Microsoft-Windows-Hyper-V-Chipset

76 events across 4 channels

Event IDTitleChannel
1500Operational
1500[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Analytic
1510Operational
1510[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Analytic
1520Operational
1520[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Analytic
1530Operational
1530[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Analytic
1540Operational
1540[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Operational
1550Operational
1550[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Operational
1560Operational
1560[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Operational
1570Operational
1570[Virtual machine VmId] TraceData.Microsoft-Windows-Hyper-V-Worker-Operational
12530Operational
12530'VmName' device Device could not allocate guest physical address space.Microsoft-Windows-Hyper-V-Worker-Admin
12531Operational
12531Device Device could not allocate guest physical address space.Microsoft-Windows-Hyper-V-Worker-Admin
12722Operational
12722The SMBIOS tables contain data for CPU information that is not valid.Microsoft-Windows-Hyper-V-Worker-Admin
12723Operational
12723The SMBIOS tables contain data for CPU information that is not valid.Microsoft-Windows-Hyper-V-Worker-Admin
12724Operational
12724The virtual machine 'VmName' cannot start because secure boot is off.Microsoft-Windows-Hyper-V-Worker-Admin
12725Operational
12725The virtual machine 'VmName' cannot start because secure boot is off.Microsoft-Windows-Hyper-V-Worker-Admin
12730Operational
12730The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage …Microsoft-Windows-Hyper-V-Worker-Admin
12731Operational
12731The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage …Microsoft-Windows-Hyper-V-Worker-Admin
18600Operational
18600'VmName' has encountered a watchdog timeout and was reset.Microsoft-Windows-Hyper-V-Worker-Admin
18601Operational
18601'VmlEventLog.VmName' successfully booted an operating system.Microsoft-Windows-Hyper-V-Worker-Admin
18602Operational
18602'VmName' successfully booted an operating system, but at least one boot source …Microsoft-Windows-Hyper-V-Worker-Admin
18603Operational
18603'VmlEventLog.VmName' failed to boot an operating system.Microsoft-Windows-Hyper-V-Worker-Admin
18604Operational
18604'VmName' failed to boot an operating system.Microsoft-Windows-Hyper-V-Worker-Admin
18605Operational
18605'VmName' No bootable devices are configured.Microsoft-Windows-Hyper-V-Worker-Admin
18606Operational
18606'VmName' is attempting to boot an operating system.Microsoft-Windows-Hyper-V-Worker-Admin
18607Operational
18607'VmName' was unable to exit UEFI boot services.Microsoft-Windows-Hyper-V-Worker-Admin
18608Operational
18608The virtual machine VmName cannot load device Device because there are no …Microsoft-Windows-Hyper-V-Worker-Admin
18609Operational
18609The device Device cannot be loaded because there are no mutually support …Microsoft-Windows-Hyper-V-Worker-Admin
18610Operational
18610'VmName' failed to initialize due to a failure in attestation and key release.Microsoft-Windows-Hyper-V-Worker-Admin
18611Operational
18611'VmName' cleared VM guest state due to a configuration change.Microsoft-Windows-Hyper-V-Worker-Admin
18612Operational
18612'VmName' VM guest state initialization failed.Microsoft-Windows-Hyper-V-Worker-Admin
18613Operational
18613'VmName' cleared VM guest state due to invalid data.Microsoft-Windows-Hyper-V-Worker-Admin
18614Operational
18614'VmName' cleared VM guest state due to corrupt data.Microsoft-Windows-Hyper-V-Worker-Admin
18615Operational
18615'VmName' VM guest state encryption key not released.Microsoft-Windows-Hyper-V-Worker-Admin
18616Operational
18616'VmName' failed to decrypt VM guest state disk encryption key.Microsoft-Windows-Hyper-V-Worker-Admin
18617Operational
18617'VmName' has encountered a watchdog timeout and was reset.Microsoft-Windows-Hyper-V-Worker-Admin
18618Operational
18618'VmName' failed while applying management VTL settings: ResultDocument.Microsoft-Windows-Hyper-V-Worker-Admin
18620Operational
18620'VmName' failed in the management VTL before starting guest VTL0: …Microsoft-Windows-Hyper-V-Worker-Admin
18622Operational
18622'VmName' has firmware debugging enabled and cannot be started without COM1 …Microsoft-Windows-Hyper-V-Worker-Admin
18624Operational
18624'VmName' cannot be started because the firmware resource DLL failed to load: …Microsoft-Windows-Hyper-V-Worker-Admin

Event ID 1500 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1500 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1510 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1520 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1530 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Analytic

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1540 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1540 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Operational

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1550 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1550 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Operational

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1560 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1560 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Operational

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1570 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

[Virtual machine ].

