Microsoft-Windows-DHCPv6-Client
127 events across 3 channels
Event ID 1000 — Your computer has lost the lease to its IP address InterfaceGUID on the Network Card with network address HWAddress.
Event ID 1003 — Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address HWAddress.
Event ID 1004 — Error occurred in stopping the Dhcpv6 client service.
Event ID 1005 — Your computer has detected that the IP address InterfaceGUID for the Network Card with network address HWAddress is already in use on the network.
Description
Your computer has detected that the IP address InterfaceGUID for the Network Card with network address HWAddress is already in use on the network. Your computer will automatically attempt to obtain a different address.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceGUID UnicodeString | — |
HWLength UInt32 | — |
HWAddress Binary | — |
Event ID 1006 — Router Advertisement settings have been changed on the network adapter InterfaceId.
Event ID 1008 — An error occurred in initializing the interface.
Event ID 1009 — MAC Address HWAddress in DUID DUID could not be found in the system.
#Description
MAC Address HWAddress in DUID DUID could not be found in the system. Generated new DUID NewDUID based on MAC address NewHWAddress.
Message #
Fields #
| Name | Description |
|---|---|
HWLength UInt32 | — |
HWAddress Binary | — |
DUIDLength UInt32 | — |
DUID Binary | — |
NewHWLength UInt32 | — |
NewHWAddress Binary | — |
NewDUIDLength UInt32 | — |
NewDUID Binary | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1009,
"version": 0,
"level": 4,
"task": 4,
"opcode": 98,
"keywords": 9223372036854775808,
"time_created": "2023-10-25T22:48:31.137277+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 2076,
"thread_id": 2260
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Admin",
"computer": "WinDevEval",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"HWLength": 6,
"HWAddress": "000C29794FE7",
"DUIDLength": 14,
"DUID": "000100012CCB4881000C29794FE7",
"NewHWLength": 6,
"NewHWAddress": "000C29B19818",
"NewDUIDLength": 14,
"NewDUID": "000100012CCB5397000C29B19818"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1010 — DHCPv6 has found SSID NetworkHintString in the cached networks for interface HWAddress.
Event ID 1011 — DHCPv6 found a valid IPv6 address Address1 and options in the cache for network SSID NetworkHintString under interface HWLength.
Description
DHCPv6 found a valid IPv6 address Address1 and options in the cache for network SSID NetworkHintString under interface HWLength. DHCPv6 will use this cached configuration.
Message #
Fields #
| Name | Description |
|---|---|
Address1 Binary | — |
NetworkHintString UnicodeString | — |
NetworkHint UnicodeString | — |
HWLength UInt32 | — |
HWAddress Binary | — |
Event ID 1012 — DHCPv6 found options in the cache for network NetworkHintString under interface HWAddress.
Event ID 1013 — DHCPv6 client found expired cached configuration for network NetworkHintString under interface HWLength.
Description
DHCPv6 client found expired cached configuration for network NetworkHintString under interface HWLength. DHCPv6 client will discard the expired configuration and obtain new configuration from DHCPv6 server.
Message #
Fields #
| Name | Description |
|---|---|
NetworkHintString UnicodeString | — |
NetworkHint UnicodeString | — |
HWLength UInt32 | — |
HWAddress Binary | — |
Event ID 1014 — IPv6 Address is unplumbed, Interface AdapterName uninitialized.
Event ID 1015 — Failed to Unplumb IPv6 Address AdapterName.
Event ID 1016 — Failed to Update Registry AdapterName.
Event ID 1017 — Unable to register with DNS AdapterName.
Event ID 1018 — Trying to Add or Update Address on AdapterName.
Event ID 1019 — Address Conflict Detected for RAS.
Description
Address Conflict Detected for RAS.
Message #
Event ID 1020 — Number of requests in queue are above LONG_MAX.
Event ID 1021 — Error in creating renewal thread.
Event ID 1022 — Error in forever request thread.
Event ID 1023 — Error in Media Connected.
Description
Error in Media Connected. ErrorCode is ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1023,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.009781+00:00",
"event_record_id": 5,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2032
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"ErrorCode": 4294967295
},
"message": ""
}
Event ID 1024 — Media Disconnected on AdapterName.
Description
Media Disconnected on AdapterName.
Message #
Fields #
| Name | Description |
|---|---|
AdapterName UnicodeString | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1024,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:26:50.955401+00:00",
"event_record_id": 60,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7364
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"AdapterName": "{b009ef7d-3a19-47a7-aee7-9535aba6a145}"
},
"message": ""
}
Event ID 1025 — MEDIA DISCONNECT: Someone still using context.
