Description

WCMSVC: Service Startup.

Message #

WCMSVC: Service Startup

Description

WCMSVC: Service Shutdown.

Message #

WCMSVC: Service Shutdown

Description

CDE reported a state change.

Message #

CDE reported a state change 

 State: %1 

 Name: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2023-11-06T06:25:42.259570+00:00",
    "event_record_id": 100,
    "correlation": {},
    "execution": {
      "process_id": 2540,
      "thread_id": 3204
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Status": 1,
    "Name": 2
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

A Group Policy change was processed.

Message #

A Group Policy change was processed

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:44:38.754171+00:00",
    "event_record_id": 124,
    "correlation": {},
    "execution": {
      "process_id": 2484,
      "thread_id": 6636
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

A Power change was processed.

Message #

A Power change was processed. 

 Reason: %1

Fields #

Description

A Terminal Services session change was processed.

Message #

A Terminal Services session change was processed. 

 Reason: %1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1006,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2023-11-05T22:32:23.678433+00:00",
    "event_record_id": 123,
    "correlation": {},
    "execution": {
      "process_id": 2484,
      "thread_id": 2872
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "Reason": 5
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

CDE reported a state change.

Message #

CDE reported a state change 

 State: %1 

 Name: Nlasvc.

Fields #

Description

NLA interface property change.

Message #

NLA interface property change 

Interface: %1
Internet v4: %2
Internet v6: %3
Probe Complete v4: %4
Probe Complete v6: %5
Domain Authenticated: %6
Domain Probe Complete: %7

Fields #

Description

CDE reported an L2 adapter arrival.

Message #

CDE reported an L2 adapter arrival 

 Interface: %1 

 Type: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1009,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2023-11-06T06:25:42.356663+00:00",
    "event_record_id": 103,
    "correlation": {},
    "execution": {
      "process_id": 2540,
      "thread_id": 3204
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "3D03B11E-98A0-4304-84E2-CD3AAE8EFE1D",
    "MediaType": 1
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

CDE reported an L2 adapter removal.

Message #

CDE reported an L2 adapter removal 

 Interface: %1 

 Type: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1010,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2026-03-13T20:18:51.255303+00:00",
    "event_record_id": 170,
    "correlation": {},
    "execution": {
      "process_id": 2572,
      "thread_id": 2756
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "MediaType": 1
  },
  "message": ""
}

Description

CDE reported a successful connection.

Message #

CDE reported a successful connection 

 Interface: %1 

 Type: %2

Fields #

Description

CDE reported a connection failure.

Message #

CDE reported a connection failure 

 Interface: %1 

 Type: %2

 Status: %3

Fields #

Description

CDE reported a disconnection.

Message #

CDE reported a disconnection 

 Interface: %1 

 Type: %2

Fields #

Description

WcmSetParameter Called.

Message #

WcmSetParameter Called

Interface: %1
Profile Name: %2
Wcm Opcode: %3
Data Length: %4
Caller Process ID: %5
Return Value: %6

Fields #

Description

Interface Token Applied.

Message #

Interface Token Applied

Interface: %1
Media Type: %2
Manual enabled: %3
Manual Filter: %4
Num Manual: %5
Manual Profiles: %6
Auto enabled: %7
Auto filter: %8
Num Auto: %9
Auto Profiles: %10

Fields #

Description

Interface Token Failed.

Message #

Interface Token Failed

Interface: %1
Media Type: %2
Manual enabled: %3
Manual Filter: %4
Num Manual: %5
Manual Profiles: %6
Auto enabled: %7
Auto filter: %8
Num Auto: %9
AutoProfiles: %10
Status: %11

Fields #

Description

Soft disconnect over thresholds for interface: InterfaceGUID.

Message #

Soft disconnect over thresholds for interface: %1
AvgIn: %2 AvgOut: %3 SpikeIn: %4 SpikeOut: %5
Thresholds: AvgIn: %6 AvgOut: %7 SpikeIn: %8 SpikeOut:%9
All values are in bytes/second

Fields #

Description

Soft disconnect under thresholds for interface: InterfaceGUID.