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 1570 — [Virtual machine VmId] TraceData.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Operational

Description

[Virtual machine VmId] TraceData.

Message #

[Virtual machine %3] %1

Fields #

NameDescription
TraceData UnicodeString
VmName UnicodeString
VmId UnicodeString
StackFrameCount UInt32
StackFrame Pointer
ModuleCount UInt32
Module Int32

Event ID 12530 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' device Device could not allocate guest physical address space. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12530 — 'VmName' device Device could not allocate guest physical address space.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' device Device could not allocate guest physical address space. (Virtual machine ID VmId).

Message #

'%1' device %3 could not allocate guest physical address space. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12531 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

Device could not allocate guest physical address space.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12531 — Device Device could not allocate guest physical address space.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

Device Device could not allocate guest physical address space.

Message #

Device %3 could not allocate guest physical address space.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString

Event ID 12722 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12722 — The SMBIOS tables contain data for CPU information that is not valid.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Message #

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12723 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12723 — The SMBIOS tables contain data for CPU information that is not valid.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Message #

The SMBIOS tables contain data for CPU information that is not valid. Please contact your computer manufacturer for a BIOS update.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
String UnicodeString
ErrorCodeString UnicodeString
ErrorCode UnicodeString
Param1 UnicodeString
Param2 UnicodeString

Event ID 12724 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The virtual machine 'VmName' cannot start because secure boot is off. Enable secure boot to start a shielded virtual machine. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 12724 — The virtual machine 'VmName' cannot start because secure boot is off.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine 'VmName' cannot start because secure boot is off. Enable secure boot to start a shielded virtual machine. (Virtual machine ID VmId).

Message #

The virtual machine '%1' cannot start because secure boot is off. Enable secure boot to start a shielded virtual machine. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 12725 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The virtual machine 'VmName' cannot start because secure boot is off.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 12725 — The virtual machine 'VmName' cannot start because secure boot is off.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine 'VmName' cannot start because secure boot is off.

Message #

The virtual machine '%1' cannot start because secure boot is off.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 12730 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString

Event ID 12730 — The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId).

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode) (Virtual machine ID VmId).

Message #

The virtual machine '%1' cannot open file '%5': %3 (%4) (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString

Event ID 12731 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString

Event ID 12731 — The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode).

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine 'VmName' cannot open file 'Parameter0': ErrorMessage (ErrorCode).

Message #

The virtual machine '%1' cannot open file '%5': %3 (%4)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString

Event ID 18600 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18600 — 'VmName' has encountered a watchdog timeout and was reset.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).

Message #

'%1' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18601 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' successfully booted an operating system. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18601 — 'VmlEventLog.VmName' successfully booted an operating system.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin
Level
Informational

Description

'VmlEventLog.VmName' successfully booted an operating system. (Virtual machine ID VmlEventLog.VmId).

Message #

'%1' successfully booted an operating system. (Virtual machine ID %2)

Fields #

NameDescription
VmlEventLog.VmName UnicodeString
VmlEventLog.VmId UnicodeString
VmlEventLog.VmBootSourceCount
VmlEventLog.VmBootSourceResult
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-Chipset",
    "guid": "DE9BA731-7F33-4F44-98C9-6CAC856B9F83",
    "event_source_name": "",
    "event_id": 18601,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:08:20.711339+00:00",
    "event_record_id": 8,
    "correlation": {
      "ActivityID": "A5B814C5-B324-0007-3329-B8A524B3DC01"
    },
    "execution": {
      "process_id": 9752,
      "thread_id": 8468
    },
    "channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-754131803-1256623942-3691508397-1420384594"
    }
  },
  "user_data": {
    "VmlEventLog": {
      "VmName": "2cf3235b-8f46-4ae6-adf2-07dc5259a954",
      "VmId": "2CF3235B-8F46-4AE6-ADF2-07DC5259A954",
      "VmBootSourceCount": 1,
      "VmBootSourceResult": "<VmBootSourceResultDetail><Status>0x00010005</Status><ExtendedStatus>0x00000000</ExtendedStatus><DevicePath>AcpiEx(VMBus,0,0)/VenHw(9B17E5A2-0891-42DD-B653-80B5C22809BA,C3C176C376D2D24890A9C04748072C60DF9B3CC6A55F0842B03F6B458B365592)/\\EFI\\Microsoft\\Boot\\bootmgfw.efi</DevicePath></VmBootSourceResultDetail>"
    }
  },
  "message": ""
}

