Microsoft-Windows-Hyper-V-Hypervisor

118 events across 4 channels

Event ID	Title	Channel
1	Hypervisor successfully started.	System
2	Hypervisor scheduler type is %1.	System
3	Hypervisor Eventlog for global system events could not be created!	System
5	Hypervisor launch has been disabled through the hypervisorlaunchtype bcdedit …	System
10	Hypervisor Eventlog creation failed!	Microsoft-Windows-Hyper-V-Hypervisor-Operational
11	Hypervisor Eventlog deletion failed!	Microsoft-Windows-Hyper-V-Hypervisor-Operational
12	Host processor features mask: %1 Host xsave features mask: %2 Host cache line …	Microsoft-Windows-Hyper-V-Hypervisor-Operational
13	Hypervisor fails to start ETW tracing session.	System
14	Hypervisor Eventlog flush failed!	Microsoft-Windows-Hyper-V-Hypervisor-Operational
20	Hypervisor launch failed; sleep and hibernate could not be disabled (status %1).	System
26	Hypervisor launch failed; the hypervisor boot loader's internal logic failed …	System
27	Hypervisor launch failed; the hypervisor boot loader was unable to allocate …	System
28	Hypervisor launch failed; the hypervisor boot loader does not support the vendor …	System
29	Hypervisor launch failed; at least one of the processors in the system does not …	System
31	Hyper-V launch failed; the system does not appear to have a sufficient level of …	System
32	Hypervisor launch failed; at least one of the processors in the system does not …	System
33	Hyper-V launch failed; the image {ImageName} could not be accessed (status …	System
34	Hyper-V launch failed; the image %1 could not be loaded (status %2).	System
35	Hyper-V launch failed; the image {ImageName} could not be read (status …	System
36	Hypervisor launch failed; the image %1 failed code integrity checks, and cannot …	System
37	Hypervisor launch failed; the image %1 does not contain the image description …	System
38	Hyper-V launch failed; at least one of the processors in the system was unable …	System
39	Hypervisor Load Options - %1.	Microsoft-Windows-Hyper-V-Hypervisor-Admin
40	Hypervisor launch failed; the hypervisor image is revision %1, but the currently …	System
41	Hypervisor launch failed; Either VMX not present or not enabled in BIOS.	System
42	Hypervisor launch failed; Either SVM not present or not enabled in BIOS.	System
43	Hypervisor launch failed; EL2 not present.	System
44	Hypervisor launch failed; Either No Execute feature (NX) not present or not …	System
46	Hypervisor launch failed; Processor does not support the minimum features …	System
47	Hypervisor launch failed; Processor does not provide the features necessary to …	System
48	Hypervisor launch failed; Processor does not provide the features necessary to …	System
54	Hypervisor launch failed; Hypervisor image does not match the platform being run …	System
55	Hypervisor launch failed; Required firmware table not found.	System
56	Hypervisor launch failed; Encountered invalid firmware information.	System
59	Hypervisor launch failed; Second Level Address Translation is required to launch …	System
60	Hypervisor launch failed; Secure Mode Extensions have been enabled by the BIOS.	System
61	Hypervisor launch failed; Minimum CPUID leaves required by the hypervisor are …	System
62	Hypervisor launch failed; The physical address limit supported has been …	System
63	Hypervisor launch failed; The hypervisor was unable to initialize successfully …	System
64	Hypervisor launch failed; Too many runtime services memory ranges described by …	System
65	Hypervisor launch failed; Memory ranges validation failure (BalStatus: %1, …	System
80	Hypervisor launch failed; The operating systems boot loader failed with error …	System
81	Hypervisor launch failed; The operating system boot loader was unable to locate …	System
82	Hypervisor launch failed; The operating system boot loader detected a persistent …	System
83	Hypervisor launch failed; The operating system boot loader was unable to …	System
84	Hypervisor launch failed; The operating system boot loader was unable to …	System
85	Hypervisor launch failed; The operating system boot loader detected a memory map …	System