Message #

Soft disconnect under thresholds for interface: %1
AvgIn: %2 AvgOut: %3 SpikeIn: %4 SpikeOut: %5
Thresholds: AvgIn: %6 AvgOut: %7 SpikeIn: %8 SpikeOut:%9
All values are in bytes/second

Fields #

Description

CDE reported an unblocked profile.

Message #

CDE reported an unblocked profile 

 Interface: %1 

 Type: %2

 Profile: %3

Fields #

Description

WCM Preferred Order List.

Message #

WCM Preferred Order List:
%1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1020,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2023-10-26T04:17:43.215170+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 2288,
      "thread_id": 2612
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "WCM Preferred Order List": "0: {3D03B11E-98A0-4304-84E2-CD3AAE8EFE1D}, Ethernet, 1\n1: {8E4162AD-6500-4899-BA95-24051405E207}, Ethernet, 1\n"
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

WCM entered connected standby.

Message #

WCM entered connected standby

Description

WCM exited connected standby.

Message #

WCM exited connected standby

Description

Acquired NDIS NIC Active Reference for interface: InterfaceGUID.

Message #

Acquired NDIS NIC Active Reference for interface: %1

Fields #

Description

Released NDIS NIC Active Reference for interface: InterfaceGUID.

Message #

Released NDIS NIC Active Reference for interface: %1

Fields #

Description

CDE reported an NDIS adapter arrival.

Message #

CDE reported an NDIS adapter arrival 

 Interface: %1 

 Type: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2022-04-07T16:53:13.091504+00:00",
    "event_record_id": 39,
    "correlation": {},
    "execution": {
      "process_id": 1488,
      "thread_id": 1596
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "00C20B5F-2254-4D8F-9391-4EED3B6F783D",
    "MediaType": 1
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

CDE reported an NDIS adapter removal.

Message #

CDE reported an NDIS adapter removal 

 Interface: %1 

 Type: %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 1027,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775840,
    "time_created": "2026-03-13T20:18:51.255300+00:00",
    "event_record_id": 169,
    "correlation": {},
    "execution": {
      "process_id": 2572,
      "thread_id": 2756
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "InterfaceGuid": "2A7BD48E-DDC6-4641-9F41-682F29F1D76C",
    "MediaType": 1
  },
  "message": ""
}

Description

WCM entered net quiet mode.

Message #

WCM entered net quiet mode

Description

WCM exited net quiet mode.

Message #

WCM exited net quiet mode

Description

Billing Cycle Reset Successful.

Message #

Billing Cycle Reset Successful

Fields #

Description

Server Time Retrieval Failure.

Message #

Server Time Retrieval Failure

Fields #

Description

Acquire NDIS NIC Active Reference Failed for interface: InterfaceGUID.

Message #

Acquire NDIS NIC Active Reference Failed for interface: %1

Fields #

Description

Release NDIS NIC Active Reference Failed for interface: InterfaceGUID.

Message #

Release NDIS NIC Active Reference Failed for interface: %1

Fields #

Description

OnDemandInterfaceStateChanged. OnDemandType:OnDemandType, Interface: InterfaceGUID, OnDemandInfo:OnDemandInfo, ProviderID:ProviderID, NewState:NewState, Ref counter:Refcount.

Message #

OnDemandInterfaceStateChanged. OnDemandType:%1, Interface: %2, OnDemandInfo:%3, ProviderID:%4, NewState:%5, Ref counter:%6

Fields #

Description

OnDemand PDP Profile Created. OnDemandInfo:APNname, ProviderID:ProviderID, SubscriberID:SubscriberID, Profile Name:Profilename.

Message #

OnDemand PDP Profile Created. OnDemandInfo:%1, ProviderID:%2, SubscriberID:%3, Profile Name:%4

Fields #

Description

OnDemand PDP Profile Deleted. Profile Name:Profilename.

