Microsoft-Windows-WPDClassInstaller
90 events across 4 channels
Event ID 100: WPD device installation function (InstallFunctionCode, InstallFunctionName) begin.
#Event ID 101: WPD device installation function (InstallFunctionCode, InstallFunctionName) end with this return code (ReturnCode).
#Event ID 102: WPD device metadata retrieval for device DevicePath begin.
#Event ID 103: WPD device metadata retrieval for device DevicePath end with this return code (ReturnCode).
#Event ID 104: WPD device metadata retrieval for device DevicePath begin.
#Event ID 105: WPD device metadata retrieval for device DevicePath end with this return code (ReturnCode).
#Event ID 200: Device marked for reinstallation on subsequent connect.
#Description
Device marked for reinstallation on subsequent connect.
Message #
Event ID 201: DevicePath: Transfer of metadata (MetadataLocaleName, MetadataContentId) succeeded.
#Event ID 202: DevicePath: Transfer of metadata (MetadataLocaleName, MetadataContentId) skipped.
#Event ID 203: DevicePath: Transfer of metadata (MetadataLocaleName, MetadataContentId) failed.
#Event ID 204: DevicePath: Transfer of metadata failed as the Device Metadata Service could not be accessed.
#Event ID 205: DevicePath: Successfully opened the Device Metadata Service to retrieve metadata: ServicePath.
#Event ID 206: Transfer of metadata (MetadataLocaleName, MetadataContentId) is skipped because the metadata already exists on the system.
#Event ID 207: Policy PolicyName enforced for user account UserAccountName, device instance InstanceId.
#Description
Policy PolicyName enforced for user account UserAccountName, device instance InstanceId.
Message #
Fields #
| Name | Description |
|---|---|
PolicyName UnicodeString | |
UserAccountName UnicodeString | |
DeviceName UnicodeString | |
ClassName UnicodeString | |
ClassGuid UnicodeString | |
HardwareIds UnicodeString | |
InstanceId UnicodeString | |
BusTypeGuid UnicodeString | |
EventSource UnicodeString |
Event ID 24576: Drivers were successfully installed for device
#Event ID 24576: Drivers were successfully installed for device
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WPDClassInstaller",
"guid": "{AD5162D8-DAF0-4A25-88A7-01CBEB33902E}",
"event_source_name": "WPDClassInstaller",
"event_id": 24576,
"version": 0,
"level": 4,
"task": 16,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2022-04-07T16:53:01.520198+00:00",
"event_record_id": 372,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "WIN-FPV0DSIC9O6",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "WPD Device",
"Binary": ""
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 24577: Media player and imaging program compatibility layers were successfully registered for device
#Event ID 24577: Media player and imaging program compatibility layers were successfully registered for device
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WPDClassInstaller",
"guid": "{AD5162D8-DAF0-4A25-88A7-01CBEB33902E}",
"event_source_name": "WPDClassInstaller",
"event_id": 24577,
"version": 0,
"level": 4,
"task": 32,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2022-04-07T16:53:01.598397+00:00",
"event_record_id": 373,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "WIN-FPV0DSIC9O6",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "",
"Binary": ""
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 24578: Autoplay was successfully registered for device
#Event ID 24578: Autoplay was successfully registered for device
#Event ID 24579: Autoplay registration was skipped for device
#Event ID 24579: Autoplay registration was skipped for device
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WPDClassInstaller",
"guid": "{AD5162D8-DAF0-4A25-88A7-01CBEB33902E}",
"event_source_name": "WPDClassInstaller",
"event_id": 24579,
"version": 0,
"level": 4,
"task": 32,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2022-04-07T16:53:01.598397+00:00",
"event_record_id": 374,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "WIN-FPV0DSIC9O6",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "",
"Binary": ""
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 24580: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP)
#Event ID 24580: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP)
#Event ID 24581: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device
#Event ID 24581: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device
#Event ID 24582: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that were connected and active
#Event ID 24582: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that were connected and active
#Event ID 24583: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device
#Event ID 24583: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device
#Event ID 24584: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that were connected and active
#Event ID 24584: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that were connected and active
#Event ID 24585: %1: Drivers were successfully migrated after Plug and Play was enumerated again
#Event ID 24585: %1: Drivers were successfully migrated after Plug and Play was enumerated again
#Event ID 24832: %1: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed
#Event ID 24832: %1: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed
#Event ID 25088: It was not possible to install drivers for the device
#Event ID 25088: It was not possible to install drivers for the device
#Event ID 25089: It was not possible to access the device (%1) after installing drivers
#Event ID 25089: It was not possible to access the device (%1) after installing drivers
#Event ID 25090: It was not possible to register media player and imaging program layers for the device
#Event ID 25090: It was not possible to register media player and imaging program layers for the device
#Event ID 25091: It was not possible to register autoplay for device
#Event ID 25091: It was not possible to register autoplay for device
#Event ID 25092: %1 failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP)
#Event ID 25092: %1 failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP)
#Event ID 25093: %1 failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices
#Event ID 25093: %1 failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices
#Event ID 25094: %1 failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices
#Event ID 25094: %1 failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices
#Event ID 25095: %1: It was not possible to enumerate Plug and Play again after drivers were migrated
#Event ID 25095: %1: It was not possible to enumerate Plug and Play again after drivers were migrated
#Event ID 1073831936: Drivers were successfully installed for device %1.
#Description
Drivers were successfully installed for device .