Description
MEDIA DISCONNECT: Someone still using context. So not destroying the context.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1025,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:44:29.371521+00:00",
"event_record_id": 97,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 6176
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {},
"message": ""
}
Event ID 1026 — Error Media Disconnected.
Event ID 1027 — FAILED TO PLUMB Address in AdapterName.
Event ID 1028 — Lease Acquisition Success in AdapterName.
Event ID 1029 — Event NACK Lease in AdapterName.
Event ID 1030 — Failed to release IPV6 Address on AdapterName.
Event ID 1031 — Error in getting interface metric.
Event ID 1032 — Error in enumerating hardware address.
Event ID 1033 — Unable to get Link characteristics.
Description
Unable to get Link characteristics. Error code is ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1033,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.009759+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2032
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"ErrorCode": 4294967295
},
"message": ""
}
Event ID 1034 — Error in adding Ipv6 Address Address.
Event ID 1035 — Successfully deleted Ipv6 Address Address.
Event ID 1036 — Error in deleting Ipv6 Address Address.
Event ID 1037 — Error in updating Ipv6 Address.
Event ID 1038 — Error in enumerating Interface.
Event ID 1039 — Error in Querying for RA Settings.
Description
Error in Querying for RA Settings. Error code is ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1039,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:26:51.062114+00:00",
"event_record_id": 64,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2744
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"ErrorCode": 1168
},
"message": ""
}
Event ID 1040 — Error in Callback of Media Sense.
Description
Error in Callback of Media Sense. Error code is ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1040,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:26:51.062131+00:00",
"event_record_id": 65,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2744
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"ErrorCode": 1168
},
"message": ""
}
Event ID 1041 — Error in initializing Media Sense.
Event ID 1042 — Error in getting static parameters from stack.
Event ID 1043 — Error in getting All parameters from stack.
Description
Error in getting All parameters from stack. Error code is ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
ErrorCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 1043,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.009812+00:00",
"event_record_id": 6,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2032
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"ErrorCode": 259
},
"message": ""
}
Event ID 1044 — Error in querying DNS config for Adapter AdapterName.
Event ID 1045 — Error in Registering Address with DNS AdapterName.
Event ID 1046 — Error in Deregistering Address with DNS AdapterName.
Event ID 1047 — Error in DynDnsRegister Adapter AdapterName.
Event ID 1048 — Failed to Acquire Wcm in Disconnected Standby.
Event ID 50057 — A network error occurred when trying to send a message.
Event ID 50071 — Attempting to acquire a reference for interface InterfaceId.
Event ID 50072 — Attempting to release the reference for interface InterfaceId.
Event ID 51001 — Media Connect notification has been received on interface with interface id InterfaceId.
Description
Media Connect notification has been received on interface with interface id InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51001,
"version": 0,
"level": 4,
"task": 1,
"opcode": 11,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.009508+00:00",
"event_record_id": 2,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2032
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 1
},
"message": ""
}
Event ID 51002 — Media Disconnect notification has been received on interface with interface id InterfaceId.
Description
Media Disconnect notification has been received on interface with interface id InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51002,
"version": 0,
"level": 4,
"task": 1,
"opcode": 12,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:26:50.955380+00:00",
"event_record_id": 59,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7364
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 18
},
"message": ""
}
Event ID 51004 — Confirm-Reply is initiated on the interface with Interface Id InterfaceId.
Event ID 51005 — Solicit-Advertise-Request-Reply is initiated on the interface with Interface Id InterfaceId.
Description
Solicit-Advertise-Request-Reply is initiated on the interface with Interface Id InterfaceId. Managed Flag value DwordVal1 OtherConfig Flag value DwordVal2.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
DwordVal2 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51005,
"version": 0,
"level": 4,
"task": 2,
"opcode": 17,
"keywords": 4611686018427387905,
"time_created": "2026-03-13T20:07:47.884482+00:00",
"event_record_id": 18,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"DwordVal1": 0,
"DwordVal2": 0
},
"message": ""
}
Event ID 51006 — Solicit is sent from the interface InterfaceId.
Description
Solicit is sent from the interface InterfaceId. Status code is StatusCode.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
StatusCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51006,
"version": 0,
"level": 4,
"task": 2,
"opcode": 19,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:07:47.970620+00:00",
"event_record_id": 20,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"StatusCode": 0
},
"message": ""
}
Event ID 51007 — Advertise is received from the interface InterfaceId.