Message #

OnDemand PDP Profile Deleted. Profile Name:%1

Fields #

Description

OnDemand Request opened. App ID:AppID, ProcessID:ProcessID,OnDemandType:OnDemandType, OnDemandInfo:OnDemandInfo, ProviderID:ProviderID, Error: Error.

Message #

OnDemand Request opened. App ID:%1, ProcessID:%2,OnDemandType:%3, OnDemandInfo:%4, ProviderID:%5, Error: %6

Fields #

Description

OnDemand Request closed. App ID:AppID, ProcessID:ProcessID,OnDemandType:OnDemandType, OnDemandInfo:OnDemandInfo, ProviderID:ProviderID, Error: Error.

Message #

OnDemand Request closed. App ID:%1, ProcessID:%2,OnDemandType:%3, OnDemandInfo:%4, ProviderID:%5, Error: %6

Fields #

Description

OnDemand Request started. App ID:AppID, ProcessID:ProcessID,OnDemandType:OnDemandType, OnDemandInfo:OnDemandInfo, ProviderID:ProviderID, Error: Error.

Message #

OnDemand Request started. App ID:%1, ProcessID:%2,OnDemandType:%3, OnDemandInfo:%4, ProviderID:%5, Error: %6

Fields #

Description

OnDemand Request cancelled. App ID:AppID, ProcessID:ProcessID,OnDemandType:OnDemandType, OnDemandInfo:OnDemandInfo, ProviderID:ProviderID, Error: Error.

Message #

OnDemand Request cancelled. App ID:%1, ProcessID:%2,OnDemandType:%3, OnDemandInfo:%4, ProviderID:%5, Error: %6

Fields #

Description

WcmSvc acquired the NIC reference for Interface: InterfaceGUID for reason: ActionType.

Message #

WcmSvc acquired the NIC reference for Interface: %1 for reason: %2

Fields #

Description

WcmSvc released the NIC reference for Interface: InterfaceGUID for reason: ActionType.

Message #

WcmSvc released the NIC reference for Interface: %1 for reason: %2

Fields #

Description

WcmSvc signalled disconnected standby.

Message #

WcmSvc signalled disconnected standby

Description

WcmSvc signalled end of disconnected standby.

Message #

WcmSvc signalled end of disconnected standby

Description

WcmSvc received power policy update for networking in standby - the new policy value is PolicyValue.

Message #

WcmSvc received power policy update for networking in standby - the new policy value is %1

Fields #

Description

End of Wwan Resume Reconnect.

Message #

End of Wwan Resume Reconnect

Fields #

Description

End of Wlan Resume Reconnect to Same Network.

Message #

End of Wlan Resume Reconnect to Same Network

Fields #

Description

End of Wlan Resume Reconnect to Same Network OneX.

Message #

End of Wlan Resume Reconnect to Same Network OneX

Fields #

Description

End of Wlan Resume Reconnect to Different Network.

Message #

End of Wlan Resume Reconnect to Different Network

Fields #

Description

End of Wlan Resume Reconnect to Different Network OneX.

Message #

End of Wlan Resume Reconnect to Different Network OneX

Fields #

Description

Cancel of Wlan Resume Reconnect2.

Message #

Cancel of Wlan Resume Reconnect2

Fields #

Fields #

Description

WcmSvc CmPdcActivationClientRegister - Status [Status].

Message #

WcmSvc CmPdcActivationClientRegister - Status [%1]

Fields #

Description

WcmSvc CmPdcActivationClientUnregister - Status [Status].

Message #

WcmSvc CmPdcActivationClientUnregister - Status [%1]

Fields #

Description

WcmSvc CmPdcActivationClientActivityRequest - Activate [Activity], Status [Status].

Message #

WcmSvc CmPdcActivationClientActivityRequest - Activate [%1], Status [%2]

Fields #

Description

WcmSvc SetNetworkReference - Activate [Activate], Result [Result], TotalNetworkRefCount [TotalNetworkRefCount], ProcessId [ProcessId], PerProcessNetworkRefCount [ProcessNetworkRefCount], App [AppName].

