Microsoft-Windows-NcdAutoSetup
17 events across 2 channels
Event ID 4001 — Network connected device (Name: %1; Model %2) got qualified for automatic setup.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4002 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup because it was manually removed earlier.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4003 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device category is disqualified.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4004 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup due to an unexpected error (%3).
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Integer1 | — |
Event ID 4005 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device category property is missing.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4006 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device IP address property is missing.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4007 — Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device PnP-X Id property is missing.
Message
Fields
| Name | Description |
|---|---|
Network_connected_device_Name | Network connected device (Name. |
String1 | — |
String2 | — |
Event ID 4008 — Network connected device (Model %1) got disqualified for automatic setup because its device friendly name property is missing.
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Event ID 5001 — Network got qualified for automatic setup of network connected devices
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Example Event
system:
provider: Microsoft-Windows-NcdAutoSetup
guid: EC23F986-AE2D-4269-B52F-4E20765C1A94
event_source_name: ''
event_id: 5001
version: 0
level: 4
task: 3
opcode: 0
keywords: 9223372036854775808
time_created: '2023-10-25T21:24:48.831864+00:00'
event_record_id: 1
correlation: {}
execution:
process_id: 7248
thread_id: 7332
channel: Microsoft-Windows-NcdAutoSetup/Operational
computer: WinDevEval
security:
user_id: S-1-5-19
event_data:
String1: Network
message: ''
References
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5002 — Network got disqualified for automatic setup of network connected devices because its network category is disqualified
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Event ID 5003 — Network got disqualified for automatic setup of network connected devices because its network size is disqualified
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Event ID 5004 — Network got disqualified for automatic setup of network connected devices because network discovery is turned off
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Event ID 5005 — Network (%1) got disqualified for automatic setup of network connected devices because %2 bits are used for its mask.
Message
Fields
| Name | Description |
|---|---|
String1 | — |
Integer1 | — |