Microsoft-Windows-NCSI

58 events across 2 channels

Event ID	Title	Channel
2001	Corporate connectivity check will be skipped.	Analytic
2002	Corporate connectivity check is enabled	Analytic
2003	Corporate inside/outside location check will be skipped.	Analytic
2004	Corporate inside/outside location check is enabled	Analytic
4001	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic
4002	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic
4003	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic
4004	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic
4005	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic
4006	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic
4007	Entered State: Interface_Luid Interface Luid: InterfaceGuid.	Analytic
4008	Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.	Analytic
4009	Inside/Outside detection started for interface IfLuid.	Operational
4010	Inside/Outside detection finished for interface IfLuid (CorporateLocation).	Operational
4011	Windows Firewall Group Policy settings have been updated.	Operational
4012	Inside/Outside probe failed for interface Host.	Operational
4013	Active Internet Probe started on interface InterfaceGuid.	Analytic
4014	Active Internet Probe finished on interface InterfaceGuid (Succeeded).	Analytic
4015	Active Internet Probe (DNS) started on interface InterfaceGuid.	Analytic
4016	Active Internet Probe (DNS) finished on interface InterfaceGuid.	Analytic
4017	Active Internet Probe (HTTP) started on interface InterfaceGuid.	Analytic
4018	Active Internet Probe (HTTP) finished on interface InterfaceGuid.	Analytic
4019	Active Corp Probe started on interface InterfaceGuid.	Analytic
4020	Active Corp Probe finished on interface InterfaceGuid (Succeeded).	Analytic
4021	Active Corp Probe (DNS) started on interface InterfaceGuid.	Analytic
4022	Active Corp Probe (DNS) finished on interface InterfaceGuid.	Analytic
4023	Active Corp Probe (HTTP) started on interface InterfaceGuid.	Analytic
4024	Active Corp Probe (HTTP) finished on interface InterfaceGuid.	Analytic
4025	Proxy Detection started	Analytic
4026	Proxy Detection stopped (HasProxy=ErrorCode).	Analytic
4027	Opportunistic Internet flag on interface InterfaceGuid for family Family marked.	Analytic
4028	Inside/Outside detection is suspect	Operational
4029	Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: …	Analytic
4030	Suspect state cancelled on interface IfLuid (Family: Family).	Analytic
4031	Suspect state expired on interface IfLuid (Family: Family).	Analytic
4032	Entered corporate suspect state on interface IfLuid.	Analytic
4033	Corporate suspect state cancelled on interface IfLuid.	Analytic
4034	Corporate suspect state expired on interface IfLuid.	Analytic
4035	Cancelling hotspot detection scenario for interface InterfaceGuid.	Analytic
4036		Analytic
4037	Starting hotspot detection for family Family on interface IfLuid.	Analytic
4038	Hotspot detected on interface IfLuid (Family: Family).	Operational
4039	Hotspot not detected on interface IfLuid (Family: Family).	Analytic
4040	Interface ConnectedInterfaceGuid (IfLuid) has been connected.	Analytic
4041	Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.	Analytic
4042	Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability …	Operational
4043	Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid …	Analytic
4044	Passive Poll state change.	Analytic
4045	NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).	Analytic
4046	Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: …	Analytic
4047	Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless …	Analytic
4048	Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: …	Analytic
4049	Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: …	Analytic
4050	Preferred global address change on HasPreferredGlobalAddress …	Analytic
4051	Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = …	Analytic
4052	Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: …	Analytic
4053		Analytic
4054		Analytic

Event ID 2001 — Corporate connectivity check will be skipped.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Corporate connectivity check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate connectivity check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8	—

Event ID 2002 — Corporate connectivity check is enabled

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Corporate connectivity check is enabled.

Message #

Corporate connectivity check is enabled

Event ID 2003 — Corporate inside/outside location check will be skipped.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Description

Corporate inside/outside location check will be skipped. Reason: CorpCheckDisabledReason.

Message #

Corporate inside/outside location check will be skipped. Reason: %1

Fields #

Name	Description
`CorpCheckDisabledReason` UInt8	—

Event ID 2004 — Corporate inside/outside location check is enabled

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Description

Corporate inside/outside location check is enabled.

Message #

Corporate inside/outside location check is enabled

Event ID 4001 — Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforNetReady

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`Entered_State`	—
`Interface_Luid`	—
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4002 — Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforNetReady

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4003 — Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforLocalConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`Entered_State`	—
`Interface_Luid`	—
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4004 — Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforLocalConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4005 — Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforInternetConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`Entered_State`	—
`Interface_Luid`	—
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4006 — Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforInternetConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4007 — Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Entered State: Interface_Luid Interface Luid: InterfaceGuid.

Message #

Entered State: %2 Interface Luid: %3

Fields #

Name	Description
`Entered_State`	—
`Interface_Luid`	—
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4008 — Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: WaitforCorporateConnectivity

Description

Transitioning to State: CurrentOrNextState Interface Luid: IfLuid.

Message #

Transitioning to State: %2 Interface Luid: %3

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4009 — Inside/Outside detection started for interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside detection started for interface IfLuid.

Message #

Inside/Outside detection started for interface %3.

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—

Event ID 4010 — Inside/Outside detection finished for interface IfLuid (CorporateLocation).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside detection finished for interface IfLuid (CorporateLocation).

Message #

Inside/Outside detection finished for interface %3 (%4).

Fields #

Name	Description
`InterfaceGuid` GUID	—
`CurrentOrNextState` UInt8	—
`IfLuid` UInt64	—
`CorporateLocation` UInt8	—
`CorporateLocationMetadata` UInt32	—

Event ID 4011 — Windows Firewall Group Policy settings have been updated.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection.

Message #

Windows Firewall Group Policy settings have been updated. Triggering another inside/outside location detection

Event ID 4012 — Inside/Outside probe failed for interface Host.

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: CheckCorporateInside/outsideLocation

Description

Inside/Outside probe failed for interface Host.

Message #

Inside/Outside probe failed for interface %1.

Error: %6 (%5)
Host: %3/%4
Next retry: %7 second(s).

Fields #

Name	Description
`Host`	—
`Error`	—
`Next_retry`	Host.
`IfLuid` UInt64	—
`InterfaceGuid` GUID	—
`ProbeHost` UnicodeString	—
`ProbePath` UnicodeString	—
`ErrorCode` UInt32	—
`ErrorString` UnicodeString	—
`RetryInterval` UInt32	—

Event ID 4013 — Active Internet Probe started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe started on interface InterfaceGuid.

Message #

Active Internet Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—
`ForceWeb` Boolean	—
`UseProxyCache` Boolean	—

Event ID 4014 — Active Internet Probe finished on interface InterfaceGuid (Succeeded).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe finished on interface InterfaceGuid (Succeeded).

Message #

Active Internet Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Succeeded` Boolean	—
`UsedDnsProbe` Boolean	—
`UsedProxy` Boolean	—
`ContentComparison` Boolean	—
`WebCompleted` Boolean	—
`WebRedirected` Boolean	—
`LocalErrorOccured` Boolean	—

Event ID 4015 — Active Internet Probe (DNS) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe (DNS) started on interface InterfaceGuid.

Message #

Active Internet Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4016 — Active Internet Probe (DNS) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe (DNS) finished on interface InterfaceGuid.

Message #

Active Internet Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4017 — Active Internet Probe (HTTP) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Start

Description

Active Internet Probe (HTTP) started on interface InterfaceGuid.

Message #

Active Internet Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4018 — Active Internet Probe (HTTP) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection
Opcode: Stop

Description

Active Internet Probe (HTTP) finished on interface InterfaceGuid.

Message #

Active Internet Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4019 — Active Corp Probe started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe started on interface InterfaceGuid.

Message #

Active Corp Probe started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4020 — Active Corp Probe finished on interface InterfaceGuid (Succeeded).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe finished on interface InterfaceGuid (Succeeded).

