detection.wiki

Microsoft-Windows-DHCPv6-Client › Event 1009

Event ID 1009 — MAC Address HWAddress in DUID DUID could not be found in the system.

Provider
Microsoft-Windows-DHCPv6-Client
Channel
Admin
Level
Informational
Task
ServiceStateEvent
Opcode
DHCPv6DUIDValidationFailed

Description

MAC Address HWAddress in DUID DUID could not be found in the system. Generated new DUID NewDUID based on MAC address NewHWAddress.

Message #

MAC Address %2 in DUID %4 could not be found in the system. Generated new DUID %8 based on MAC address %6.

Fields #

NameDescription
HWLength UInt32—
HWAddress Binary—
DUIDLength UInt32—
DUID Binary—
NewHWLength UInt32—
NewHWAddress Binary—
NewDUIDLength UInt32—
NewDUID Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DHCPv6-Client",
    "guid": "6A1F2B00-6A90-4C38-95A5-5CAB3B056778",
    "event_source_name": "",
    "event_id": 1009,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 98,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:48:31.137277+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 2260
    },
    "channel": "Microsoft-Windows-Dhcpv6-Client/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "HWLength": 6,
    "HWAddress": "000C29794FE7",
    "DUIDLength": 14,
    "DUID": "000100012CCB4881000C29794FE7",
    "NewHWLength": 6,
    "NewHWAddress": "000C29B19818",
    "NewDUIDLength": 14,
    "NewDUID": "000100012CCB5397000C29B19818"
  },
  "message": ""
}

References #