Microsoft-Windows-NlaSvc

52 events across 2 channels

Event ID	Title	Channel
4001	Entered State: %2 Interface Guid: %1.	Diagnostic
4002	Transitioning to State: %2 Interface Guid: %1.	Diagnostic
4101	Received WMI Media Connect Notification for '.	Diagnostic
4102	Received WMI Media Disconnect Notification for '.	Diagnostic
4103	Route change has occurred for interface %1 (%2).	Diagnostic
4104	Address change has occurred for interface %1 (%2).	Diagnostic
4105	Quarantine state has changed	Diagnostic
4106	Received DHCP notification	Diagnostic
4201	Start link resolver	Diagnostic
4202	Stop link resolver	Diagnostic
4203	Start gateway resolution on interface %1 for %2.	Diagnostic
4204	Stop gateway resolution on interface %1 for %2.	Diagnostic
4205	Gateway resolution failed on interface %1 for %2 with error: %3.	Operational
4251	Plug-in data indicated from %1 for entity %2 (%3 rows) %5.	Diagnostic
4261	DHCP has stabilized for %1 (%2).	Diagnostic
4301	Start Intranet resolver	Diagnostic
4302	Stop Intranet resolver	Diagnostic
4311	Start DsGetDcName(%1,%2) for DnsSuffix.	Diagnostic
4312	Stop DsGetDcName(%1,%2) for DnsSuffix returned error %3 (domain=%4, forest=%5).	Diagnostic
4313	DsGetDcName(%1,%2) for DnsSuffix failed with error %3.	Diagnostic
4321	Start DsGetDcName for DS info	Diagnostic
4322	Stop DsGetDcName(%2) for DS info returned error %3 (domain=%4, forest=%5).	Diagnostic
4323	DsGetDcName(%2) for DS info failed with error %3.	Diagnostic
4331	Start DsGetDcName for root domain GUID	Diagnostic
4332	Stop DsGetDcName(%2) for root domain GUID returned error %3 (domain=%4, …	Diagnostic
4333	DsGetDcName(%2) for root domain GUID failed with error %3.	Operational
4341	Start LDAP authentication on interface %1 (%2) (%3 tries).	Diagnostic
4342	Stop LDAP authentication on interface %1 (%2).	Diagnostic
4343	LDAP authentication on interface %1 (%2) failed with error %4.	Operational
4351	Start ldap_connect(%1) for DC=%2 (%3 of %4 tries).	Diagnostic
4352	Stop ldap_connect(%1) for DC=%2 (%3 of %4 tries).	Diagnostic
4353	ldap_connect(%1) for DC=%2 (%3 of %4 tries) failed with %5.	Diagnostic
4354	Start ldap_bind(%1) for DC=%2 (%3 of %4 tries).	Diagnostic
4355	Stop ldap_bind(%1) for DC=%2 (%3 of %4 tries).	Diagnostic
4356	ldap_bind(%1) for DC=%2 (%3 of %4 tries) failed with %5.	Diagnostic
4401	Inserting identifying signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4402	Inserting identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4403	Removing identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4404	Inserting identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4405	Inserting identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4407	Adding interface '.	Diagnostic
4408	Removing interface '.	Diagnostic
4409	Adding interface '.	Diagnostic
4410	Inserting identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4411	Inserting identified signature for interface %1 Source=%4 Signature=%3.	Diagnostic
4451	Network on %1 is unlikely to be authentication-capable; authentication will …	Diagnostic
5001		Diagnostic
5002	Inserting identified signature for interface %1 Source=%2 Characteristics=%3.	Diagnostic
6101	Perftrack cancel event for interface '.	Diagnostic
6102	Perftrack cancel event for interface '.	Diagnostic
6103	Perftrack cancel event for interface '.	Diagnostic
6104	Perftrack cancel event for interface '.	Diagnostic

Event ID 4001 — Entered State: %2 Interface Guid: %1.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Entered State: %2 Interface Guid: %1

Fields

Name	Description
`Interface_Guid`	—
`Entered_State`	—
`InterfaceGuid`	—
`CurrentOrNextState`	—

Event ID 4002 — Transitioning to State: %2 Interface Guid: %1.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Transitioning to State: %2 Interface Guid: %1