86	Hypervisor launch failed; the version of the microcode update dll does not match …	System
96	Hypervisor processor startup failed (APIC ID %1, status %2).	System
97	Hypervisor processor startup failed (APIC ID %1) due to CPUID feature validation …	System
129	Hypervisor initialized I/O remapping.	System
130	Hypervisor I/O remapping is forcibly enabled by policy (the …	System
131	There is an I/O remapping problem with the sytem BIOS.	System
144	A device is operating with reduced performance because of a problem with the …	System
145	A device will not work correctly because of a problem with the system BIOS.	System
146	A device will not work correctly because the hypervisor does not have enough …	System
147	A device will not work correctly because of a problem with the system BIOS.	System
148	A device could not be used by a child partition because of a limitation of the …	System
149	A device could not be used by a child partition because of a limitation of the …	System
150	The image {ImageName} could not be accessed (status {Status}).	System
151	The image {ImageName} could not be loaded (status {Status}).	System
152	The image %1 could not be read (status %2).	System
153	The image %1 failed code integrity checks, and cannot be used.	System
154	Hypervisor failed to properly synchronize TSC across logical processors (Max …	System
155	Host processor features mask: %1 Host xsave features mask: %2 Host cache line …	Microsoft-Windows-Hyper-V-Hypervisor-Admin
156	Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.	System
156	Hypervisor initial page allocation NUMA policy: .	Microsoft-Windows-Hyper-V-Hypervisor-Admin
157	The hypervisor did not enable mitigations for side channel vulnerabilities for …	System
158	The queried interface version %1 is not supported (Min : %2, Max : %3).	System
159	The queried interface is incomplete.	System
160	Partition persistence services will be unavailable.	System
161	The configured Minroot settings are not compatible with the hypervisor core …	System
162	Failed to unregister the remote hypercall interface (status %1).	System
163	The hypervisor encountered an internal error: nested NMI (processor %1).	Microsoft-Windows-Hyper-V-Hypervisor-Operational
164	The hypervisor encountered an internal error: IPI timeout (processor %1).	Microsoft-Windows-Hyper-V-Hypervisor-Operational
165	Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, …	System
166	Hypervisor Load Options are conflicting - %1, %2.	Microsoft-Windows-Hyper-V-Hypervisor-Admin
167	The hypervisor did not enable mitigations for side channel vulnerabilities for …	System
168	AMD PSP PCI device discovered.	System
169	Secure firmware update status.	System
170	Secure firmware image invalid.	System
171	Secure firmware version.	System
172	Features are enabled that require all processors be started.	Microsoft-Windows-Hyper-V-Hypervisor-Admin
173	On the prior boot session, the root partition did not respond to the synthetic …	System
8451	Hyper-V failed creating a new partition (status %1)!	Microsoft-Windows-Hyper-V-Hypervisor-Operational
12288		Operational
12289		Operational
12290		Operational
12291		Operational
12292		Operational
12293		Operational
12294		Operational
12295		Operational
12296		Operational
12297		Operational
12298		Operational
12299		Operational
12300		Operational
12301		Operational
12302		Operational
12303		Operational
12304		Operational
12305		Operational
12306		Operational
12307		Operational
12308		Operational
12309		Operational
12310		Operational
12311		Operational
12312		Operational
12313		Operational
12314		Operational
12315		Operational
12316		Operational
12317		Operational
12550	Hyper-V detected access to a restricted MSR.	Microsoft-Windows-Hyper-V-Hypervisor-Operational
16641	Hyper-V successfully created a new partition (partition %1).	Microsoft-Windows-Hyper-V-Hypervisor-Operational
16642	Hyper-V successfully deleted a partition (partition %1).	Microsoft-Windows-Hyper-V-Hypervisor-Operational

Event ID 1 — Hypervisor successfully started.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor successfully started.

