | Description |
|---|---|
HWLength | — |
HWAddress | — |
StatusCode | — |
Event ID 1004 — Error occurred in stopping the Dhcpv6 client service.
Message
Fields
| Name | Description |
|---|---|
StatusCode | — |
DwordVal | — |
Event ID 1005 — Your computer has detected that the IP address %1 for the Network Card with network address %3 is already in use on the network.
Message
Fields
| Name | Description |
|---|---|
InterfaceGUID | — |
HWLength | — |
HWAddress | — |
Event ID 1006 — Router Advertisement settings have been changed on the network adapter %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Flag1 | — |
Flag2 | — |
Event ID 1008 — An error occurred in initializing the interface.
Message
Fields
| Name | Description |
|---|---|
StatusCode | — |
Event ID 1009 — MAC Address %2 in DUID %4 could not be found in the system.
Message
Fields
| Name | Description |
|---|---|
HWLength | — |
HWAddress | — |
DUIDLength | — |
DUID | — |
NewHWLength | — |
NewHWAddress | — |
NewDUIDLength | — |
NewDUID | — |
Example Event
system:
provider: Microsoft-Windows-DHCPv6-Client
guid: 6A1F2B00-6A90-4C38-95A5-5CAB3B056778
event_source_name: ''
event_id: 1009
version: 0
level: 4
task: 4
opcode: 98
keywords: 9223372036854775808
time_created: '2023-10-25T22:48:31.137277+00:00'
event_record_id: 3
correlation: {}
execution:
process_id: 2076
thread_id: 2260
channel: Microsoft-Windows-Dhcpv6-Client/Admin
computer: WinDevEval
security:
user_id: S-1-5-19
event_data:
HWLength: 6
HWAddress: 000C29794FE7
DUIDLength: 14
DUID: 000100012CCB4881000C29794FE7
NewHWLength: 6
NewHWAddress: 000C29B19818
NewDUIDLength: 14
NewDUID: 000100012CCB5397000C29B19818
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1010 — DHCPv6 has found SSID %1 in the cached networks for interface %4.
Message
Fields
| Name | Description |
|---|---|
NetworkHintString | — |
NetworkHint | — |
HWLength | — |
HWAddress | — |
Event ID 1011 — DHCPv6 found a valid IPv6 address %1 and options in the cache for network SSID %2 under interface %4.
Message
Fields
| Name | Description |
|---|---|
Address1 | — |
NetworkHintString | — |
NetworkHint | — |
HWLength | — |
HWAddress | — |
Event ID 1012 — DHCPv6 found options in the cache for network %1 under interface %4.
Message
Fields
| Name | Description |
|---|---|
NetworkHintString | — |
NetworkHint | — |
HWLength | — |
HWAddress | — |
Event ID 1013 — DHCPv6 client found expired cached configuration for network %1 under interface %3.
Message
Fields
| Name | Description |
|---|---|
NetworkHintString | — |
NetworkHint | — |
HWLength | — |
HWAddress | — |
Event ID 1014 — IPv6 Address is unplumbed, Interface %1 uninitialized.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1015 — Failed to Unplumb IPv6 Address %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1016 — Failed to Update Registry %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1017 — Unable to register with DNS %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1018 — Trying to Add or Update %1 on %2.
Message
Fields
| Name | Description |
|---|---|
Address | — |
AdapterName | — |
Event ID 1019 — Address Conflict Detected for RAS.
Message
Event ID 1020 — Number of requests in queue are above LONG_MAX.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1021 — Error in creating renewal thread.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1022 — Error in forever request thread.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1023 — Error in Media Connected.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1024 — Media Disconnected on %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1025 — MEDIA DISCONNECT: Someone still using context.
Message
Event ID 1026 — Error Media Disconnected.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1027 — FAILED TO PLUMB %1 in %2.
