DFIRHub

Windows event log ยท System20001 Device installation

  • System
  • 7 fields
  • System.evtx
  • Microsoft-Windows-UserPnp

Fields EvtxECmd extracts

7 columns in the EvtxECmd CSV

  • PayloadData1DriverDescription: %DriverDescription%
    • %DriverDescription% = /Event/UserData/InstallDeviceID/DriverDescription
  • PayloadData2InstallStatus: %InstallStatus%
    • %InstallStatus% = /Event/UserData/InstallDeviceID/InstallStatus
  • PayloadData3IsDriverOEM: %IsDriverOEM%
    • %IsDriverOEM% = /Event/UserData/InstallDeviceID/IsDriverOEM
  • PayloadData4UpgradeDevice: %UpgradeDevice%
    • %UpgradeDevice% = /Event/UserData/InstallDeviceID/UpgradeDevice
  • PayloadData5RebootOption: %RebootOption%
    • %RebootOption% = /Event/UserData/InstallDeviceID/RebootOption
  • PayloadData6DeviceInstanceID: %DeviceInstanceID%
    • %DeviceInstanceID% = /Event/UserData/InstallDeviceID/DeviceInstanceID
  • ExecutableInfo%DriverName%
    • %DriverName% = /Event/UserData/InstallDeviceID/DriverName

Value lookups

Codes that EvtxECmd turns into text

InstallStatus

0x0
Installation Successful
0x00000002
File Not Found
0x80070002
File Not Found
0x80070003
Path Not Found
0x80070005
Access Denied
0x800F0233
Invalid Target
0x8028006E
Invalid Source Path
0x000005B3
Requires Interactive Workstation
0x000005B4
Timeout
0xE0000234
Driver Non-native
0xE0000246
Device Installer Not Ready

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-UserPnp" Guid="96f4a050-7e31-453c-88be-9634f4e02139"/>
    <EventID>20001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>7005</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000500000000</Keywords>
    <TimeCreated SystemTime="2020-10-19 18:15:14.4350230"/>
    <EventRecordID>80566</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3528" ThreadID="1020"/>
    <Channel>System</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <InstallDeviceID>
      <DriverName>intcdaud.inf_amd64_46799624fe0dfa08\intcdaud.inf</DriverName>
      <DriverVersion>6.16.0.3208</DriverVersion>
      <DriverProvider>Intel(R) Corporation</DriverProvider>
      <DeviceInstanceID>HDAUDIO\FUNC_01&amp;amp;VEN_8086&amp;amp;DEV_2807&amp;amp;SUBSYS_80860101&amp;amp;REV_1000\4&amp;amp;2BFF37FD&amp;amp;1&amp;amp;0001</DeviceInstanceID>
      <SetupClass>4d13e96c-e325-11ce-bfc1-08002be10318</SetupClass>
      <RebootOption>False</RebootOption>
      <UpgradeDevice>True</UpgradeDevice>
      <IsDriverOEM>True</IsDriverOEM>
      <InstallStatus>0x0</InstallStatus>
      <DriverDescription>Intel(R) Display Audio</DriverDescription>
    </InstallDeviceID>
  </UserData>
</Event>

References

1 link

Source: evtx/Maps/System_Microsoft-Windows-UserPnp_20001.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)