detection.wiki

Microsoft-Windows-Kernel-PnP › Event 403

Event ID 403 — Device DeviceInstanceId requires a system reboot to complete configuration.

Provider
Microsoft-Windows-Kernel-PnP
Channel
Configuration
Level
Warning
Opcode
Info

Description

Device DeviceInstanceId requires a system reboot to complete configuration.

Message #

Device %1 requires a system reboot to complete configuration.

Driver Name: %2
Class GUID: %3
Driver Date: %4
Driver Version: %5
Driver Provider: %6
Driver Section: %8
Driver Rank: %9
Matching Device ID: %10
Outranked Drivers: %11
Device Updated: %12
Status: %13
Parent Device: %14

Fields #

NameDescription
DeviceInstanceId UnicodeString—
DriverName UnicodeString—
ClassGuid GUID—
DriverDate UnicodeString—
DriverVersion UnicodeString—
DriverProvider UnicodeString—
DriverInbox Boolean—
DriverSection UnicodeString—
DriverRank HexInt32—
MatchingDeviceId UnicodeString—
OutrankedDrivers UnicodeString—
DeviceUpdated Boolean—
Status HexInt32— NTSTATUS reference
ParentDeviceInstanceId UnicodeStringParent Device.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-PnP",
    "guid": "9C205A39-1250-487D-ABD7-E831C6290539",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-26T04:16:19.107877+00:00",
    "event_record_id": 112,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 248
    },
    "channel": "Microsoft-Windows-Kernel-PnP/Configuration",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceInstanceId": "ROOT\\VOLMGR\\0000",
    "DriverName": "volmgr.inf",
    "ClassGuid": "4D36E97D-E325-11CE-BFC1-08002BE10318",
    "DriverDate": "06/21/2006",
    "DriverVersion": "10.0.22621.608",
    "DriverProvider": "Microsoft",
    "DriverInbox": true,
    "DriverSection": "Volmgr",
    "DriverRank": "0xff0000",
    "MatchingDeviceId": "ROOT\\VOLMGR",
    "OutrankedDrivers": "",
    "DeviceUpdated": false,
    "Status": "0x0",
    "ParentDeviceInstanceId": "HTREE\\ROOT\\0"
  },
  "message": ""
}

References #