Message #
Event ID 1073831936: Drivers were successfully installed for device .
#Description
Drivers were successfully installed for device .
Message #
Event ID 1073831937: Media player and imaging program compatibility layers were successfully registered for device %1.
#Description
Media player and imaging program compatibility layers were successfully registered for device . Layer bits were requested, layer bits were registered.
Message #
Event ID 1073831937: Media player and imaging program compatibility layers were successfully registered for device .
#Description
Media player and imaging program compatibility layers were successfully registered for device . Layer bits were requested, layer bits were registered.
Message #
Event ID 1073831938: Autoplay was successfully registered for device %1.
#Description
Autoplay was successfully registered for device .
Message #
Event ID 1073831938: Autoplay was successfully registered for device .
#Description
Autoplay was successfully registered for device .
Message #
Event ID 1073831939: Autoplay registration was skipped for device %1.
#Description
Autoplay registration was skipped for device .
Message #
Event ID 1073831939: Autoplay registration was skipped for device .
#Description
Autoplay registration was skipped for device .
Message #
Event ID 1073831940: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP).
#Description
: Drivers for device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP).
Message #
Event ID 1073831940: ...: Drivers for ... device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP).
#Description
: Drivers for device(s) were successfully uninstalled while migrating a dual-mode mass storage class device to Media Transfer Protocol (MTP).
Message #
Event ID 1073831941: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device.
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device.
Message #
Event ID 1073831941: ...: Drivers for ... device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device.
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device.
Message #
Event ID 1073831942: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that were ...
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that were connected and active.
Message #
Event ID 1073831942: ...: Drivers for ... device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that wer...
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Media Transfer Protocol (MTP) device, including any devices that were connected and active.
Message #
Event ID 1073831943: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device.
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device.
Message #
Event ID 1073831943: ...: Drivers for ... device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device.
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device.
Message #
Event ID 1073831944: %1: Drivers for %2 device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that wer...
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that were connected and active.
Message #
Event ID 1073831944: ...: Drivers for ... device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that w...
#Description
: Drivers for device(s) were successfully uninstalled while migrating a Picture Transfer Protocol (PTP) device, including any devices that were connected and active.
Message #
Event ID 1073831945: %1: Drivers were successfully migrated after Plug and Play was enumerated again.
#Description
: Drivers were successfully migrated after Plug and Play was enumerated again.
Message #
Event ID 1073831945: ...: Drivers were successfully migrated after Plug and Play was enumerated again.
#Description
: Drivers were successfully migrated after Plug and Play was enumerated again.
Message #
Event ID 2147574016: %1: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed.
#Description
: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed.
Message #
Event ID 2147574016: ...: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed.
#Description
: This version of Windows does not support Windows Portable Device drivers, so the drivers were not installed.
Event ID 3221316096: It was not possible to install drivers for the device %1.
#Description
It was not possible to install drivers for the device . Error code .
Message #
Event ID 3221316096: It was not possible to install drivers for the device .
#Description
It was not possible to install drivers for the device . Error code .
Event ID 3221316097: It was not possible to access the device after installing drivers.
#Description
It was not possible to access the device () after installing drivers. Error code .
Message #
Event ID 3221316097: It was not possible to access the device (.
#Description
It was not possible to access the device () after installing drivers. Error code .
Event ID 3221316098: It was not possible to register media player and imaging program layers for the device %1.
#Description
It was not possible to register media player and imaging program layers for the device . Error code .
Message #
Event ID 3221316098: It was not possible to register media player and imaging program layers for the device .
#Description
It was not possible to register media player and imaging program layers for the device . Error code .
Event ID 3221316099: It was not possible to register autoplay for device %1.
#Description
It was not possible to register autoplay for device . Error code .
Message #
Event ID 3221316099: It was not possible to register autoplay for device .
#Description
It was not possible to register autoplay for device . Error code .
Event ID 3221316100: %1 failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP).
#Description
failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP). Error code .
Message #
Event ID 3221316100: ... failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP). Error code ....
#Description
failed to uninstall drivers when migrating dual-mode devices from mass storage class to Media Transfer Protocol (MTP). Error code .
Event ID 3221316101: %1 failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices.
#Description
failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices. Error .
Message #
Event ID 3221316101: ... failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices. Error ....
#Description
failed to uninstall drivers for single-protocol Media Transfer Protocol (MTP) devices. Error .
Event ID 3221316102: %1 failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices.
#Description
failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices. Error .
Message #
Event ID 3221316102: ... failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices. Error ....
#Description
failed to uninstall drivers for single-protocol Picture Transfer Protocol (PTP) devices. Error .
Event ID 3221316103: %1: It was not possible to enumerate Plug and Play again after drivers were migrated.
#Description
: It was not possible to enumerate Plug and Play again after drivers were migrated. Error code .
Message #
Event ID 3221316103: ...: It was not possible to enumerate Plug and Play again after drivers were migrated. Error code ....
#Description
: It was not possible to enumerate Plug and Play again after drivers were migrated. Error code .
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID ad5162d8-daf0-4a25-88a7-01cbeb33902e
Defined in wpd_ci.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.2849 · captured 2026-06-02
- Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02
Downloads
- Microsoft-Windows-WPDClassInstaller registered manifest XML (WS2022-20348.4893) manifest-xml
- Microsoft-Windows-WPDClassInstaller registered manifest XML (Win11-26200.6584) manifest-xml