detection.wiki

Microsoft-Windows-UserPnp › Event 20003

Event ID 20003 — Driver Management has concluded the process to add Service AddServiceID.ServiceName for Device Instance ID AddServiceID.DeviceInstanceID with the following status: AddServiceID.AddServiceStatus.

Provider
Microsoft-Windows-UserPnp
Channel
System
Level
Informational
Task
PnP_PlugPlay_DeviceInstall

Description

Driver Management has concluded the process to add Service AddServiceID.ServiceName for Device Instance ID AddServiceID.DeviceInstanceID with the following status: AddServiceID.AddServiceStatus.

Message #

Driver Management has concluded the process to add Service %1 for Device Instance ID %3 with the following status: %6.

Fields #

NameDescription
AddServiceID.ServiceName—
AddServiceID.DriverFileName—
AddServiceID.DeviceInstanceID—
AddServiceID.PrimaryService—
AddServiceID.UpdateService—
AddServiceID.AddServiceStatus—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-UserPnp",
    "guid": "96F4A050-7E31-453C-88BE-9634F4E02139",
    "event_source_name": "",
    "event_id": 20003,
    "version": 0,
    "level": 4,
    "task": 7005,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:30:40.551666+00:00",
    "event_record_id": 1844,
    "correlation": {},
    "execution": {
      "process_id": 7864,
      "thread_id": 8460
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "AddServiceID": {
      "ServiceName": "VM3DService",
      "DriverFileName": "%SystemRoot%\\system32\\vm3dservice.exe",
      "DeviceInstanceID": "PCI\\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\\3&61AAA01&0&78",
      "PrimaryService": false,
      "UpdateService": false,
      "AddServiceStatus": 0
    }
  },
  "message": ""
}

References #