Message #

Active Corp Probe finished on interface %1 (%2)

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Succeeded` Boolean	—

Event ID 4021 — Active Corp Probe (DNS) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe (DNS) started on interface InterfaceGuid.

Message #

Active Corp Probe (DNS) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4022 — Active Corp Probe (DNS) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe (DNS) finished on interface InterfaceGuid.

Message #

Active Corp Probe (DNS) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4023 — Active Corp Probe (HTTP) started on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Start

Description

Active Corp Probe (HTTP) started on interface InterfaceGuid.

Message #

Active Corp Probe (HTTP) started on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4024 — Active Corp Probe (HTTP) finished on interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateConnectivityDetection
Opcode: Stop

Description

Active Corp Probe (HTTP) finished on interface InterfaceGuid.

Message #

Active Corp Probe (HTTP) finished on interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4025 — Proxy Detection started

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: ProxyDetection
Opcode: Start

Description

Proxy Detection started.

Message #

Proxy Detection started

Event ID 4026 — Proxy Detection stopped (HasProxy=ErrorCode).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: ProxyDetection
Opcode: Stop

Description

Proxy Detection stopped (HasProxy=ErrorCode).

Message #

Proxy Detection stopped (HasProxy=%1)

Fields #

Name	Description
`ErrorCode` UInt32	—
`Source` UInt8	—

Event ID 4027 — Opportunistic Internet flag on interface InterfaceGuid for family Family marked.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Opportunistic Internet flag on interface InterfaceGuid for family Family marked.

Message #

Opportunistic Internet flag on interface %1 for family %2 marked

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4028 — Inside/Outside detection is suspect

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: Inside/Outside detection verification

Description

Inside/Outside detection is suspect.

Message #

Inside/Outside detection is suspect

Event ID 4029 — Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Entered suspect state on interface InterfaceGuid (Family: IfLuid Reason: Family).

Message #

Entered suspect state on interface %2 (Family: %3 Reason: %4)

Fields #

Name	Description
`Reason`	—
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—
`SuspectStateReason` UInt8	—

Event ID 4030 — Suspect state cancelled on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Suspect state cancelled on interface IfLuid (Family: Family).

Message #

Suspect state cancelled on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4031 — Suspect state expired on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: Suspectstate

Description

Suspect state expired on interface IfLuid (Family: Family).

Message #

Suspect state expired on interface %2 (Family: %3)

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4032 — Entered corporate suspect state on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Entered corporate suspect state on interface IfLuid.

Message #

Entered corporate suspect state on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—

Event ID 4033 — Corporate suspect state cancelled on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Corporate suspect state cancelled on interface IfLuid.

Message #

Corporate suspect state cancelled on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—

Event ID 4034 — Corporate suspect state expired on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CorporateSuspectstate

Description

Corporate suspect state expired on interface IfLuid.

Message #

Corporate suspect state expired on interface %2

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—

Event ID 4035 — Cancelling hotspot detection scenario for interface InterfaceGuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Cancelling hotspot detection scenario for interface InterfaceGuid.

Message #

Cancelling hotspot detection scenario for interface %1

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4036 —

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: CheckCorporateInside/outsideLocation

Fields #

Name	Description
`InterfaceGuid` GUID	—

Event ID 4037 — Starting hotspot detection for family Family on interface IfLuid.

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Starting hotspot detection for family Family on interface IfLuid.

Message #

Starting hotspot detection for family %2 on interface %1

Fields #

Name	Description
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4038 — Hotspot detected on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Task: InternetConnectivityDetection

Description

Hotspot detected on interface IfLuid (Family: Family).

Message #

Hotspot detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4039 — Hotspot not detected on interface IfLuid (Family: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic
Task: InternetConnectivityDetection

Description

Hotspot not detected on interface IfLuid (Family: Family).

Message #

Hotspot not detected on interface %1 (Family: %2)

Fields #

Name	Description
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4040 — Interface ConnectedInterfaceGuid (IfLuid) has been connected.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface ConnectedInterfaceGuid (IfLuid) has been connected.