Event ID 2 — Hypervisor scheduler type is %1.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor scheduler type is %1.

Fields

Name	Description
`SchedulerType`	—

Event ID 3 — Hypervisor Eventlog for global system events could not be created!

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor Eventlog for global system events could not be created!

Event ID 5 — Hypervisor launch has been disabled through the hypervisorlaunchtype bcdedit setting.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch has been disabled through the hypervisorlaunchtype bcdedit setting.

Event ID 10 — Hypervisor Eventlog creation failed!

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hypervisor Eventlog creation failed!

Fields

Name	Description
`Error`	—

Event ID 11 — Hypervisor Eventlog deletion failed!

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hypervisor Eventlog deletion failed!

Fields

Name	Description
`Error`	—

Event ID 12 — Host processor features mask: %1 Host xsave features mask: %2 Host cache line flush size: %3 bytes.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Host processor features mask: %1

Host xsave features mask: %2

Host cache line flush size: %3 bytes

Fields

Name	Description
`Host_processor_features_mask`	—
`Host_xsave_features_mask`	—
`Host_cache_line_flush_size`	—
`BankCount`	—
`ProcessorFeatures`	—
`XsaveFeatures`	—
`CLFlushSize`	—

Event ID 13 — Hypervisor fails to start ETW tracing session.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor fails to start ETW tracing session.

Event ID 14 — Hypervisor Eventlog flush failed!

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hypervisor Eventlog flush failed!

Fields

Name	Description
`Error`	—

Event ID 20 — Hypervisor launch failed; sleep and hibernate could not be disabled (status %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; sleep and hibernate could not be disabled (status %1).

Fields

Name	Description
`ErrorCode`	—

Event ID 26 — Hypervisor launch failed; the hypervisor boot loader's internal logic failed (BalStatus %1, sub-status %2).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the hypervisor boot loader's internal logic failed (BalStatus %1, sub-status %2).

Fields

Name	Description
`BalStatus`	—
`Error`	—

Event ID 27 — Hypervisor launch failed; the hypervisor boot loader was unable to allocate sufficient resources to perform the launch.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the hypervisor boot loader was unable to allocate sufficient resources to perform the launch.

Event ID 28 — Hypervisor launch failed; the hypervisor boot loader does not support the vendor of at least one of the processors in the system.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the hypervisor boot loader does not support the vendor of at least one of the processors in the system.

Event ID 29 — Hypervisor launch failed; at least one of the processors in the system does not appear to support the features required by the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; at least one of the processors in the system does not appear to support the features required by the hypervisor.  (leaf: {Leaf}; required features: {FeaturesRequired}; features available: {FeaturesPresent})

Fields

Name	Description
`Leaf`	—
`FeaturesRequired`	—
`FeaturesPresent`	—

Event ID 31 — Hyper-V launch failed; the system does not appear to have a sufficient level of ACPI support to launch the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hyper-V launch failed; the system does not appear to have a sufficient level of ACPI support to launch the hypervisor.

Event ID 32 — Hypervisor launch failed; at least one of the processors in the system does not appear to provide a virtualization platform supported by the hyperv...

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; at least one of the processors in the system does not appear to provide a virtualization platform supported by the hypervisor.

Event ID 33 — Hyper-V launch failed; the image {ImageName} could not be accessed (status {Status}).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hyper-V launch failed; the image {ImageName} could not be accessed (status {Status}).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 34 — Hyper-V launch failed; the image %1 could not be loaded (status %2).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hyper-V launch failed; the image %1 could not be loaded (status %2).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 35 — Hyper-V launch failed; the image {ImageName} could not be read (status {Status}).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hyper-V launch failed; the image {ImageName} could not be read (status {Status}).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 36 — Hypervisor launch failed; the image %1 failed code integrity checks, and cannot be used.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the image %1 failed code integrity checks, and cannot be used.