Message
Fields
| Name | Description |
|---|---|
Address | — |
AdapterName | — |
ErrorCode | — |
Event ID 1028 — Lease Acquisition Success in %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1029 — Event NACK Lease in %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1030 — Failed to release IPV6 Address on %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
Event ID 1031 — Error in getting interface metric.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1032 — Error in enumerating hardware address.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1033 — Unable to get Link characteristics.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1034 — Error in adding Ipv6 Address %1.
Message
Fields
| Name | Description |
|---|---|
Address | — |
ErrorCode | — |
Event ID 1035 — Successfully deleted Ipv6 Address %1.
Message
Fields
| Name | Description |
|---|---|
Address | — |
Event ID 1036 — Error in deleting Ipv6 Address %1.
Message
Fields
| Name | Description |
|---|---|
Address | — |
ErrorCode | — |
Event ID 1037 — Error in updating Ipv6 Address.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1038 — Error in enumerating Interface.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1039 — Error in Querying for RA Settings.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1040 — Error in Callback of Media Sense.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1041 — Error in initializing Media Sense.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1042 — Error in getting static parameters from stack.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1043 — Error in getting All parameters from stack.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 1044 — Error in querying DNS config for Adapter %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1045 — Error in Registering Address with DNS %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1046 — Error in Deregistering Address with DNS %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1047 — Error in DynDnsRegister Adapter %1.
Message
Fields
| Name | Description |
|---|---|
AdapterName | — |
ErrorCode | — |
Event ID 1048 — Failed to Acquire Wcm in Disconnected Standby.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Event ID 50057 — A network error occurred when trying to send a message.
Message
Fields
| Name | Description |
|---|---|
StatusCode | — |
Event ID 50071 — Attempting to acquire a reference for interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 50072 — Attempting to release the reference for interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51001 — Media Connect notification has been received on interface with interface id %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51002 — Media Disconnect notification has been received on interface with interface id %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51004 — Confirm-Reply is initiated on the interface with Interface Id %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51005 — Solicit-Advertise-Request-Reply is initiated on the interface with Interface Id %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
DwordVal2 | — |
Event ID 51006 — Solicit is sent from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51007 — Advertise is received from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Address | — |
Event ID 51008 — Advertise is discarded from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51009 — Request is sent from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51010 — A valid reply is received for request from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Address | — |
Event ID 51011 — Incorrect reply is received for request from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51012 — Renew is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51013 — A valid reply is received for renew from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51014 — An invalid reply is received for renew from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51015 — Rebind is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51016 — A valid reply is received for rebind from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51017 — An invalid reply is received for rebind from the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51018 — Release is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51019 — Decline is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51020 — A valid reply is received for decline on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51021 — An invalid reply is received for decline on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51022 — Confirm is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51023 — A valid reply is received for confirm on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51024 — An invalid reply is received for confirm on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51025 — Info-request is sent on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51026 — A valid reply is received for Info-request on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51027 — An invalid reply is received for Info-request on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51029 — An error occurred in creation of packet on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51030 — An error occurred in extracting options from the message received on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51031 — DHCP is changed from stateful to stateless mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Dword1 | — |
Dword2 | — |
Event ID 51032 — DHCP is changed from stateless to stateful mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51033 — DHCP is changed from nondhcp to stateful mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51034 — DHCP is changed from nondhcp to stateless mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Dword1 | — |
Dword2 | — |
Event ID 51035 — DHCP is converted to static mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51036 — Error occurred in parsing the DHCP message received on the interface id %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51037 — Information refresh time option is received in the interface %1 with a refresh time value of %2.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
RefreshTime | — |
Event ID 51038 — The information refresh time has expired, hence triggering a new inform packet on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51039 — Address %1 is plumbed on the interface %2.
Message
Fields
| Name | Description |
|---|---|
Address | — |
InterfaceId | — |
StatusCode | — |
Event ID 51040 — Address %1 is unplumbed on the interface %2.
