Microsoft-Windows-NcdAutoSetup

17 events across 2 channels

Event ID	Title	Channel
4001	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4002	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4003	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4004	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4005	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4006	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4007	Network connected device (Name: Network_connected_device_Name; Model String1) …	Operational
4008	Network connected device (Model String1) got disqualified for automatic setup …	Operational
5001	Network (String1) got qualified for automatic setup of network connected …	Operational
5002	Network (String1) got disqualified for automatic setup of network connected …	Operational
5003	Network (String1) got disqualified for automatic setup of network connected …	Operational
5004	Network (String1) got disqualified for automatic setup of network connected …	Operational
5005	Network (String1) got disqualified for automatic setup of network connected …	Operational
6001		Diagnostic
6002		Diagnostic
6003		Diagnostic
6004		Diagnostic

Event ID 4001 — Network connected device (Name: Network_connected_device_Name; Model String1) got qualified for automatic setup.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceQualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got qualified for automatic setup.

Message #

Network connected device (Name: %1; Model %2) got qualified for automatic setup

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4002 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because it was manually removed earlier.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because it was manually removed earlier.

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup because it was manually removed earlier

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4003 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category is disqualified.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category is disqualified.

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device category is disqualified

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4004 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup due to an unexpected error (String2).

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup due to an unexpected error (String2).

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup due to an unexpected error (%3)

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—
`Integer1` UInt32	—

Event ID 4005 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category property is missing.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device category property is missing.

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device category property is missing

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4006 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device IP address property is missing.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device IP address property is missing.

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device IP address property is missing

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4007 — Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device PnP-X Id property is missing.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Name: Network_connected_device_Name; Model String1) got disqualified for automatic setup because its device PnP-X Id property is missing.

Message #

Network connected device (Name: %1; Model %2) got disqualified for automatic setup because its device PnP-X Id property is missing

Fields #

Name	Description
`Network_connected_device_Name`	Network connected device (Name.
`String1` UnicodeString	—
`String2` UnicodeString	—

Event ID 4008 — Network connected device (Model String1) got disqualified for automatic setup because its device friendly name property is missing.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: DeviceDisqualified

Description

Network connected device (Model String1) got disqualified for automatic setup because its device friendly name property is missing.

Message #

Network connected device (Model %1) got disqualified for automatic setup because its device friendly name property is missing

Fields #

Name	Description
`String1` UnicodeString	—

Event ID 5001 — Network (String1) got qualified for automatic setup of network connected devices.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Level: Informational
Task: NetworkQualified

Description

Network (String1) got qualified for automatic setup of network connected devices.

Message #

Network (%1) got qualified for automatic setup of network connected devices

Fields #

Name	Description
`String1` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-NcdAutoSetup",
    "guid": "EC23F986-AE2D-4269-B52F-4E20765C1A94",
    "event_source_name": "",
    "event_id": 5001,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T21:24:48.831864+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 7248,
      "thread_id": 7332
    },
    "channel": "Microsoft-Windows-NcdAutoSetup/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "String1": "Network"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 5002 — Network (String1) got disqualified for automatic setup of network connected devices because its network category is disqualified.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: NetworkDisqualified

Description

Network (String1) got disqualified for automatic setup of network connected devices because its network category is disqualified.

Message #

Network (%1) got disqualified for automatic setup of network connected devices because its network category is disqualified

Fields #

Name	Description
`String1` UnicodeString	—

Event ID 5003 — Network (String1) got disqualified for automatic setup of network connected devices because its network size is disqualified.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: NetworkDisqualified

Description

Network (String1) got disqualified for automatic setup of network connected devices because its network size is disqualified.

Message #

Network (%1) got disqualified for automatic setup of network connected devices because its network size is disqualified

Fields #

Name	Description
`String1` UnicodeString	—

Event ID 5004 — Network (String1) got disqualified for automatic setup of network connected devices because network discovery is turned off.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: NetworkDisqualified

Description

Network (String1) got disqualified for automatic setup of network connected devices because network discovery is turned off.

Message #

Network (%1) got disqualified for automatic setup of network connected devices because network discovery is turned off

Fields #

Name	Description
`String1` UnicodeString	—

Event ID 5005 — Network (String1) got disqualified for automatic setup of network connected devices because Integer1 bits are used for its mask.

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Operational
Task: NetworkDisqualified

Description

Network (String1) got disqualified for automatic setup of network connected devices because Integer1 bits are used for its mask.

Message #

Network (%1) got disqualified for automatic setup of network connected devices because %2 bits are used for its mask

Fields #

Name	Description
`String1` UnicodeString	—
`Integer1` UInt32	—

Event ID 6001 —

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Diagnostic
Task: taskNetworkSizeCalculation

Event ID 6002 —

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Diagnostic
Task: taskNetworkSizeCalculation

Event ID 6003 —

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Diagnostic
Task: taskNetworkQualificationCheck

Event ID 6004 —

Provider: Microsoft-Windows-NcdAutoSetup
Channel: Diagnostic
Task: taskNetworkQualificationCheck