Event ID 18602 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18602 — 'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' successfully booted an operating system, but at least one boot source failed secure boot validation. (Virtual machine ID VmId).

Message #

'%1' successfully booted an operating system, but at least one boot source failed secure boot validation. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18603 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed to boot an operating system. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18603 — 'VmlEventLog.VmName' failed to boot an operating system.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin
Level
Warning

Description

'VmlEventLog.VmName' failed to boot an operating system. (Virtual machine ID VmlEventLog.VmId).

Message #

'%1' failed to boot an operating system. (Virtual machine ID %2)

Fields #

NameDescription
VmlEventLog.VmName UnicodeString
VmlEventLog.VmId UnicodeString
VmlEventLog.VmBootSourceCount
VmlEventLog.VmBootSourceResult
VmlEventLog.VmBootSourceResult_1
VmlEventLog.VmBootSourceResult_2
VmlEventLog.VmBootSourceResult_3
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Hyper-V-Chipset",
    "guid": "DE9BA731-7F33-4F44-98C9-6CAC856B9F83",
    "event_source_name": "",
    "event_id": 18603,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:25:28.192759+00:00",
    "event_record_id": 43,
    "correlation": {},
    "execution": {
      "process_id": 2520,
      "thread_id": 8480
    },
    "channel": "Microsoft-Windows-Hyper-V-Worker-Admin",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-83-1-2656045725-1227044221-1802231738-3450451864"
    }
  },
  "user_data": {
    "VmlEventLog": {
      "VmName": "TestVM2",
      "VmId": "9E500A9D-357D-4923-BADF-6B6B98B7A9CD",
      "VmBootSourceCount": 4,
      "VmBootSourceResult": "Optical",
      "VmBootSourceResult_1": "HardDrive",
      "VmBootSourceResult_2": "Network",
      "VmBootSourceResult_3": "Floppy"
    }
  },
  "message": ""
}

Event ID 18604 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed to boot an operating system. At least one boot source failed secure boot validation. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18604 — 'VmName' failed to boot an operating system.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to boot an operating system. At least one boot source failed secure boot validation. (Virtual machine ID VmId).

Message #

'%1' failed to boot an operating system. At least one boot source failed secure boot validation. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18605 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' No bootable devices are configured. Use Hyper-V Manager to configure a bootable device. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18605 — 'VmName' No bootable devices are configured.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' No bootable devices are configured. Use Hyper-V Manager to configure a bootable device. (Virtual machine ID VmId).

Message #

'%1' No bootable devices are configured. Use Hyper-V Manager to configure a bootable device. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18606 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' is attempting to boot an operating system. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18606 — 'VmName' is attempting to boot an operating system.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' is attempting to boot an operating system. (Virtual machine ID VmId).

Message #

'%1' is attempting to boot an operating system. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
BootSourceCount UInt32
BootSourceResult UnicodeString

Event ID 18607 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' was unable to exit UEFI boot services. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18607 — 'VmName' was unable to exit UEFI boot services.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' was unable to exit UEFI boot services. (Virtual machine ID VmId).

Message #

'%1' was unable to exit UEFI boot services. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18608 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The virtual machine cannot load device because there are no mutually supported protocol versions. The server version is and the client version is (Virtual machine ID ).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 18608 — The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The virtual machine VmName cannot load device Device because there are no mutually supported protocol versions. The server version is ServerVersion and the client version is ClientVersion (Virtual machine ID VmId).

Message #

The virtual machine %1 cannot load device %3 because there are no mutually supported protocol versions. The server version is %4 and the client version is %5 (Virtual machine ID %2).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 18609 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

The device cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 18609 — The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

The device Device cannot be loaded because there are no mutually support protocol versions between the server and client.

