DFIRHub

Windows event log ยท System20003 Service installation

  • System
  • 6 fields
  • System.evtx
  • Microsoft-Windows-UserPnp

Fields EvtxECmd extracts

6 columns in the EvtxECmd CSV

  • PayloadData1ServiceName: %ServiceName%
    • %ServiceName% = /Event/UserData/AddServiceID/ServiceName
  • PayloadData2AddServiceStatus: %AddServiceStatus%
    • %AddServiceStatus% = /Event/UserData/AddServiceID/AddServiceStatus
  • PayloadData4UpdateService: %UpdateService%
    • %UpdateService% = /Event/UserData/AddServiceID/UpdateService
  • PayloadData5PrimaryService: %PrimaryService%
    • %PrimaryService% = /Event/UserData/AddServiceID/PrimaryService
  • PayloadData6DeviceInstanceID: %DeviceInstanceID%
    • %DeviceInstanceID% = /Event/UserData/AddServiceID/DeviceInstanceID
  • ExecutableInfo%DriverFileName%
    • %DriverFileName% = /Event/UserData/AddServiceID/DriverFileName

Value lookups

Codes that EvtxECmd turns into text

AddServiceStatus

0x0
Installation Successful
0x00000002
File Not Found
0x80070002
File Not Found
0x80070003
Path Not Found
0x80070005
Access Denied
0x800F0233
Invalid Target
0x8028006E
Invalid Source Path
0x000005B3
Requires Interactive Workstation
0x000005B4
Timeout
0xE0000234
Driver Non-native
0xE0000246
Device Installer Not Ready
0xE0000217
Driver Non-native
0xE0000219
Device Installer Not Ready

Sample event

Event XML from the map file

<Event>
  <System>
    <Provider Name="Microsoft-Windows-UserPnp" Guid="96f4a050-7e31-453c-88be-9634f4e02139"/>
    <EventID>20003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>7005</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000500000000</Keywords>
    <TimeCreated SystemTime="2020-10-19 18:15:14.4350230"/>
    <EventRecordID>80566</EventRecordID>
    <Correlation/>
    <Execution ProcessID="3528" ThreadID="1020"/>
    <Channel>System</Channel>
    <Computer>HOSTNAME.domain.com</Computer>
    <Security UserID="S-1-5-18"/>
  </System>
  <UserData>
    <AddServiceID>
      <ServiceName>usbaudio</ServiceName>
      <DriverFileName>\SystemRoot\system32\drivers\usbaudio.sys</DriverFileName>
      <DeviceInstanceID>USB\VID_0B0E&amp;amp;PID_245E&amp;amp;MI_00\6&amp;amp;549A665&amp;amp;0&amp;amp;0000</DeviceInstanceID>
      <PrimaryService>True</PrimaryService>
      <UpdateService>True</UpdateService>
      <AddServiceStatus>0</AddServiceStatus>
    </AddServiceID>
  </UserData>
</Event>

References

1 link

Source: evtx/Maps/System_Microsoft-Windows-UserPnp_20003.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)