Microsoft-Windows Networking VPN Plugin Platform

32 events across 2 channels

Event IDTitleChannel
2001Vpn Connection Error = Error, Profile name = Profile, Plugin SID = Plugin.Operational
2002Vpn Plugin Background Task Execution StartedOperationalVerbose
2003Vpn Plugin Background Task Execution ExitOperationalVerbose
2004Message from VPN App: [Profile] Message.OperationalVerbose
2005Autotrigger [profileName], device is inside the trusted network boundary …Operational
2006Autotrigger [string], device is outside the trusted network boundary.Operational
2007Autotrigger: [string], device is attempting to connect to VPN.Operational
2008Autotrigger: [string], device failed to connect to VPN.Operational
2009Autotrigger: [string], device is connected to VPN.Operational
2010Autotrigger: [string], device got disconnected from VPN, Redial it.Operational
2011Autotrigger: [string], profile got activated.Operational
2012Autotrigger: [string], profile got deactivated.Operational
2013Autotrigger: [string], profile got auto disconnected.Operational
2014Autotrigger: [string], profile got disconnected as device going to sleep state.Operational
2015Autotrigger: [string], device is resumed, Redialling it.Operational
2016Autotrigger: [string], profile added.Operational
2017Autotrigger: [string], profile deleted.Operational
2018Autotrigger: [string], profile modified.Operational
2019Vpn State Machine Status : Invalid, Profile name = profile, Plugin SID = plugin.Operational
2020Vpn State Machine Status : Connecting, Profile name = profile, Plugin SID = …Operational
2021Vpn State Machine Status : Connected, Profile name = profile, Plugin SID = …Operational
2022Vpn State Machine Status : Disconnecting, Profile name = profile, Plugin SID = …Operational
2023Vpn State Machine Status : Disconnected, Profile name = profile, Plugin SID = …Operational
2024Vpn State Machine Status : Abort, Profile name = profile, Plugin SID = plugin.Operational
2025Vpn State Machine Status : Negotiating Network, Profile name = profile, Plugin …Operational
2026Vpn State Machine Status : Requesting Credentials, Profile name = profile, …Operational
2027Vpn State Machine Status : Requesting Credentials using Custom UI, Profile name …Operational
2028Keep Alive event invoked, Profile name = string.Operational
2029Autotrigger: DNS query string is made, matching VPN trigger rules.Operational
2030Autotrigger: [string] Unable to determine internet connectivity, vpn trigger …Operational
2031Autotrigger: auto trigger module initialization completed with Error = Error.Operational
2032Autotrigger: auto trigger Config registry content completed with Error = Error.Operational

Event ID 2001 — Vpn Connection Error = Error, Profile name = Profile, Plugin SID = Plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn Connection Error = Error, Profile name = Profile, Plugin SID = Plugin.

Message #

Vpn Connection Error = %3, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
Plugin SID
Profile UnicodeString
Error UInt32

Event ID 2002 — Vpn Plugin Background Task Execution Started

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
OperationalVerbose
Opcode
Info

Description

Vpn Plugin Background Task Execution Started.

Message #

Vpn Plugin Background Task Execution Started

Fields #

NameDescription
Plugin SID
InitialProfile UnicodeString
InitialEventType UInt32

Event ID 2003 — Vpn Plugin Background Task Execution Exit

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
OperationalVerbose
Opcode
Info

Description

Vpn Plugin Background Task Execution Exit.

Message #

Vpn Plugin Background Task Execution Exit

Fields #

NameDescription
Plugin SID
InitialProfile UnicodeString
InitialEventType UInt32
NumPacketsSent UInt32
NumPacketsReceived UInt32
LastError UInt32

Event ID 2004 — Message from VPN App: [Profile] Message.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
OperationalVerbose
Opcode
Info

Description

Message from VPN App: [Profile] Message.

Message #

Message from VPN App: [%1] %2

Fields #

NameDescription
Profile UnicodeString
Message UnicodeString

Event ID 2005 — Autotrigger [profileName], device is inside the trusted network boundary [NetworkName].

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger [profileName], device is inside the trusted network boundary [NetworkName].

Message #

Autotrigger [%1], device is inside the trusted network boundary [%2]

Fields #

NameDescription
profileName UnicodeString
NetworkName UnicodeString

Event ID 2006 — Autotrigger [string], device is outside the trusted network boundary.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger [string], device is outside the trusted network boundary.

Message #

Autotrigger [%1], device is outside the trusted network boundary

Fields #

NameDescription
string UnicodeString

Event ID 2007 — Autotrigger: [string], device is attempting to connect to VPN.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], device is attempting to connect to VPN. Please refer to Microsoft-Windows-VPN channel under WFP for cause of connect.

Message #

Autotrigger: [%1], device is attempting to connect to VPN. Please refer to Microsoft-Windows-VPN channel under WFP for cause of connect

Fields #

NameDescription
string UnicodeString

References #

Event ID 2008 — Autotrigger: [string], device failed to connect to VPN.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], device failed to connect to VPN.

Message #

Autotrigger: [%1], device failed to connect to VPN

Fields #

NameDescription
string UnicodeString

Event ID 2009 — Autotrigger: [string], device is connected to VPN.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], device is connected to VPN.

Message #

Autotrigger: [%1], device is connected to VPN

Fields #

NameDescription
string UnicodeString

Event ID 2010 — Autotrigger: [string], device got disconnected from VPN, Redial it.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], device got disconnected from VPN, Redial it.