Event ID 51008 — Advertise is discarded from the interface InterfaceId.
Event ID 51009 — Request is sent from the interface InterfaceId.
Event ID 51010 — A valid reply is received for request from the interface InterfaceId.
Event ID 51011 — Incorrect reply is received for request from the interface InterfaceId.
Event ID 51012 — Renew is sent on the interface InterfaceId.
Event ID 51013 — A valid reply is received for renew from the interface InterfaceId.
Event ID 51014 — An invalid reply is received for renew from the interface InterfaceId.
Event ID 51015 — Rebind is sent on the interface InterfaceId.
Event ID 51016 — A valid reply is received for rebind from the interface InterfaceId.
Event ID 51017 — An invalid reply is received for rebind from the interface InterfaceId.
Event ID 51018 — Release is sent on the interface InterfaceId.
Event ID 51019 — Decline is sent on the interface InterfaceId.
Event ID 51020 — A valid reply is received for decline on the interface InterfaceId.
Event ID 51021 — An invalid reply is received for decline on the interface InterfaceId.
Event ID 51022 — Confirm is sent on the interface InterfaceId.
Event ID 51023 — A valid reply is received for confirm on the interface InterfaceId.
Event ID 51024 — An invalid reply is received for confirm on the interface InterfaceId.
Event ID 51025 — Info-request is sent on the interface InterfaceId.
Event ID 51026 — A valid reply is received for Info-request on the interface InterfaceId.
Event ID 51027 — An invalid reply is received for Info-request on the interface InterfaceId.
Event ID 51029 — An error occurred in creation of packet on the interface InterfaceId.
Event ID 51030 — An error occurred in extracting options from the message received on the interface InterfaceId.
Event ID 51031 — DHCP is changed from stateful to stateless mode on the interface InterfaceId.
Event ID 51032 — DHCP is changed from stateless to stateful mode on the interface InterfaceId.
Event ID 51033 — DHCP is changed from nondhcp to stateful mode on the interface InterfaceId.
Description
DHCP is changed from nondhcp to stateful mode on the interface InterfaceId. Status Code is StatusCode.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
StatusCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51033,
"version": 0,
"level": 4,
"task": 3,
"opcode": 51,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:09:55.011775+00:00",
"event_record_id": 29,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"StatusCode": 121
},
"message": ""
}
Event ID 51034 — DHCP is changed from nondhcp to stateless mode on the interface InterfaceId.
Event ID 51035 — DHCP is converted to static mode on the interface InterfaceId.
Event ID 51036 — Error occurred in parsing the DHCP message received on the interface id InterfaceId.
Event ID 51037 — Information refresh time option is received in the interface InterfaceId with a refresh time value of RefreshTime.
Event ID 51038 — The information refresh time has expired, hence triggering a new inform packet on the interface InterfaceId.
Event ID 51039 — Address Address is plumbed on the interface InterfaceId.
Event ID 51040 — Address Address is unplumbed on the interface InterfaceId.
Event ID 51043 — An interface is added whose interface index is InterfaceId.
Description
An interface is added whose interface index is InterfaceId. Status Code is StatusCode.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
StatusCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51043,
"version": 0,
"level": 4,
"task": 1,
"opcode": 16,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:07:47.857120+00:00",
"event_record_id": 11,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7352
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"StatusCode": 0
},
"message": ""
}
Event ID 51044 — An error occurred in initializing the interface InterfaceId.
Event ID 51045 — An error occurred in plumbing the parameters into stack.
Event ID 51046 — DHCPv6 client service is started
#Description
DHCPv6 client service is started.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51046,
"version": 0,
"level": 4,
"task": 4,
"opcode": 62,
"keywords": 2305843009213693952,
"time_created": "2023-11-06T06:25:40.191684+00:00",
"event_record_id": 1679,
"correlation": {},
"execution": {
"process_id": 2372,
"thread_id": 2512
},
"channel": "System",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {},
"message": ""
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 51047 — DHCPv6 client service is stopped.
#Description
DHCPv6 client service is stopped. ShutDown Flag value is DwordVal.
Message #
Fields #
| Name | Description |
|---|---|
DwordVal UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51047,
"version": 0,
"level": 4,
"task": 4,
"opcode": 63,
"keywords": 2305843009213693952,
"time_created": "2023-11-05T22:31:36.932069+00:00",
"event_record_id": 1854,
"correlation": {},
"execution": {
"process_id": 2232,
"thread_id": 2424
},
"channel": "System",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"DwordVal": 1
},
"message": ""
}
References #
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 51048 — An error has occurred in opening the socket on the interface InterfaceId.
