DFIRHub

Windows event log ยท Microsoft-Windows-Kernel-PnP/Configuration400 Device driver error

  • Windows operational
  • 7 fields
  • Microsoft-Windows-Kernel-PnP%4Configuration.evtx
  • Microsoft-Windows-Kernel-PnP

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • PayloadData1MatchingDeviceId: %MatchingDeviceId%
    • %MatchingDeviceId% = /Event/EventData/Data[@Name="MatchingDeviceId"]
  • PayloadData2DriverSection: %DriverSection%
    • %DriverSection% = /Event/EventData/Data[@Name="DriverSection"]
  • PayloadData3DriverProvider: %DriverProvider%
    • %DriverProvider% = /Event/EventData/Data[@Name="DriverProvider"]
  • PayloadData4DeviceUpdated: %DeviceUpdated%
    • %DeviceUpdated% = /Event/EventData/Data[@Name="DeviceUpdated"]
  • PayloadData5ParentDeviceInstanceId: %ParentDeviceInstanceId%
    • %ParentDeviceInstanceId% = /Event/EventData/Data[@Name="ParentDeviceInstanceId"]
  • PayloadData6DeviceInstanceID: %DeviceInstanceID%
    • %DeviceInstanceID% = /Event/EventData/Data[@Name="DeviceInstanceID"]
  • ExecutableInfo%DriverName%
    • %DriverName% = /Event/EventData/Data[@Name="DriverName"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c679a39-1250-487d-abd7-e831c6290539"/>
    <EventID>400</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000500000000</Keywords>
    <TimeCreated SystemTime="2019-06-25 16:54:32.9955521"/>
    <EventRecordID>2811</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="4568"/>
    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="DeviceInstanceId">SWD\PRINTENUM\{3CDEEBDB-6F0B-4ECB-94CD-3151F17A3B59}</Data>
    <Data Name="DriverName">printqueue.inf</Data>
    <Data Name="ClassGuid">1ed2fff9-11f0-4084-b21f-ad83a8e6dcdc</Data>
    <Data Name="DriverDate">06/21/2006</Data>
    <Data Name="DriverVersion">10.0.14393.0</Data>
    <Data Name="DriverProvider">Microsoft</Data>
    <Data Name="DriverInbox">True</Data>
    <Data Name="DriverSection">NO_DRV_LOCAL</Data>
    <Data Name="DriverRank">0x1</Data>
    <Data Name="MatchingDeviceId">PRINTENUM\LocalPrintQueue</Data>
    <Data Name="OutrankedDrivers">oem0.inf:{013f01fa-e634-4d77-83ee-074817c03581}:00FF0002 c_swdevice.inf:SWD\GenericRaw:00FF3001</Data>
    <Data Name="DeviceUpdated">False</Data>
    <Data Name="Status">0x0</Data>
    <Data Name="ParentDeviceInstanceId">SWD\PRINTENUM\PrintQueues</Data>
  </EventData>
</Event>

References

4 links

Source: evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_400.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)