Fields

Name	Description
`ImageName`	—

Event ID 37 — Hypervisor launch failed; the image %1 does not contain the image description datastructures, and cannot be used.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the image %1 does not contain the image description datastructures, and cannot be used.

Fields

Name	Description
`ImageName`	—

Event ID 38 — Hyper-V launch failed; at least one of the processors in the system was unable to launch the hypervisor (status %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hyper-V launch failed; at least one of the processors in the system was unable to launch the hypervisor (status %1).

Fields

Name	Description
`BalStatus`	—

Event ID 39 — Hypervisor Load Options - %1.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin

Message

Hypervisor Load Options - %1.

Fields

Name	Description
`LoadOptions`	—

Event ID 40 — Hypervisor launch failed; the hypervisor image is revision %1, but the currently installed virtualization software only supports launching revision...

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the hypervisor image is revision %1, but the currently installed virtualization software only supports launching revision %2 hypervisor images.

Fields

Name	Description
`HypervisorVersion`	—
`VersionSupported`	—

Event ID 41 — Hypervisor launch failed; Either VMX not present or not enabled in BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System
Level: 2
Samples: 1

Message

Hypervisor launch failed; Either VMX not present or not enabled in BIOS.

Example Event

system:
  provider: Microsoft-Windows-Hyper-V-Hypervisor
  guid: 52FC89F8-995E-434C-A91E-199986449890
  event_source_name: ''
  event_id: 41
  version: 0
  level: 2
  task: 0
  opcode: 0
  keywords: 9223442405598953472
  time_created: '2023-11-06T06:24:56.254005+00:00'
  event_record_id: 1627
  correlation:
    ActivityID: A94F03D9-96B8-C53E-D5D7-00FBA9067B3F
  execution:
    process_id: 4
    thread_id: 8
  channel: System
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data: {}
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 42 — Hypervisor launch failed; Either SVM not present or not enabled in BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Either SVM not present or not enabled in BIOS.

Event ID 43 — Hypervisor launch failed; EL2 not present.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; EL2 not present.

Event ID 44 — Hypervisor launch failed; Either No Execute feature (NX) not present or not enabled in BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Either No Execute feature (NX) not present or not enabled in BIOS.

Event ID 46 — Hypervisor launch failed; Processor does not support the minimum features required to run the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Processor does not support the minimum features required to run the hypervisor (MSR index %1, allowed bits %2, required bits %3).

Fields

Name	Description
`MSRIndex`	—
`AllowedZeroes`	—
`AllowedOnes`	—

Event ID 47 — Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor (BalStatus {BalStatus}; leaf1 EAX {Leaf1Eax}; VMCR MS EAX {VmCrMsrValue}; SVM CPUID features {SvmFeatureEax}; has working SMM {HasWorkingSmm}).

Fields

Name	Description
`BalStatus`	—
`Leaf1Eax`	—
`VmCrMsrValue`	—
`SvmFeatureEax`	—
`HasWorkingSmm`	—

Event ID 48 — Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor (leaf %1, register %2: features needed %3, features supported %4).

Fields

Name	Description
`Leaf`	—
`Register`	—
`FeaturesNeeded`	—
`FeaturesSupported`	—

Event ID 54 — Hypervisor launch failed; Hypervisor image does not match the platform being run on.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Hypervisor image does not match the platform being run on.

Event ID 55 — Hypervisor launch failed; Required firmware table not found.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Required firmware table not found.

Event ID 56 — Hypervisor launch failed; Encountered invalid firmware information.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Encountered invalid firmware information.

Event ID 59 — Hypervisor launch failed; Second Level Address Translation is required to launch the hypervisor.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Second Level Address Translation is required to launch the hypervisor.

Event ID 60 — Hypervisor launch failed; Secure Mode Extensions have been enabled by the BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Secure Mode Extensions have been enabled by the BIOS. Please disable Secure Mode Extensions in the BIOS to launch Hyper-V.