Message
Fields
| Name | Description |
|---|---|
Address | — |
InterfaceId | — |
StatusCode | — |
Event ID 51043 — An interface is added whose interface index is %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51044 — An error occurred in initializing the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51045 — An error occurred in plumbing the parameters into stack.
Message
Fields
| Name | Description |
|---|---|
StatusCode | — |
Event ID 51046 — DHCPv6 client service is started
Message
Example Event
system:
provider: Microsoft-Windows-DHCPv6-Client
guid: 6A1F2B00-6A90-4C38-95A5-5CAB3B056778
event_source_name: ''
event_id: 51046
version: 0
level: 4
task: 4
opcode: 62
keywords: 2305843009213693952
time_created: '2023-11-06T06:25:40.191684+00:00'
event_record_id: 1679
correlation: {}
execution:
process_id: 2372
thread_id: 2512
channel: System
computer: WinDev2310Eval
security:
user_id: S-1-5-19
event_data: {}
message: ''
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 51047 — DHCPv6 client service is stopped. ShutDown Flag value is DwordVal
Message
Fields
| Name | Description |
|---|---|
DwordVal | — |
Example Event
system:
provider: Microsoft-Windows-DHCPv6-Client
guid: 6A1F2B00-6A90-4C38-95A5-5CAB3B056778
event_source_name: ''
event_id: 51047
version: 0
level: 4
task: 4
opcode: 63
keywords: 2305843009213693952
time_created: '2023-11-05T22:31:36.932069+00:00'
event_record_id: 1854
correlation: {}
execution:
process_id: 2232
thread_id: 2424
channel: System
computer: WinDev2310Eval
security:
user_id: S-1-5-19
event_data:
DwordVal: 1
message: ''
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 51048 — An error has occurred in opening the socket on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51049 — An error has occurred in closing the socket on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51050 — DNS registration has happened for the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Dword | — |
Event ID 51051 — DNS deregistration has happened for the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51057 — DHCPv6 client service stop is almost done.
Message
Fields
| Name | Description |
|---|---|
DwordVal | — |
Example Event
system:
provider: Microsoft-Windows-DHCPv6-Client
guid: 6A1F2B00-6A90-4C38-95A5-5CAB3B056778
event_source_name: ''
event_id: 51057
version: 0
level: 4
task: 4
opcode: 104
keywords: 2305843009213693952
time_created: '2023-11-05T22:31:36.932388+00:00'
event_record_id: 1856
correlation: {}
execution:
process_id: 2232
thread_id: 2424
channel: System
computer: WinDev2310Eval
security:
user_id: S-1-5-19
event_data:
DwordVal: 1
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 51058 — DHCP is changed from stateful to stateful mode on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
StatusCode | — |
Event ID 51059 — Message is Invalid and it is discarded.
Message
Event ID 51060 — The Class ID %1 was set for the interface %3.
Message
Fields
| Name | Description |
|---|---|
InterfaceGUID | — |
HWLength | — |
HWAddress | — |
Event ID 51061 — Address %1 being plumbed for adapter %2 already exists.
Message
Fields
| Name | Description |
|---|---|
Address | — |
InterfaceId | — |
Event ID 51062 — Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address %2.
Message
Fields
| Name | Description |
|---|---|
HWLength | — |
HWAddress | — |
StatusCode | — |
Event ID 51063 — Firewall port %1 is exempted on interface %2.
Message
Fields
| Name | Description |
|---|---|
DwordVal | — |
InterfaceId | — |
DwordVal1 | — |
Event ID 51064 — Firewall port %1 is closed on interface %2.
Message
Fields
| Name | Description |
|---|---|
DwordVal | — |
InterfaceId | — |
DwordVal1 | — |
Event ID 51065 — DHCP is changing mode to %2 on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
NewMode | — |
Event ID 51066 — Regular address acquisition will be done on interface %1 because aggressive address acquisition is turned ON.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51067 — DHCP has cancelled IPv6 address acquisition cycle after %1 SOLICIT transmissions on interface %2 because the machine is in Connected Standby state ...