Message #

Autotrigger: [%1], device got disconnected from VPN, Redial it

Fields #

NameDescription
string UnicodeString

Event ID 2011 — Autotrigger: [string], profile got activated.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile got activated.

Message #

Autotrigger: [%1], profile got activated

Fields #

NameDescription
string UnicodeString

References #

Event ID 2012 — Autotrigger: [string], profile got deactivated.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile got deactivated.

Message #

Autotrigger: [%1], profile got deactivated

Fields #

NameDescription
string UnicodeString

References #

Event ID 2013 — Autotrigger: [string], profile got auto disconnected.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile got auto disconnected. Please refer to Microsoft-Windows-VPN channel under WFP for cause of disconnect.

Message #

Autotrigger: [%1], profile got auto disconnected. Please refer to Microsoft-Windows-VPN channel under WFP for cause of disconnect

Fields #

NameDescription
string UnicodeString

References #

Event ID 2014 — Autotrigger: [string], profile got disconnected as device going to sleep state.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile got disconnected as device going to sleep state.

Message #

Autotrigger: [%1], profile got disconnected as device going to sleep state

Fields #

NameDescription
string UnicodeString

Event ID 2015 — Autotrigger: [string], device is resumed, Redialling it.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], device is resumed, Redialling it.

Message #

Autotrigger: [%1], device is resumed, Redialling it

Fields #

NameDescription
string UnicodeString

Event ID 2016 — Autotrigger: [string], profile added.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile added.

Message #

Autotrigger: [%1], profile added

Fields #

NameDescription
string UnicodeString

Event ID 2017 — Autotrigger: [string], profile deleted.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile deleted.

Message #

Autotrigger: [%1], profile deleted

Fields #

NameDescription
string UnicodeString

Event ID 2018 — Autotrigger: [string], profile modified.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string], profile modified.

Message #

Autotrigger: [%1], profile modified

Fields #

NameDescription
string UnicodeString

Event ID 2019 — Vpn State Machine Status : Invalid, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Invalid, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Invalid, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2020 — Vpn State Machine Status : Connecting, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Connecting, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Connecting, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2021 — Vpn State Machine Status : Connected, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Connected, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Connected, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2022 — Vpn State Machine Status : Disconnecting, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Disconnecting, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Disconnecting, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2023 — Vpn State Machine Status : Disconnected, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Disconnected, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Disconnected, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2024 — Vpn State Machine Status : Abort, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Abort, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Abort, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2025 — Vpn State Machine Status : Negotiating Network, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Negotiating Network, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Negotiating Network, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2026 — Vpn State Machine Status : Requesting Credentials, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Requesting Credentials, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Requesting Credentials, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2027 — Vpn State Machine Status : Requesting Credentials using Custom UI, Profile name = profile, Plugin SID = plugin.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Vpn State Machine Status : Requesting Credentials using Custom UI, Profile name = profile, Plugin SID = plugin.

Message #

Vpn State Machine Status : Requesting Credentials using Custom UI, Profile name = %2, Plugin SID = %1

Fields #

NameDescription
plugin SID
profile UnicodeString

Event ID 2028 — Keep Alive event invoked, Profile name = string.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Keep Alive event invoked, Profile name = string.

Message #

Keep Alive event invoked, Profile name = %1

Fields #

NameDescription
string UnicodeString

Event ID 2029 — Autotrigger: DNS query string is made, matching VPN trigger rules.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: DNS query string is made, matching VPN trigger rules.

Message #

Autotrigger: DNS query %1 is made, matching VPN trigger rules

Fields #

NameDescription
string UnicodeString

Event ID 2030 — Autotrigger: [string] Unable to determine internet connectivity, vpn trigger failed.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Opcode
Info

Description

Autotrigger: [string] Unable to determine internet connectivity, vpn trigger failed.

Message #

Autotrigger: [%1] Unable to determine internet connectivity, vpn trigger failed

Fields #

NameDescription
string UnicodeString

Event ID 2031 — Autotrigger: auto trigger module initialization completed with Error = Error.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Level
Informational
Opcode
Info

Description

Autotrigger: auto trigger module initialization completed with Error = Error.

Message #

Autotrigger: auto trigger module initialization completed with Error = %1

Fields #

NameDescription
Error UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows Networking VPN Plugin Platform",
    "guid": "E5FC4A0F-7198-492F-9B0F-88FDCBFDED48",
    "event_source_name": "",
    "event_id": 2031,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223374235878031360,
    "time_created": "2026-03-13T21:48:17.001311+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 5124,
      "thread_id": 5756
    },
    "channel": "Windows Networking Vpn Plugin Platform/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Error": 13
  },
  "message": ""
}

Event ID 2032 — Autotrigger: auto trigger Config registry content completed with Error = Error.

Provider
Microsoft-Windows Networking VPN Plugin Platform
Channel
Operational
Level
Informational
Opcode
Info

Description

Autotrigger: auto trigger Config registry content completed with Error = Error.

Message #

Autotrigger: auto trigger Config registry content completed with Error = %1

Fields #

NameDescription
Error UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows Networking VPN Plugin Platform",
    "guid": "E5FC4A0F-7198-492F-9B0F-88FDCBFDED48",
    "event_source_name": "",
    "event_id": 2032,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223374235878031360,
    "time_created": "2026-03-13T21:48:16.999208+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 5124,
      "thread_id": 5756
    },
    "channel": "Windows Networking Vpn Plugin Platform/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Error": 2
  },
  "message": ""
}