Event ID 61 — Hypervisor launch failed; Minimum CPUID leaves required by the hypervisor are not supported on the system.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Minimum CPUID leaves required by the hypervisor are not supported on the system.

Event ID 62 — Hypervisor launch failed; The physical address limit supported has been exceeded.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The physical address limit supported has been exceeded.

Event ID 63 — Hypervisor launch failed; The hypervisor was unable to initialize successfully (phase %1), and was not started.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The hypervisor was unable to initialize successfully (phase %1), and was not started.  This initialization failure may be the result of a platform configuration or firmware issue.  Contact your system vendor for more information or updated firmware.

Fields

Name	Description
`Phase`	—

Event ID 64 — Hypervisor launch failed; Too many runtime services memory ranges described by firmware.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Too many runtime services memory ranges described by firmware.

Event ID 65 — Hypervisor launch failed; Memory ranges validation failure (BalStatus: %1, BalInternalError: %2, Line: %3, MemoryRangesCount: %4).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; Memory ranges validation failure (BalStatus: %1, BalInternalError: %2, Line: %3, MemoryRangesCount: %4).

Fields

Name	Description
`BalStatus`	—
`BalInternalError`	—
`Line`	—
`MemoryRangesCount`	—
`MemoryRanges`	—

Event ID 80 — Hypervisor launch failed; The operating systems boot loader failed with error %1.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating systems boot loader failed with error %1.

Fields

Name	Description
`NtStatus`	—

Event ID 81 — Hypervisor launch failed; The operating system boot loader was unable to locate a required resource.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating system boot loader was unable to locate a required resource.

Event ID 82 — Hypervisor launch failed; The operating system boot loader detected a persistent memory failure.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating system boot loader detected a persistent memory failure.

Event ID 83 — Hypervisor launch failed; The operating system boot loader was unable to allocate sufficient memory to complete the operation.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating system boot loader was unable to allocate sufficient memory to complete the operation.

Event ID 84 — Hypervisor launch failed; The operating system boot loader was unable to allocate sufficient resources to complete the operation.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating system boot loader was unable to allocate sufficient resources to complete the operation.

Event ID 85 — Hypervisor launch failed; The operating system boot loader detected a memory map conflict.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; The operating system boot loader detected a memory map conflict.

Event ID 86 — Hypervisor launch failed; the version of the microcode update dll does not match the current operating system.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor launch failed; the version of the microcode update dll does not match the current operating system.

Fields

Name	Description
`ExpectedVersion`	—
`ActualVersion`	—
`ExpectedFunctionTableSize`	—
`ActualFunctionTableSize`	—
`UpdateDllName`	—

Event ID 96 — Hypervisor processor startup failed (APIC ID %1, status %2).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor processor startup failed (APIC ID %1, status %2). Further processors in the system were not started.

Fields

Name	Description
`CPU`	—
`ErrorCode`	—

Event ID 97 — Hypervisor processor startup failed (APIC ID %1) due to CPUID feature validation error.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor processor startup failed (APIC ID %1) due to CPUID feature validation error. Further processors in the system were not started. Leaf %2, register %3 feature mismatch: BSP has features %5; AP has features %4

Fields

Name	Description
`CPU`	—
`LeafNumber`	—
`Register`	—
`BSPCpuidData`	—
`APCpuidData`	—

Event ID 129 — Hypervisor initialized I/O remapping.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor initialized I/O remapping.

Hardware present: %1
Hardware enabled: %2
Policy: %3
Enabled features: %4
Internal information: %5
Problems: %6
Additional information: %7

Fields

Name	Description
`Hardware_present`	—
`Hardware_enabled`	—
`Policy`	—
`Enabled_features`	—
`Internal_information`	—
`Problems`	—
`Additional_information`	—
`HardwarePresent`	—
`HardwareEnabled`	—
`EnabledFeatures`	—
`InternalInfo`	—
`AdditionalInfo`	—

Event ID 130 — Hypervisor I/O remapping is forcibly enabled by policy (the hypervisoriommupolicy BCD option is set to enable).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor I/O remapping is forcibly enabled by policy (the hypervisoriommupolicy BCD option is set to enable). If the system exhibits instability or reduced performance, consider restoring the default policy.