Message #

The device %3 cannot be loaded because there are no mutually support protocol versions between the server and client.

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
Device UnicodeString
ServerVersion UnicodeString
ClientVersion UnicodeString

Event ID 18610 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed to initialize due to a failure in attestation and key release. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18610 — 'VmName' failed to initialize due to a failure in attestation and key release.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to initialize due to a failure in attestation and key release. (Virtual machine ID VmId).

Message #

'%1' failed to initialize due to a failure in attestation and key release. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18611 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' cleared VM guest state due to a configuration change. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18611 — 'VmName' cleared VM guest state due to a configuration change.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' cleared VM guest state due to a configuration change. (Virtual machine ID VmId).

Message #

'%1' cleared VM guest state due to a configuration change. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18612 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' VM guest state initialization failed. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18612 — 'VmName' VM guest state initialization failed.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' VM guest state initialization failed. (Virtual machine ID VmId).

Message #

'%1' VM guest state initialization failed. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18613 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' cleared VM guest state due to invalid data. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18613 — 'VmName' cleared VM guest state due to invalid data.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' cleared VM guest state due to invalid data. (Virtual machine ID VmId).

Message #

'%1' cleared VM guest state due to invalid data. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18614 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' cleared VM guest state due to corrupt data. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18614 — 'VmName' cleared VM guest state due to corrupt data.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' cleared VM guest state due to corrupt data. (Virtual machine ID VmId).

Message #

'%1' cleared VM guest state due to corrupt data. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18615 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' VM guest state encryption key not released. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18615 — 'VmName' VM guest state encryption key not released.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' VM guest state encryption key not released. (Virtual machine ID VmId).

Message #

'%1' VM guest state encryption key not released. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18616 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed to decrypt VM guest state disk encryption key. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18616 — 'VmName' failed to decrypt VM guest state disk encryption key.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed to decrypt VM guest state disk encryption key. (Virtual machine ID VmId).

Message #

'%1' failed to decrypt VM guest state disk encryption key. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18617 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18617 — 'VmName' has encountered a watchdog timeout and was reset.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID VmId).

Message #

'%1' has encountered a watchdog timeout and was reset. If the problem persists, contact Product Support for the guest operating system. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18618 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed while applying management VTL settings: ResultDocument. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Status UInt32NTSTATUS reference
ResultDocument UnicodeString

Event ID 18618 — 'VmName' failed while applying management VTL settings: ResultDocument.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed while applying management VTL settings: ResultDocument. (Virtual machine ID VmId).

Message #

'%1' failed while applying management VTL settings: %6. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Status UInt32NTSTATUS reference
ResultDocument UnicodeString

Event ID 18620 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' failed in the management VTL before starting guest VTL0: ResultDocument. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Status UInt32NTSTATUS reference
ResultDocument UnicodeString

Event ID 18620 — 'VmName' failed in the management VTL before starting guest VTL0: ResultDocument.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' failed in the management VTL before starting guest VTL0: ResultDocument. (Virtual machine ID VmId).

Message #

'%1' failed in the management VTL before starting guest VTL0: %6. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Status UInt32NTSTATUS reference
ResultDocument UnicodeString

Event ID 18622 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' has firmware debugging enabled and cannot be started without COM1 configured. (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18622 — 'VmName' has firmware debugging enabled and cannot be started without COM1 configured.

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' has firmware debugging enabled and cannot be started without COM1 configured. (Virtual machine ID VmId).

Message #

'%1' has firmware debugging enabled and cannot be started without COM1 configured. (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString

Event ID 18624 —

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Operational

Description

'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode). (Virtual machine ID VmId).

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString

Event ID 18624 — 'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode).

Provider
Microsoft-Windows-Hyper-V-Chipset
Channel
Microsoft-Windows-Hyper-V-Worker-Admin

Description

'VmName' cannot be started because the firmware resource DLL failed to load: ErrorMessage (ErrorCode). (Virtual machine ID VmId).

Message #

'%1' cannot be started because the firmware resource DLL failed to load: %3 (%4). (Virtual machine ID %2)

Fields #

NameDescription
VmName UnicodeString
VmId UnicodeString
ErrorMessage UnicodeString
ErrorCode UnicodeString
Parameter0 UnicodeString