Event ID 51049 — An error has occurred in closing the socket on the interface InterfaceId.
Event ID 51050 — DNS registration has happened for the interface InterfaceId.
Event ID 51051 — DNS deregistration has happened for the interface InterfaceId.
Event ID 51057 — DHCPv6 client service stop is almost done.
#Description
DHCPv6 client service stop is almost done.DHCP Context Ref count is DwordVal.
Message #
Fields #
| Name | Description |
|---|---|
DwordVal UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51057,
"version": 0,
"level": 4,
"task": 4,
"opcode": 104,
"keywords": 2305843009213693952,
"time_created": "2023-11-05T22:31:36.932388+00:00",
"event_record_id": 1856,
"correlation": {},
"execution": {
"process_id": 2232,
"thread_id": 2424
},
"channel": "System",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"DwordVal": 1
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 51058 — DHCP is changed from stateful to stateful mode on the interface InterfaceId.
Event ID 51059 — Message is Invalid and it is discarded.
Description
Message is Invalid and it is discarded.
Message #
Event ID 51060 — The Class ID InterfaceGUID was set for the interface HWAddress.
Event ID 51061 — Address Address being plumbed for adapter InterfaceId already exists.
Event ID 51062 — Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address HWAddress.
Message #
Fields #
| Name | Description |
|---|---|
HWLength UInt32 | — |
HWAddress Binary | — |
StatusCode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51062,
"version": 0,
"level": 2,
"task": 3,
"opcode": 74,
"keywords": 4611686018427387905,
"time_created": "2026-03-13T20:09:55.011295+00:00",
"event_record_id": 27,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"HWLength": 6,
"HWAddress": "00155D284E57",
"StatusCode": 121
},
"message": ""
}
Event ID 51063 — Firewall port DwordVal is exempted on interface InterfaceId.
Description
Firewall port DwordVal is exempted on interface InterfaceId. Error code is DwordVal1.
Message #
Fields #
| Name | Description |
|---|---|
DwordVal UInt32 | — |
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51063,
"version": 0,
"level": 4,
"task": 2,
"opcode": 77,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:07:47.955604+00:00",
"event_record_id": 19,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8268
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"DwordVal": 546,
"InterfaceId": 12,
"DwordVal1": 0
},
"message": ""
}
Event ID 51064 — Firewall port DwordVal is closed on interface InterfaceId.
Description
Firewall port DwordVal is closed on interface InterfaceId. Error code is DwordVal1.
Message #
Fields #
| Name | Description |
|---|---|
DwordVal UInt32 | — |
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51064,
"version": 0,
"level": 4,
"task": 2,
"opcode": 78,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:09:55.022448+00:00",
"event_record_id": 30,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8268
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"DwordVal": 546,
"InterfaceId": 12,
"DwordVal1": 0
},
"message": ""
}
Event ID 51065 — DHCP is changing mode to NewMode on the interface InterfaceId.
Description
DHCP is changing mode to NewMode on the interface InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
NewMode UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51065,
"version": 0,
"level": 4,
"task": 3,
"opcode": 79,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:07:47.857446+00:00",
"event_record_id": 15,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7352
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"NewMode": 0
},
"message": ""
}
Event ID 51066 — Regular address acquisition will be done on interface InterfaceId because aggressive address acquisition is turned ON.
Event ID 51067 — DHCP has cancelled IPv6 address acquisition cycle after DwordVal1 SOLICIT transmissions on interface InterfaceId because the machine is in Connected Standby state ...
Event ID 51068 — DHCP has cancelled IPv6 address acquisition cycle after DwordVal1 SOLICIT transmissions on interface InterfaceId because the machine is in Connected Standby state ...
Event ID 51069 — DHCP will not try regular IPv6 address acquisition on interface InterfaceId since the machine is in Connected Standby state and the interface has the IPv4 a...
Description
DHCP will not try regular IPv6 address acquisition on interface since the machine is in Connected Standby state and the interface has the IPv4 address . Managed Flag value OtherConfig Flag value .
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
Address1 UInt32 | — |
DwordVal1 UInt32 | — |
DwordVal2 UInt32 | — |
Event ID 51070 — DHCP will try regular IPv6 address acquisition on interface InterfaceId even though the machine is in Connected Standby state since the interface has no IPv...
Event ID 51073 — Firewall port DwordVal1 exemption triggered on interface InterfaceId.