Event ID 131 — There is an I/O remapping problem with the sytem BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

There is an I/O remapping problem with the sytem BIOS.

Problems: %1

Fields

Name	Description
`Problems`	—

Event ID 144 — A device is operating with reduced performance because of a problem with the system BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device is operating with reduced performance because of a problem with the system BIOS.



The device is not reported under the scope of a unique I/O remapping unit.



Device ID: %1

Partition ID: %2

Fields

Name	Description
`DeviceId`	—
`PartitionId`	—

Event ID 145 — A device will not work correctly because of a problem with the system BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device will not work correctly because of a problem with the system BIOS.



The Requester IDs reported for the device overlap with those reported for another device.



Device ID: %1

Partition ID: %2

Fields

Name	Description
`DeviceId`	—
`PartitionId`	—

Event ID 146 — A device will not work correctly because the hypervisor does not have enough resources.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device will not work correctly because the hypervisor does not have enough resources.



Device ID: %1

Partition ID: %2

Fields

Name	Description
`DeviceId`	—
`PartitionId`	—

Event ID 147 — A device will not work correctly because of a problem with the system BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device will not work correctly because of a problem with the system BIOS.



An IOAPIC is not correctly reported.



IOAPIC ID: %1

Fields

Name	Description
`IoApicId`	—

Event ID 148 — A device could not be used by a child partition because of a limitation of the system hardware and BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device could not be used by a child partition because of a limitation of the system hardware and BIOS.



The I/O remapping unit that controls the device does not have sufficient capabilities.



Device ID: %1

I/O remapping unit base address: %2

Partition ID: %3

Fields

Name	Description
`DeviceId`	—
`UnitBaseAddress`	—
`PartitionId`	—

Event ID 149 — A device could not be used by a child partition because of a limitation of the system hardware and BIOS.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

A device could not be used by a child partition because of a limitation of the system hardware and BIOS.



The device cannot be securely used by a child partition.



Device ID: %1

Partition ID: %2

Fields

Name	Description
`DeviceId`	—
`PartitionId`	—

Event ID 150 — The image {ImageName} could not be accessed (status {Status}).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The image {ImageName} could not be accessed (status {Status}).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 151 — The image {ImageName} could not be loaded (status {Status}).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The image {ImageName} could not be loaded (status {Status}).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 152 — The image %1 could not be read (status %2).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The image %1 could not be read (status %2).

Fields

Name	Description
`ImageName`	—
`Status`	—

Event ID 153 — The image %1 failed code integrity checks, and cannot be used.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The image %1 failed code integrity checks, and cannot be used.

Fields

Name	Description
`ImageName`	—

Event ID 154 — Hypervisor failed to properly synchronize TSC across logical processors (Max delta: %1, Min delta: %2).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor failed to properly synchronize TSC across logical processors (Max delta: %1, Min delta: %2).

Fields

Name	Description
`MaxDelta`	—
`MinDelta`	—

Event ID 155 — Host processor features mask: %1 Host xsave features mask: %2 Host cache line flush size: %3 bytes.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin

Message

Host processor features mask: %1

Host xsave features mask: %2

Host cache line flush size: %3 bytes

Fields

Name	Description
`Host_processor_features_mask`	—
`Host_xsave_features_mask`	—
`Host_cache_line_flush_size`	—
`BankCount`	—
`ProcessorFeatures`	—
`XsaveFeatures`	—
`CLFlushSize`	—

Event ID 156 — Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor configured mitigations for CVE-2018-3646 for virtual machines.