Fields

Name	Description
`InterfaceGuid`	—
`CurrentOrNextState`	—

Event ID 4101 — Received WMI Media Connect Notification for '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Received WMI Media Connect Notification for '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 4102 — Received WMI Media Disconnect Notification for '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Received WMI Media Disconnect Notification for '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 4103 — Route change has occurred for interface %1 (%2).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Route change has occurred for interface %1 (%2)

Fields

Name	Description
`InterfaceGuid`	—
`MibNotificationType`	—

Event ID 4104 — Address change has occurred for interface %1 (%2).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Address change has occurred for interface %1 (%2)

Fields

Name	Description
`InterfaceGuid`	—
`MibNotificationType`	—

Event ID 4105 — Quarantine state has changed

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Quarantine state has changed

Event ID 4106 — Received DHCP notification

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Received DHCP notification

Event ID 4201 — Start link resolver

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start link resolver

Event ID 4202 — Stop link resolver

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop link resolver

Event ID 4203 — Start gateway resolution on interface %1 for %2.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start gateway resolution on interface %1 for %2

Fields

Name	Description
`InterfaceGuid`	—
`GatewayIpAddress`	—

Event ID 4204 — Stop gateway resolution on interface %1 for %2.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop gateway resolution on interface %1 for %2. Error: %3 NlnsState: %4 MAC: %6

Fields

Name	Description
`NlnsState`	—
`MAC`	2. Error.
`InterfaceGuid`	—
`GatewayIpAddress`	—
`ErrorCode`	—
`MacAddrLen`	—
`MacAddr`	—

Event ID 4205 — Gateway resolution failed on interface %1 for %2 with error: %3.

Provider: Microsoft-Windows-NlaSvc
Channel: Operational

Message

Gateway resolution failed on interface %1 for %2 with error: %3

Fields

Name	Description
`InterfaceGuid`	—
`GatewayIpAddress`	—
`ErrorCode`	—

Event ID 4251 — Plug-in data indicated from %1 for entity %2 (%3 rows) %5.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Plug-in data indicated from %1 for entity %2 (%3 rows)
%5

Fields

Name	Description
`PluginName`	—
`EntityName`	—
`IndicatedRowCount`	—
`RowsWithInterfacesIndicatedCount`	—
`RowInterfaceGuid`	—

Event ID 4261 — DHCP has stabilized for %1 (%2).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

DHCP has stabilized for %1 (%2)

Fields

Name	Description
`InterfaceGuid`	—
`NlaState`	—

Event ID 4301 — Start Intranet resolver

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start Intranet resolver

Event ID 4302 — Stop Intranet resolver

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop Intranet resolver

References

Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dfsr-diagnostics-shows-sharing-violations-events

Event ID 4311 — Start DsGetDcName(%1,%2) for DnsSuffix.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start DsGetDcName(%1,%2) for DnsSuffix

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4312 — Stop DsGetDcName(%1,%2) for DnsSuffix returned error %3 (domain=%4, forest=%5).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop DsGetDcName(%1,%2) for DnsSuffix returned error %3 (domain=%4, forest=%5)

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4313 — DsGetDcName(%1,%2) for DnsSuffix failed with error %3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

DsGetDcName(%1,%2) for DnsSuffix failed with error %3

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4321 — Start DsGetDcName for DS info

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start DsGetDcName(%2) for DS info

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4322 — Stop DsGetDcName(%2) for DS info returned error %3 (domain=%4, forest=%5).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop DsGetDcName(%2) for DS info returned error %3 (domain=%4, forest=%5)

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4323 — DsGetDcName(%2) for DS info failed with error %3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

DsGetDcName(%2) for DS info failed with error %3

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4331 — Start DsGetDcName for root domain GUID

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start DsGetDcName(%2) for root domain GUID

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4332 — Stop DsGetDcName(%2) for root domain GUID returned error %3 (domain=%4, forest=%5).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop DsGetDcName(%2) for root domain GUID returned error %3 (domain=%4, forest=%5)

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4333 — DsGetDcName(%2) for root domain GUID failed with error %3.