Description
Firewall port DwordVal1 exemption triggered on interface InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51073,
"version": 0,
"level": 4,
"task": 2,
"opcode": 87,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:07:47.884463+00:00",
"event_record_id": 17,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"DwordVal1": 546
},
"message": ""
}
Event ID 51074 — Firewall port DwordVal1 close triggered on interface InterfaceId.
Description
Firewall port DwordVal1 close triggered on interface InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51074,
"version": 0,
"level": 4,
"task": 2,
"opcode": 88,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:09:55.011759+00:00",
"event_record_id": 28,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 8212
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 12,
"DwordVal1": 546
},
"message": ""
}
Event ID 51075 — The DHCPv6 client received connected standby entry notification.
Description
The DHCPv6 client received connected standby entry notification.
Message #
Event ID 51076 — The DHCPv6 client received connected standby exit notification.
Description
The DHCPv6 client received connected standby exit notification.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51076,
"version": 0,
"level": 4,
"task": 7,
"opcode": 90,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.007503+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 1988
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {},
"message": ""
}
Event ID 51077 — DHCP will try regular IPv6 address acquisition on interface InterfaceId due to registry settings even though the machine is in Connected Standby state and t...
Event ID 51078 — DHCP is enabled on the interface InterfaceId.
Event ID 51079 — DHCP is disabled on the interface InterfaceId.
Event ID 51080 — DHCP transaction will not be attempted on interface InterfaceId because DHCP is disabled on it.
Event ID 51081 — DHCP has cancelled IPv6 address acquisition cycle after DwordVal1 SOLICIT transmissions on interface InterfaceId because the machine is in Connected Standby state ...
Event ID 51082 — DHCP has cancelled IPv6 address acquisition cycle after DwordVal1 SOLICIT transmissions on interface InterfaceId because the machine is in Connected Standby state ...
Event ID 51083 — DHCP has cancelled IPv6 address acquisition on interface InterfaceId because the interface is not multicast enabled.
Event ID 51084 — The values of flags received on interface InterfaceId are: Managed Flag value DwordVal1 OtherConfig Flag value DwordVal2.
Description
The values of flags received on interface InterfaceId are: Managed Flag value DwordVal1 OtherConfig Flag value DwordVal2.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceId UInt32 | — |
DwordVal1 UInt32 | — |
DwordVal2 UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 51084,
"version": 0,
"level": 4,
"task": 2,
"opcode": 103,
"keywords": 4611686018427387904,
"time_created": "2026-03-13T20:05:04.009569+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 2032
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceId": 1,
"DwordVal1": 0,
"DwordVal2": 0
},
"message": ""
}
Event ID 51085 — Firewall port exemption is in progress but incomplete.
Event ID 60000 — PERFTRACK (DHCPSOLICIT): Offer is accepted on the IPv6 interface InterfaceId.
Event ID 60001 — PERFTRACK (DHCINFORMATIONREQUEST): Options received on the IPv6 interface InterfaceId.
Event ID 60002 — PERFTRACK (DHCPv6): Media Connect on interface InterfaceId.
Description
PERFTRACK (DHCPv6): Media Connect on interface InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceGuid GUID | — |
InterfaceId UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 60002,
"version": 0,
"level": 4,
"task": 1,
"opcode": 14,
"keywords": 4611967493404098560,
"time_created": "2026-03-13T20:07:47.857153+00:00",
"event_record_id": 13,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7352
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceGuid": "FFE5E4CF-5122-47DA-AB92-688CEA20F16B",
"InterfaceId": 12
},
"message": ""
}
Event ID 60003 — PERFTRACK (DHCPv6): End of Media Connect on interface InterfaceId.
Description
PERFTRACK (DHCPv6): End of Media Connect on interface InterfaceId.
Message #
Fields #
| Name | Description |
|---|---|
InterfaceGuid GUID | — |
InterfaceId UInt32 | — |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DHCPv6-Client",
"guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
"event_source_name": "",
"event_id": 60003,
"version": 0,
"level": 4,
"task": 1,
"opcode": 15,
"keywords": 4611967493404098560,
"time_created": "2026-03-13T20:07:47.857137+00:00",
"event_record_id": 12,
"correlation": {},
"execution": {
"process_id": 1868,
"thread_id": 7352
},
"channel": "Microsoft-Windows-Dhcpv6-Client/Operational",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {
"InterfaceGuid": "FFE5E4CF-5122-47DA-AB92-688CEA20F16B",
"InterfaceId": 12
},
"message": ""
}