Message
Fields
| Name | Description |
|---|---|
DwordVal1 | — |
InterfaceId | — |
Address1 | — |
DwordVal2 | — |
DwordVal3 | — |
Event ID 51068 — DHCP has cancelled IPv6 address acquisition cycle after %1 SOLICIT transmissions on interface %2 because the machine is in Connected Standby state ...
Message
Fields
| Name | Description |
|---|---|
DwordVal1 | — |
InterfaceId | — |
Address1 | — |
DwordVal2 | — |
DwordVal3 | — |
Event ID 51069 — DHCP will not try regular IPv6 address acquisition on interface %1 since the machine is in Connected Standby state and the interface has the IPv4 a...
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Address1 | — |
DwordVal1 | — |
DwordVal2 | — |
Event ID 51070 — DHCP will try regular IPv6 address acquisition on interface %1 even though the machine is in Connected Standby state since the interface has no IPv...
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
DwordVal2 | — |
Event ID 51073 — Firewall port %2 exemption triggered on interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
Event ID 51074 — Firewall port %2 close triggered on interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
Event ID 51075 — The DHCPv6 client received connected standby entry notification.
Message
Event ID 51076 — The DHCPv6 client received connected standby exit notification.
Message
Event ID 51077 — DHCP will try regular IPv6 address acquisition on interface %1 due to registry settings even though the machine is in Connected Standby state and t...
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
DwordVal2 | — |
Event ID 51078 — DHCP is enabled on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
Event ID 51079 — DHCP is disabled on the interface %1.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
Event ID 51080 — DHCP transaction will not be attempted on interface %1 because DHCP is disabled on it.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51081 — DHCP has cancelled IPv6 address acquisition cycle after %1 SOLICIT transmissions on interface %2 because the machine is in Connected Standby state ...
Message
Fields
| Name | Description |
|---|---|
DwordVal1 | — |
InterfaceId | — |
Address | — |
DwordVal2 | — |
DwordVal3 | — |
Event ID 51082 — DHCP has cancelled IPv6 address acquisition cycle after %1 SOLICIT transmissions on interface %2 because the machine is in Connected Standby state ...
Message
Fields
| Name | Description |
|---|---|
DwordVal1 | — |
InterfaceId | — |
Address | — |
DwordVal2 | — |
DwordVal3 | — |
Event ID 51083 — DHCP has cancelled IPv6 address acquisition on interface %1 because the interface is not multicast enabled.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
Event ID 51084 — The values of flags received on interface %1 are: Managed Flag value %2 OtherConfig Flag value %3.
Message
Fields
| Name | Description |
|---|---|
InterfaceId | — |
DwordVal1 | — |
DwordVal2 | — |
Event ID 51085 — Firewall port exemption is in progress but incomplete.
Message
Fields
| Name | Description |
|---|---|
DwordVal | — |
Event ID 60000 — PERFTRACK (DHCPSOLICIT): Offer is accepted on the IPv6 interface %2.
Message
Fields
| Name | Description |
|---|---|
InterfaceGuid | — |
InterfaceId | — |
Address1 | — |
Event ID 60001 — PERFTRACK (DHCINFORMATIONREQUEST): Options received on the IPv6 interface %2.
Message
Fields
| Name | Description |
|---|---|
InterfaceGuid | — |
InterfaceId | — |
Event ID 60002 — PERFTRACK (DHCPv6): Media Connect on interface %2.
Message
Fields
| Name | Description |
|---|---|
InterfaceGuid | — |
InterfaceId | — |
Event ID 60003 — PERFTRACK (DHCPv6): End of Media Connect on interface %2.
Message
Fields
| Name | Description |
|---|---|
InterfaceGuid | — |
InterfaceId | — |