DFIRHub

Windows event log ยท Microsoft-Windows-Kernel-PnP/Configuration410 Device driver error

  • Windows operational
  • 5 fields
  • Microsoft-Windows-Kernel-PnP%4Configuration.evtx
  • Microsoft-Windows-Kernel-PnP

Fields EvtxECmd extracts

5 columns in the EvtxECmd CSV

  • PayloadData1ServiceName: %ServiceName%
    • %ServiceName% = /Event/EventData/Data[@Name="ServiceName"]
  • PayloadData2Problem: %Problem%
    • %Problem% = /Event/EventData/Data[@Name="Problem"]
  • PayloadData3Status: %Status%
    • %Status% = /Event/EventData/Data[@Name="Status"]
  • PayloadData6DeviceInstanceID: %DeviceInstanceID%
    • %DeviceInstanceID% = /Event/EventData/Data[@Name="DeviceInstanceID"]
  • ExecutableInfo%DriverName%
    • %DriverName% = /Event/EventData/Data[@Name="DriverName"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c205a39-1250-487d-abd7-e831c6290539"/>
    <EventID>410</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000090000000</Keywords>
    <TimeCreated SystemTime="2019-08-30 17:58:17.3774575"/>
    <EventRecordID>3067</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="9600"/>
    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="DeviceInstanceId">SWD\ScDeviceEnum\6_Windows_Hello_for_Business_1</Data>
    <Data Name="DriverName">c_swdevice.inf</Data>
    <Data Name="ClassGuid">62f9c741-b25a-46ce-b54c-9bccce08b6f2</Data>
    <Data Name="ServiceName"></Data>
    <Data Name="LowerFilters"></Data>
    <Data Name="UpperFilters"></Data>
    <Data Name="Problem">0x0</Data>
    <Data Name="Status">0x0</Data>
  </EventData>
</Event>

References

3 links

Source: evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_410.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)