Message #

Interface %1 (%2) has been connected

Fields #

Name	Description
`ConnectedInterfaceGuid` GUID	—
`IfLuid` UInt64	—

Event ID 4041 — Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface DisconnectedInterfaceGuid (IfLuid) has been disconnected.

Message #

Interface %1 (%2) has been disconnected

Fields #

Name	Description
`DisconnectedInterfaceGuid` GUID	—
`IfLuid` UInt64	—

Event ID 4042 — Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability ChangeReason: CapabilityChangeReason).

Provider: Microsoft-Windows-NCSI
Channel: Operational
Level: Informational

Description

Capability change on InterfaceGuid (IfLuid Family: Family Capability: Capability ChangeReason: CapabilityChangeReason).

Message #

Capability change on %1 (%2 Family: %3 Capability: %4 ChangeReason: %5)

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	2 Family.
`Capability` UInt32	—
`CapabilityChangeReason` UInt32	ChangeReason.
`PreviousCapability` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-NCSI",
    "guid": "314DE49F-CE63-4779-BA2B-D616F6963A88",
    "event_source_name": "",
    "event_id": 4042,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387936,
    "time_created": "2023-11-06T06:25:52.980589+00:00",
    "event_record_id": 19,
    "correlation": {
      "ActivityID": "F590C418-1079-0000-E6C4-90F57910DA01"
    },
    "execution": {
      "process_id": 1696,
      "thread_id": 3516
    },
    "channel": "Microsoft-Windows-NCSI/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "InterfaceGuid": "3D03B11E-98A0-4304-84E2-CD3AAE8EFE1D",
    "IfLuid": 1689399649632256,
    "Family": 0,
    "Capability": 2,
    "CapabilityChangeReason": 4,
    "PreviousCapability": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4043 — Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid ProxiedCapability: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Proxied capability change on ProxiedCapability (InterfaceGuid Family: IfLuid ProxiedCapability: Family).

Message #

Proxied capability change on %1 (%2 Family: %3 ProxiedCapability: %4)

Fields #

Name	Description
`ProxiedCapability` UInt32	—
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4044 — Passive Poll state change.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Message #

Passive Poll state change (ShouldPassivePollRun: %1 WasPassivePollRunning: %2 IsPassivePollAllowed: %3 ClientPresent: %4 UserPresent: %5 NetworkQuietMode: %6 DeadUserPollCount: %7 DeadNetPollCountV4: %8 DeadNetPollCountV6: %9)

Fields #

Name	Description
`ShouldPassivePollRun` Boolean	—
`WasPassivePollRunning` Boolean	—
`IsPassivePollAllowed` Boolean	—
`ClientPresent` Boolean	—
`UserPresent` Boolean	—
`NetworkQuietMode` Boolean	—
`DeadUserPollCount` UInt32	—
`DeadNetPollCountV4` UInt32	—
`DeadNetPollCountV6` UInt32	—

Event ID 4045 — NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

NetReady update on NetReady (InterfaceGuid Family: IfLuid NetReady: Family).

Message #

NetReady update on %1 (%2 Family: %3 NetReady: %4)

Fields #

Name	Description
`NetReady` Boolean	—
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4046 — Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: IfLuid HasCorporateConnectivity: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Corporate connectivity change on HasCorporateConnectivity (InterfaceGuid Family: IfLuid HasCorporateConnectivity: Family).

Message #

Corporate connectivity change on %1 (%2 Family: %3 HasCorporateConnectivity: %4)

Fields #

Name	Description
`HasCorporateConnectivity` Boolean	—
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4047 — Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: I...

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Default gateway is set on GatewayIP (GatewayMAC Family: KnownProxyless GatewayIP: KnownOppInternet GatewayMAC: InterfaceGuid KnownHotspot: IfLuid KnownOppInternet: Family KnownProxiedOppInternet: IpAddressLength).

