Microsoft-Windows-StorageManagement-WSP-Host

4 events across 1 channel

Event ID	Title	Channel
1000	A Windows Storage Provider failed to load.	Operational
1001	A Windows Storage Provider was loaded successfully.	Operational
1002	Shutdown has been initiated for the Windows Storage Provider host service.	Operational
1003	Shutdown for the Windows Storage Provider host service has been completed.	Operational

Event ID 1000 — A Windows Storage Provider failed to load.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational

Description

A Windows Storage Provider failed to load.

Message #

A Windows Storage Provider failed to load.             
Provider: %1             
Provider DLL: %2             
Error Code: %3             
Load Phase: %4             

This failure is indicative of a bad installation, or a missing or corrupt DLL.

Fields #

Name	Description
`ProviderName` UnicodeString	—
`ProviderDLL` UnicodeString	—
`ErrorCode` UInt32	—
`LoadPhase` UInt32	—

Event ID 1001 — A Windows Storage Provider was loaded successfully.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: Informational

Description

A Windows Storage Provider was loaded successfully.

Message #

A Windows Storage Provider was loaded successfully.             
Provider: %1             
Provider DLL: %2

Fields #

Name	Description
`ProviderName` UnicodeString	—
`ProviderDLL` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Host",
    "guid": "595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E",
    "event_source_name": "",
    "event_id": 1001,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:49:38.650790+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 6420,
      "thread_id": 6800
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ProviderName": "wsp_health",
    "ProviderDLL": "wsp_health.dll"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1002 — Shutdown has been initiated for the Windows Storage Provider host service.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: Informational

Description

Shutdown has been initiated for the Windows Storage Provider host service.

Message #

Shutdown has been initiated for the Windows Storage Provider host service.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Host",
    "guid": "595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E",
    "event_source_name": "",
    "event_id": 1002,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:36:56.572612+00:00",
    "event_record_id": 35,
    "correlation": {},
    "execution": {
      "process_id": 5108,
      "thread_id": 516
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1003 — Shutdown for the Windows Storage Provider host service has been completed.

Provider: Microsoft-Windows-StorageManagement-WSP-Host
Channel: Operational
Level: Informational

Description

Shutdown for the Windows Storage Provider host service has been completed.

Message #

Shutdown for the Windows Storage Provider host service has been completed.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-StorageManagement-WSP-Host",
    "guid": "595F33EA-D4AF-4F4D-B4DD-9DACDD17FC6E",
    "event_source_name": "",
    "event_id": 1003,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2022-04-07T17:36:56.602787+00:00",
    "event_record_id": 36,
    "correlation": {},
    "execution": {
      "process_id": 5108,
      "thread_id": 516
    },
    "channel": "Microsoft-Windows-StorageManagement/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline