detection.wiki

Microsoft-Windows-DriverFrameworks-UserMode › Event 2102

Event ID 2102 — Forwarded a finished Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) to the lower driver for device UMDFHostDeviceRequest.InstanceId with sta...

Provider
Microsoft-Windows-DriverFrameworks-UserMode
Channel
Operational
Level
Informational
Task
PnporPowerManagementoperationtoaparticulardevice.
Opcode
Stop

Description

Forwarded a finished Pnp or Power operation (UMDFHostDeviceRequest.RequestMajorCode, UMDFHostDeviceRequest.RequestMinorCode) to the lower driver for device UMDFHostDeviceRequest.InstanceId with status UMDFHostDeviceRequest.Status.

Message #

Forwarded a finished Pnp or Power operation (%3, %4) to the lower driver for device %2 with status %9.

Fields #

NameDescription
UMDFHostDeviceRequest.LifetimeId GUID—
UMDFHostDeviceRequest.InstanceId UnicodeString—
UMDFHostDeviceRequest.RequestMajorCode—
UMDFHostDeviceRequest.RequestMinorCode—
UMDFHostDeviceRequest.Argument1 Pointer—
UMDFHostDeviceRequest.Argument2 Pointer—
UMDFHostDeviceRequest.Argument3 Pointer—
UMDFHostDeviceRequest.Argument4 Pointer—
UMDFHostDeviceRequest.Status UInt32— NTSTATUS reference
LifetimeId GUID—
InstanceId UnicodeString—
MajorCode UInt8—
MinorCode UInt8—
Argument1 Pointer—
Argument2 Pointer—
Argument3 Pointer—
Argument4 Pointer—
Status UInt32— NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DriverFrameworks-UserMode",
    "guid": "2E35AAEB-857F-4BEB-A418-2E6C0E54D988",
    "event_source_name": "",
    "event_id": 2102,
    "version": 1,
    "level": 4,
    "task": 37,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T22:03:23.459717+00:00",
    "event_record_id": 53,
    "correlation": {},
    "execution": {
      "process_id": 6928,
      "thread_id": 6020
    },
    "channel": "Microsoft-Windows-DriverFrameworks-UserMode/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "user_data": {
    "UMDFHostDeviceRequest": {
      "LifetimeId": "2E824AC4-1BF6-49DF-A55C-C63302D85A3E",
      "InstanceId": "SWD\\REMOTEDISPLAYENUM\\RDPIDD_INDIRECTDISPLAY&SESSIONID_0001",
      "RequestMajorCode": 27,
      "RequestMinorCode": 23,
      "Argument1": "0x0",
      "Argument2": "0x0",
      "Argument3": "0x0",
      "Argument4": "0x0",
      "Status": 0
    }
  },
  "message": ""
}

Detection Patterns #