DFIRHub

Windows event log ยท Microsoft-Windows-Kernel-PnP/Configuration430 Device requires further installation

  • Windows operational
  • 1 field
  • Microsoft-Windows-Kernel-PnP%4Configuration.evtx
  • Microsoft-Windows-Kernel-PnP

Fields EvtxECmd extracts

1 column in the EvtxECmd CSV

  • PayloadData6DeviceInstanceId: %DeviceInstanceId%
    • %DeviceInstanceId% = /Event/EventData/Data[@Name="DeviceInstanceId"]

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="9c455a39-1250-487d-abd7-e831c6290539"/>
    <EventID>430</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000090000000</Keywords>
    <TimeCreated SystemTime="2019-10-17 03:18:15.2790188"/>
    <EventRecordID>3314</EventRecordID>
    <Correlation/>
    <Execution ProcessID="4" ThreadID="660"/>
    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <EventData>
    <Data Name="DeviceInstanceId">SWD\WPDBUSENUM\_??_USBSTOR#Disk&amp;amp;Ven_iDRAC&amp;amp;Prod_MAS001&amp;amp;Rev_0329#20120731&amp;amp;0#{53g76307-b6bf-11d0-94f2-00a0c13dfb8b}</Data>
  </EventData>
</Event>

References

2 links

Source: evtx/Maps/Microsoft-Windows-Kernel-PnP-Configuration_Microsoft-Windows-Kernel-PnP_430.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)