Message #

Default gateway is set on %1 (%2 Family: %3 GatewayIP: %5 GatewayMAC: %7 KnownHotspot: %8 KnownOppInternet: %9 KnownProxiedOppInternet: %10)

Fields #

Name	Description
`GatewayIP`	—
`GatewayMAC`	2 Family.
`KnownProxyless` Boolean	—
`KnownHotspot` Boolean	GatewayIP.
`KnownOppInternet` Boolean	—
`KnownProxiedOppInternet` Boolean	GatewayMAC.
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—
`IpAddressLength` UInt32	—
`IpAddress` Binary	—
`MacAddressLength` UInt32	—
`MacAddress` Binary	—

Event ID 4048 — Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: InterfaceGuid HasNextHopToInternet: IfLuid NextHopAddress: NextHopAddressLength).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Next hop to Internet has changed on HasNextHopToInternet (NextHopAddress Family: InterfaceGuid HasNextHopToInternet: IfLuid NextHopAddress: NextHopAddressLength).

Message #

Next hop to Internet has changed on %1 (%2 Family: %3 HasNextHopToInternet: %4 NextHopAddress: %6)

Fields #

Name	Description
`HasNextHopToInternet` Boolean	—
`NextHopAddress` Binary	2 Family.
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—
`NextHopAddressLength` UInt32	—

Event ID 4049 — Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredAddress: IfLuid AddressSuffixOrigins: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Preferred address change on HasPreferredAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredAddress: IfLuid AddressSuffixOrigins: Family).

Message #

Preferred address change on %1 (%2 Family: %3 HasPreferredAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`HasPreferredAddress` Boolean	—
`AddressSuffixOrigins` UInt32	2 Family.
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4050 — Preferred global address change on HasPreferredGlobalAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredGlobalAddress: IfLuid AddressSuffixOrigins: Family).

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Preferred global address change on HasPreferredGlobalAddress (AddressSuffixOrigins Family: InterfaceGuid HasPreferredGlobalAddress: IfLuid AddressSuffixOrigins: Family).

Message #

Preferred global address change on %1 (%2 Family: %3 HasPreferredGlobalAddress: %4 AddressSuffixOrigins: %5)

Fields #

Name	Description
`HasPreferredGlobalAddress` Boolean	—
`AddressSuffixOrigins` UInt32	2 Family.
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—

Event ID 4051 — Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = ActiveProbeResultCode.

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Active probe result code on interface InterfaceGuid (IfLuid Family: Family) = ActiveProbeResultCode.

Message #

Active probe result code on interface %1 (%2 Family: %3) = %4

Fields #

Name	Description
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`Family` UInt32	—
`ActiveProbeResultCode` UInt32	—

Event ID 4052 — Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used...

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Description

Interface diagnostic for IPv6_address (IPv4_capability): IPv4 address: IPv6_capability, IPv6 address: IPv4_test_used, IPv4 capability: IPv6_test_used, IPv6 capability: InterfaceGuid, IPv4 test used: IfLuid, IPv6 test used: HasPreferredGlobalAddressIPv4.

Message #

Interface diagnostic for %1 (%2): IPv4 address: %3, IPv6 address: %4, IPv4 capability: %5, IPv6 capability: %6, IPv4 test used: %7, IPv6 test used: %8

Fields #

Name	Description
`IPv6_address`	—
`IPv4_capability`	—
`IPv6_capability`	—
`IPv4_test_used`	—
`IPv6_test_used`	—
`InterfaceGuid` GUID	—
`IfLuid` UInt64	—
`HasPreferredGlobalAddressIPv4` Boolean	—
`HasPreferredGlobalAddressIPv6` Boolean	—
`InternetCapabilityIPv4` UInt8	—
`InternetCapabilityIPv6` UInt8	—
`InternetTestIPv4` UInt8	—
`InternetTestIPv6` UInt8	—

Event ID 4053 —

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—

Event ID 4054 —

Provider: Microsoft-Windows-NCSI
Channel: Analytic

Fields #

Name	Description
`InterfaceGuid` GUID	—
`Family` UInt32	—