Microsoft-Windows-Diagnostics-Networking

40 events across 3 channels

Event ID	Title	Channel
1000	Network Diagnostics Framework started because the user requested a diagnostics …	Operational
2000	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
2100	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
2200	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
2300	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
2400	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
2500	Network Diagnostics Framework stopped because it completed the user initiated …	Operational
3000	An error occurred.	Operational
3100	An error occurred.	Operational
4000	This event is not emitted, it remains manifested for AppCompat	System
4100	The Network Diagnostics Framework has completed the diagnosis phase of …	System
4200	An error occurred.	System
5000	This event is not emitted, it remains manifested for AppCompat	System
5100	This event is not emitted, it remains manifested for AppCompat	System
5200	This event is not emitted, it remains manifested for AppCompat	System
5300	An error occurred.	System
6000	Details about %1 diagnosis: %2.	Operational
6100	Details about %1 diagnosis: %2.	System
6200	Details about %1 diagnosis: %2.	Debug
7000		Debug
7010		Debug
7020		Debug
7030		Debug
7040		Debug
7050		Debug
7100		Debug
8001	Start NDF Incident	Debug
8002	Stop NDF Incident	Debug
8003	Start NDF Diagnose	Debug
8004	Stop NDF Diagnose	Debug
8005	Start NDF Repair	Debug
8006	Stop NDF Repair	Debug
8007	Start NDF Validate	Debug
8008	Stop NDF Validate	Debug
8009	Start NDF Reproduce Failure	Debug
8010	Stop NDF Reproduce Failure	Debug
8103	Start NDF Helper Class '.	Debug
8104	Stop NDF Helper Class '.	Debug
8107	Start NDF Helper Class '.	Debug
8108	Stop NDF Helper Class '.	Debug

Event ID 1000 — Network Diagnostics Framework started because the user requested a diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework started because the user requested a diagnostics session. 

Helper Class Name: %1 

Number of parameters: %2 

Attributes passed to helper class: 
%3

Fields

Name	Description
`HelperClassName`	—
`NumberOfAttributes`	—
`HelperClassAttributes`	—

Event ID 2000 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Success, no problems found. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 2100 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Success, problems repaired. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 2200 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Failed during diagnosis. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 2300 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Failed during repair. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 2400 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Cancelled during diagnosis. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 2500 — Network Diagnostics Framework stopped because it completed the user initiated diagnostics session.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Network Diagnostics Framework stopped because it completed the user initiated diagnostics session. 

Result: Cancelled during repair. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 3000 — An error occurred.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [%1].

Fields

Name	Description
`ResultHR`	—

Event ID 3100 — An error occurred.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

An error occurred. The Network Diagnostics Framework failed to complete operation. A Windows Error Report was generated. [%1].

Fields

Name	Description
`ResultHR`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/operations/event-id-explanations

Event ID 4000 — This event is not emitted, it remains manifested for AppCompat

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

This event is not emitted, it remains manifested for AppCompat

Fields

Name	Description
`RootCause`	—
`RootCauseGUID`	—
`RepairOption`	—
`RepairGUID`	—
`SecondsRequired`	—
`SIDTypeRequired`	—
`HelperClassName`	—
`InterfaceDesc`	—
`InterfaceGUID`	—

Event ID 4100 — The Network Diagnostics Framework has completed the diagnosis phase of operation, but no network problem was identified.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

The Network Diagnostics Framework has completed the diagnosis phase of operation, but no network problem was identified.

Event ID 4200 — An error occurred.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

An error occurred. The Network Diagnostics Framework failed to complete the diagnosis phase of operation. A Windows Error Report was generated. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 5000 — This event is not emitted, it remains manifested for AppCompat

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

This event is not emitted, it remains manifested for AppCompat

Fields

Name	Description
`RootCause`	—
`RootCauseGUID`	—
`RepairOption`	—
`RepairGUID`	—
`SecondsRequired`	—
`SIDTypeRequired`	—
`HelperClassName`	—
`InterfaceDesc`	—
`InterfaceGUID`	—

Event ID 5100 — This event is not emitted, it remains manifested for AppCompat

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

This event is not emitted, it remains manifested for AppCompat

Fields

Name	Description
`RootCause`	—
`RootCauseGUID`	—
`RepairOption`	—
`RepairGUID`	—
`SecondsRequired`	—
`SIDTypeRequired`	—
`HelperClassName`	—
`InterfaceDesc`	—
`InterfaceGUID`	—

References

Microsoft Learn https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus

Event ID 5200 — This event is not emitted, it remains manifested for AppCompat

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

This event is not emitted, it remains manifested for AppCompat

Fields

Name	Description
`RootCause`	—
`RootCauseGUID`	—
`RepairOption`	—
`RepairGUID`	—
`SecondsRequired`	—
`SIDTypeRequired`	—
`HelperClassName`	—
`InterfaceDesc`	—
`InterfaceGUID`	—

Event ID 5300 — An error occurred.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

An error occurred. The Network Diagnostics Framework failed to complete the repair phase of operation. A Windows Error Report was generated. [%1]

Fields

Name	Description
`ResultHR`	—

Event ID 6000 — Details about %1 diagnosis: %2.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Operational

Message

Details about %1 diagnosis: 

%2

Fields

Name	Description
`HelperClassName`	—
`EventDescription`	—
`EventVerbosity`	—

Event ID 6100 — Details about %1 diagnosis: %2.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: System

Message

Details about %1 diagnosis: 

%2

Fields

Name	Description
`HelperClassName`	—
`EventDescription`	—
`EventVerbosity`	—

Event ID 6200 — Details about %1 diagnosis: %2.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Details about %1 diagnosis: 

%2

Fields

Name	Description
`HelperClassName`	—
`EventDescription`	—
`EventVerbosity`	—

Event ID 7000 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7010 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7020 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7030 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7040 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7050 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 7100 —

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

%1

Fields

Name	Description
`DebugMessage`	—

Event ID 8001 — Start NDF Incident

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Incident

Event ID 8002 — Stop NDF Incident

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Incident

Event ID 8003 — Start NDF Diagnose

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Diagnose

Event ID 8004 — Stop NDF Diagnose

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Diagnose

References

Microsoft Learn https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/jj865682(v=ws.10)

Event ID 8005 — Start NDF Repair

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Repair

Event ID 8006 — Stop NDF Repair

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Repair

Event ID 8007 — Start NDF Validate

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Validate

Event ID 8008 — Stop NDF Validate

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Validate

Event ID 8009 — Start NDF Reproduce Failure

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Reproduce Failure

Event ID 8010 — Stop NDF Reproduce Failure

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Reproduce Failure

Event ID 8103 — Start NDF Helper Class '.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Helper Class '%1' Diagnose

Fields

Name	Description
`HelperClassName`	—

Event ID 8104 — Stop NDF Helper Class '.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Helper Class '%1' Diagnose

Fields

Name	Description
`HelperClassName`	—

Event ID 8107 — Start NDF Helper Class '.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Start NDF Helper Class '%1' Validate

Fields

Name	Description
`HelperClassName`	—

Event ID 8108 — Stop NDF Helper Class '.

Provider: Microsoft-Windows-Diagnostics-Networking
Channel: Debug

Message

Stop NDF Helper Class '%1' Validate

Fields

Name	Description
`HelperClassName`	—