Message #

WcmSvc SetNetworkReference - Activate [%1], Result [%2], TotalNetworkRefCount [%3], ProcessId [%4], PerProcessNetworkRefCount [%5], App [%6]

Fields #

Description

WcmSvc ReleaseNetworkReferenceInProcess - ProcessId [ProcessId], PerProcessNetworkRefCount [ProcessNetworkRefCount], TotalNetworkRefCount [TotalNetworkRefCount].

Message #

WcmSvc ReleaseNetworkReferenceInProcess - ProcessId [%1], PerProcessNetworkRefCount [%2], TotalNetworkRefCount [%3]

Fields #

Description

WcmSvc AcquireNdisReference - Result [Result], TotalCmNdisRefCount [TotalCmNdisRefCount], ProcessId [ProcessId], PerProcessCmNdisRefCount [PerProcessCmNdisRefCount], App [AppName].

Message #

WcmSvc AcquireNdisReference - Result [%1], TotalCmNdisRefCount [%2], ProcessId [%3], PerProcessCmNdisRefCount [%4], App [%5]

Fields #

Description

WcmSvc ReleaseNdisReference - Result [Result], TotalCmNdisRefCount [TotalCmNdisRefCount], ProcessId [ProcessId], PerProcessCmNdisRefCount [PerProcessCmNdisRefCount], App [AppName].

Message #

WcmSvc ReleaseNdisReference - Result [%1], TotalCmNdisRefCount [%2], ProcessId [%3], PerProcessCmNdisRefCount [%4], App [%5]

Fields #

Description

WcmSvc ReleaseNdisReferenceInProcess - ProcessId [ProcessId], PerProcessCmNdisRefCount [ProcessNetworkRefCount], TotalCmNdisRefCount [TotalNetworkRefCount].

Message #

WcmSvc ReleaseNdisReferenceInProcess - ProcessId [%1], PerProcessCmNdisRefCount [%2], TotalCmNdisRefCount [%3]

Fields #

Description

WcmSvc NdisReferenceError - [FunctionName]: Result [Error].

Message #

WcmSvc NdisReferenceError - [%1]: Result [%2]

Fields #

Description

CmService::NdisReference - [AcquireRelease] InterfaceLuid [InterfaceLuid], Result [Result].

Message #

CmService::NdisReference - [%1] InterfaceLuid [%2], Result [%3]

Fields #

Description

WCMSVC: Start WCM Service Startup.

Message #

WCMSVC: Start WCM Service Startup

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 10001,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:41.759091+00:00",
    "event_record_id": 98,
    "correlation": {},
    "execution": {
      "process_id": 2540,
      "thread_id": 2940
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

WCMSVC: Complete WCM Service Startup.

Message #

WCMSVC: Complete WCM Service Startup

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 10002,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T06:25:42.274933+00:00",
    "event_record_id": 102,
    "correlation": {},
    "execution": {
      "process_id": 2540,
      "thread_id": 2940
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

WCMSVC: Start Service Shutdown.

Message #

WCMSVC: Start Service Shutdown

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 10003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:31:36.633156+00:00",
    "event_record_id": 115,
    "correlation": {},
    "execution": {
      "process_id": 2584,
      "thread_id": 5648
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

WCMSVC: Complete Service Shutdown.

Message #

WCMSVC: Complete Service Shutdown

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Wcmsvc",
    "guid": "67D07935-283A-4791-8F8D-FA9117F3E6F2",
    "event_source_name": "",
    "event_id": 10004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:31:37.882676+00:00",
    "event_record_id": 116,
    "correlation": {},
    "execution": {
      "process_id": 2584,
      "thread_id": 5648
    },
    "channel": "Microsoft-Windows-Wcmsvc/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Tethering Manager Loaded Successfully.

Message #

Tethering Manager Loaded Successfully

Description

Tethering Manager Unloaded Successfully.

Message #

Tethering Manager Unloaded Successfully