Processor not affected: %1
Processor family not affected: %2
Processor supports cache flush: %3
HyperThreading enabled: %4
Parent hypervisor applies mitigations: %5
Mitigations disabled by bcdedit: %6
Mitigations enabled: %7
Cache flush needed: %8

Fields

Name	Description
`InitialAllocationNumaPolicy`	—

Event ID 156 — Hypervisor initial page allocation NUMA policy: .

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin
Level: 4
Samples: 1

Fields

Name	Description
`InitialAllocationNumaPolicy`	Hypervisor initial page allocation NUMA policy.

Example Event

system:
  provider: Microsoft-Windows-Hyper-V-Hypervisor
  guid: 52FC89F8-995E-434C-A91E-199986449890
  event_source_name: ''
  event_id: 156
  version: 1
  level: 4
  task: 0
  opcode: 0
  keywords: 4611686018427387904
  time_created: '2023-11-06T06:24:56.253950+00:00'
  event_record_id: 6
  correlation:
    ActivityID: A94F03D9-96B8-C53E-D5D7-00FBA9067B3F
  execution:
    process_id: 4
    thread_id: 8
  channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin
  computer: WinDev2310Eval
  security:
    user_id: S-1-5-18
event_data:
  InitialAllocationNumaPolicy: 0
message: ''

References

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 157 — The hypervisor did not enable mitigations for side channel vulnerabilities for virtual machines because HyperThreading is enabled and the hyperviso...

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The hypervisor did not enable mitigations for side channel vulnerabilities for virtual machines because HyperThreading is enabled and the hypervisor core scheduler is not enabled. To enable mitigations for virtual machines, enable the core scheduler by running "bcdedit /set hypervisorschedulertype core" from an elevated command prompt and reboot.

Event ID 158 — The queried interface version %1 is not supported (Min : %2, Max : %3).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The queried interface version %1 is not supported (Min : %2, Max : %3).

Fields

Name	Description
`Max`	1 is not supported (Min.
`CurrentVersion`	—
`MinVersion`	—
`MaxVersion`	—

Event ID 159 — The queried interface is incomplete.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The queried interface is incomplete.

Event ID 160 — Partition persistence services will be unavailable.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Partition persistence services will be unavailable.

Event ID 161 — The configured Minroot settings are not compatible with the hypervisor core scheduler and have been overriden.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The configured Minroot settings are not compatible with the hypervisor core scheduler and have been overriden. This may expose a different number of logical processors to the root partition.

Event ID 162 — Failed to unregister the remote hypercall interface (status %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Failed to unregister the remote hypercall interface (status %1).

Fields

Name	Description
`NtStatus`	—

Event ID 163 — The hypervisor encountered an internal error: nested NMI (processor %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

The hypervisor encountered an internal error: nested NMI (processor %1).

Fields

Name	Description
`Processor`	—

Event ID 164 — The hypervisor encountered an internal error: IPI timeout (processor %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

The hypervisor encountered an internal error: IPI timeout (processor %1).

Fields

Name	Description
`Processor`	—

Event ID 165 — Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Hypervisor configured mitigations for CVE-2019-11091, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130 for virtual machines.

Processor not affected: %1
Processor family not affected: %2
Processor supports microarchitectural buffer flush: %3
Buffer flush needed: %4

Fields

Name	Description
`NotAffectedMdsNo`	—
`NotAffectedAtom`	—
`MdClearSupported`	—
`BufferFlushNeeded`	—

Event ID 166 — Hypervisor Load Options are conflicting - %1, %2.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin

Message

Hypervisor Load Options are conflicting - %1, %2.

Fields

Name	Description
`LoadOptions`	—
`LoadFlags`	—

Event ID 167 — The hypervisor did not enable mitigations for side channel vulnerabilities for virtual machines because HyperThreading is enabled.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

The hypervisor did not enable mitigations for side channel vulnerabilities for virtual machines because HyperThreading is enabled. To enable mitigations for virtual machines, disable HyperThreading.