Provider: Microsoft-Windows-NlaSvc
Channel: Operational

Message

DsGetDcName(%2) for root domain GUID failed with error %3

Fields

Name	Description
`DnsSuffix`	—
`Flags`	—
`ErrorCode`	—
`RetrievedDomain`	—
`RetrievedForest`	—

Event ID 4341 — Start LDAP authentication on interface %1 (%2) (%3 tries).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start LDAP authentication on interface %1 (%2) (%3 tries)

Fields

Name	Description
`Interface Name`	—
`Addresses`	—
`Try Count`	—
`ErrorCode`	—
`InterfaceName`	—
`TryCount`	—

Event ID 4342 — Stop LDAP authentication on interface %1 (%2).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop LDAP authentication on interface %1 (%2)

Fields

Name	Description
`Interface Name`	—
`Addresses`	—
`Try Count`	—
`ErrorCode`	—
`InterfaceName`	—
`TryCount`	—

Event ID 4343 — LDAP authentication on interface %1 (%2) failed with error %4.

Provider: Microsoft-Windows-NlaSvc
Channel: Operational

Message

LDAP authentication on interface %1 (%2) failed with error %4

Fields

Name	Description
`Interface Name`	—
`Addresses`	—
`Try Count`	—
`ErrorCode`	—
`InterfaceName`	—
`TryCount`	—

Event ID 4351 — Start ldap_connect(%1) for DC=%2 (%3 of %4 tries).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start ldap_connect(%1) for DC=%2 (%3 of %4 tries)

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4352 — Stop ldap_connect(%1) for DC=%2 (%3 of %4 tries).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop ldap_connect(%1) for DC=%2 (%3 of %4 tries)

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4353 — ldap_connect(%1) for DC=%2 (%3 of %4 tries) failed with %5.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

ldap_connect(%1) for DC=%2 (%3 of %4 tries) failed with %5

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4354 — Start ldap_bind(%1) for DC=%2 (%3 of %4 tries).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Start ldap_bind(%1) for DC=%2 (%3 of %4 tries)

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4355 — Stop ldap_bind(%1) for DC=%2 (%3 of %4 tries).

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Stop ldap_bind(%1) for DC=%2 (%3 of %4 tries)

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4356 — ldap_bind(%1) for DC=%2 (%3 of %4 tries) failed with %5.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

ldap_bind(%1) for DC=%2 (%3 of %4 tries) failed with %5

Fields

Name	Description
`Addresses`	—
`DcName`	—
`Try Number`	—
`Try Count`	—
`ErrorCode`	—
`TryNumber`	—
`TryCount`	—

Event ID 4401 — Inserting identifying signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identifying signature for interface %1 
Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4402 — Inserting identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 
Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4403 — Removing identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Removing identified signature for interface %1 
Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4404 — Inserting identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 

Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4405 — Inserting identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 
Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4407 — Adding interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Adding interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 4408 — Removing interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Removing interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 4409 — Adding interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Adding interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 4410 — Inserting identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 
Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4411 — Inserting identified signature for interface %1 Source=%4 Signature=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 

Source=%4 Signature=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureLength`	—
`Signature`	—
`SignatureSource`	—

Event ID 4451 — Network on %1 is unlikely to be authentication-capable; authentication will continue in the background.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Network on %1 is unlikely to be authentication-capable; authentication will continue in the background. 
Reason: %2

Fields

Name	Description
`Reason`	—
`InterfaceGuid`	—
`AuthCapUnlikelyReason`	—
`SpeculativeTimeout`	—

Event ID 5001 —

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Fields

Name	Description
`InterfaceGuid`	—
`NlaState`	—

Event ID 5002 — Inserting identified signature for interface %1 Source=%2 Characteristics=%3.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Inserting identified signature for interface %1 

Source=%2 Characteristics=%3

Fields

Name	Description
`InterfaceGuid`	—
`SignatureSource`	—
`SignatureCharacteristics`	—

Event ID 6101 — Perftrack cancel event for interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Perftrack cancel event for interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 6102 — Perftrack cancel event for interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Perftrack cancel event for interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 6103 — Perftrack cancel event for interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Perftrack cancel event for interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—

Event ID 6104 — Perftrack cancel event for interface '.

Provider: Microsoft-Windows-NlaSvc
Channel: Diagnostic

Message

Perftrack cancel event for interface '%2' %1

Fields

Name	Description
`InterfaceGuid`	—
`AdapterName`	—