Event ID 1000: Faulting application name: …, version: …, time stamp: 0x

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Faulting application name: …, version: …, time stamp: 0x

Event 1000

Application Error

Application log

Error

An application crashed. The message names the program, the module (DLL) where it failed and the exception code.

What to check: Exception 0xC0000005 is an access violation, 0xE0434352 an unhandled .NET exception (see 1026 for details), 0xC0000409 a stack buffer overrun. A third-party DLL as the faulting module is often the real culprit.

Related: 1001, 1002, 1026

Message and fields (as Event Viewer shows them)

Faulting application name: …, version: …, time stamp: 0x…
Faulting module name: …, version: …, time stamp: 0x…
Exception code: 0x…
Fault offset: 0x…
Faulting process id: …
Faulting application start time: …
Faulting application path: …
Faulting module path: …
Report Id: …
Faulting package full name: …
Faulting package-relative application ID: …

The computer has rebooted from a bugcheck.

Event 1000

WER-SystemErrorReporting

System log

Error

Message and fields (as Event Viewer shows them)

The computer has rebooted from a bugcheck.  The bugcheck was: …. A full dump was not saved.

There are currently no IPv4 DNS servers configured for any interface on this host.

Event 1000

DNS-Client

System log

Information

Message and fields (as Event Viewer shows them)

There are currently no IPv4 DNS servers configured for any interface on this host. Please configure DNS server settings, or renew your dynamic IP settings.

Connecting to NVMeoF Controller on device(Port

Event 1000

StorPort

System log

Information

Message and fields (as Event Viewer shows them)

Connecting to NVMeoF Controller on device(Port = …).                    
Adapter Guid: …                    
Miniport driver name: …                    
SubsystemNqn: …                    
ControllerId: …

Device … could not be query removed as the removal was vetoed.

Event 1000

Kernel-PnP

System log

Warning

Message and fields (as Event Viewer shows them)

Device … could not be query removed as the removal was vetoed.

Veto Type: …
Vetoed By: …

… scan has started.

Event 1000

Windows Defender

Windows Defender/Operational log

Information

Message and fields (as Event Viewer shows them)

… scan has started.
 	Scan ID: …
 	Scan Type: …
 	Scan Parameters: …
 	Scan Resources: …
  	User: …\…
 	Scan Trigger: …
 	Scan Only If Idle: …
 	Low CPU Priority for Scans: …
 	Thread Priority: …

S4U2Self authentication failure - The client could not be reauthenticated with S4U2Self to obtain claims.

Event 1000

SMBServer

SMBServer/Operational log

Warning

Message and fields (as Event Viewer shows them)

S4U2Self authentication failure - The client could not be reauthenticated with S4U2Self to obtain claims.  This may be expected if the account is not a domain account.