Event ID 168 — AMD PSP PCI device discovered.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

AMD PSP PCI device discovered. Segment: %1, bus: %2, device: %3, function: %4.

Fields

Name	Description
`AMD_PSP_PCI_device_discovered_Segment`	AMD PSP PCI device discovered. Segment.
`bus`	—
`device`	—
`function`	—
`Segment`	—
`Bus`	—
`Device`	—
`Function`	—

Event ID 169 — Secure firmware update status.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Secure firmware update status: %1.

Fields

Name	Description
`Secure_firmware_update_status`	—
`Status`	—

Event ID 170 — Secure firmware image invalid.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Secure firmware image invalid.

Event ID 171 — Secure firmware version.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

Secure firmware version: %1.

Fields

Name	Description
`Secure_firmware_version`	—
`Version`	—

Event ID 172 — Features are enabled that require all processors be started.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Admin

Message

Features are enabled that require all processors be started. %1 of %2 processors currently running.

Fields

Name	Description
`RunningProcessors`	—
`AvailableProcessors`	—

Event ID 173 — On the prior boot session, the root partition did not respond to the synthetic watchdog in time, triggering a hardware watchdog reboot.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: System

Message

On the prior boot session, the root partition did not respond to the synthetic watchdog in time, triggering a hardware watchdog reboot.

Event ID 8451 — Hyper-V failed creating a new partition (status %1)!

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hyper-V failed creating a new partition (status %1)!

Fields

Name	Description
`Error`	—

Event ID 12288 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`FailurePhase`	—
`NtStatus`	—

Event ID 12289 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12290 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12291 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12292 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12293 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12294 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12295 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12296 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`PartitionId`	—
`NtStatus`	—
`AuxiliaryData`	—

Event ID 12297 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`TotalSystemPages`	—
`TotalPagesRequested`	—
`Policy`	—
`ProximityDomainCount`	—
`AllocationPass`	—
`ProximityDomainIndex`	—
`ProximityDomainId`	—
`TotalDomainPages`	—
`PagesRequested`	—
`BalStatus`	—
`PagesAllocated`	—

Event ID 12298 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12299 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12300 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12301 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12302 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`BalStatus`	—

Event ID 12303 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`HsrInUse`	—
`Reason`	—

Event ID 12304 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12305 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12306 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12307 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12308 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12309 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12310 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12311 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`ImageName`	—
`Checksum`	—
`Timestamp`	—
`NtStatus`	—

Event ID 12312 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12313 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`AuxData`	—
`NtStatus`	—

Event ID 12314 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`HsrInUse`	—
`Reason`	—

Event ID 12315 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`LoadOptions`	—

Event ID 12316 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`LoadOptions`	—

Event ID 12317 —

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Operational

Fields

Name	Description
`BaseLocation`	—
`Line`	—
`BalStatus`	—
`AuxData`	—

Event ID 12550 — Hyper-V detected access to a restricted MSR.

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hyper-V detected access to a restricted MSR (Msr: %1, IsWrite: %2, MsrValue: %3, AccessStatus: %4, Pc: %5, ImageBase: %6, ImageChecksum: %7, ImageTimestamp: %8, ImageName: %9).

Fields

Name	Description
`Msr`	—
`IsWrite`	—
`MsrValue`	—
`AccessStatus`	—
`Pc`	—
`ImageBase`	—
`ImageChecksum`	—
`ImageTimestamp`	—
`ImageName`	—

Event ID 16641 — Hyper-V successfully created a new partition (partition %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hyper-V successfully created a new partition (partition %1).

Fields

Name	Description
`PartitionId`	—

Event ID 16642 — Hyper-V successfully deleted a partition (partition %1).

Provider: Microsoft-Windows-Hyper-V-Hypervisor
Channel: Microsoft-Windows-Hyper-V-Hypervisor-Operational

Message

Hyper-V successfully deleted a partition (partition %1).

Fields

Name	Description
`PartitionId`	—