Where do all the little vEthernet (Default Switch) come from?

Question

Potentially related to this question or that one, I currently have 16 "vEthernet (Default Switch)"es around ("Standardswitch" in German, though I doubt l10n has anything to do with this). All but one are in a "cable not connected" state.

I only have 5 Hyper-V machines set up in total, and all of them use the manually created external switch "vEthernet (Extern)" instead. I can remove those manually via the device manager, but they keep popping up again and their amount seems to be perpetually increasing ~~even more often than I boot my PC~~^{see edit below, 16 boots since the last cleanup does actually sound reasonable on second thought}. What could be the culprit then, how can I figure this out? Is there any event log for the creation of those devices?

--

edit Mentioning event log, I noticed the respective device properties has an event tab and a button "all events" which creates a query

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-Kernel-PnP/Configuration">
    <Select Path="Microsoft-Windows-Kernel-PnP/Configuration">*[System/Provider[@Name='Microsoft-Windows-Kernel-PnP'] and EventData/Data[@Name='DeviceInstanceID']='ROOT\VMS_MP\0005']</Select>
    <Select Path="System">*[System/Provider[@Name='Microsoft-Windows-UserPnp'] and UserData/*/DeviceInstanceID='ROOT\VMS_MP\0005']</Select>
  </Query>
</QueryList>

so I dropped the DeviceInstaceID, yielding

<QueryList>
  <Query Id="0" Path="Microsoft-Windows-Kernel-PnP/Configuration">
    <Select Path="Microsoft-Windows-Kernel-PnP/Configuration">*[System/Provider[@Name='Microsoft-Windows-Kernel-PnP']]</Select>
    <Select Path="System">*[System/Provider[@Name='Microsoft-Windows-UserPnp']]</Select>
  </Query>
</QueryList>

There seem to occur 2-3 errors per day at times which might concur with booting my system (I guess there's a query for that as well?), so: why does this happen? Why is a new default switch created at every boot?

edit2 The error code always is 0xa with status 0xc0000001, or in more detail:

Protokollname: Microsoft-Windows-Kernel-PnP/Configuration
Quelle:        Microsoft-Windows-Kernel-PnP
Datum:         03.05.2019 07:21:32
Ereignis-ID:   411
Aufgabenkategorie:Keine
Ebene:         Fehler
Schlüsselwörter:
Benutzer:      SYSTEM
Computer:      [redacted]
Beschreibung:
Das Gerät ROOT\VMS_MP\0003 wurde gestartet.

Treibername: wvms_mp.inf
Klassen-GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Dienst: VMSNPXYMP
Untere Filter: 
Obere Filter: 
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9C205A39-1250-487D-ABD7-E831C6290539}" />
    <EventID>410</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime="2019-04-15T07:38:13.514403800Z" />
    <EventRecordID>1531</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="11876" />
    <Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
    <Computer>[redacted]</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="DeviceInstanceId">ROOT\VMS_MP\0003</Data>
    <Data Name="DriverName">wvms_mp.inf</Data>
    <Data Name="ClassGuid">{4D36E972-E325-11CE-BFC1-08002BE10318}</Data>
    <Data Name="ServiceName">VMSNPXYMP</Data>
    <Data Name="LowerFilters">
    </Data>
    <Data Name="UpperFilters">
    </Data>
    <Data Name="Problem">0x0</Data>
    <Data Name="Status">0x0</Data>
  </EventData>
</Event>

This seems to mean a disconnected or inaccessible device. In the administrative events log I find two errors that might correlate in terms of timing and meaning:

Protokollname: System
Quelle:        Microsoft-Windows-Hyper-V-VmSwitch
Datum:         03.05.2019 07:21:24
Ereignis-ID:   269
Aufgabenkategorie:Keine
Ebene:         Fehler
Schlüsselwörter:
Benutzer:      SYSTEM
Computer:      [redacted]
Beschreibung:
Failed to get Device VlanID Regkey for Physical NIC /DEVICE/{[redacted]}. vSwitch will be created on this Physical NIC without VlanID being inherited by HostVNic. Status = Der Objektname wurde nicht gefunden.
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Hyper-V-VmSwitch" Guid="{67DC0D66-3695-47C0-9642-33F76F7BD7AD}" />
    <EventID>269</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2019-05-03T05:21:24.475217200Z" />
    <EventRecordID>67541</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="540" />
    <Channel>System</Channel>
    <Computer>CARTMAN</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="Status">3221225524</Data>
    <Data Name="NicNameLen">46</Data>
    <Data Name="NicName">/DEVICE/{[redacted]}</Data>
    <Data Name="NicFNameLen">1</Data>
    <Data Name="NicFName">
    </Data>
    <Data Name="UniqueEvent">0</Data>
  </EventData>
</Event>

Protokollname: Microsoft-Windows-Kernel-EventTracing/Admin
Quelle:        Microsoft-Windows-Kernel-EventTracing
Datum:         03.05.2019 07:21:24
Ereignis-ID:   28
Aufgabenkategorie:Provider
Ebene:         Fehler
Schlüsselwörter:(2048),(512),Provider
Benutzer:      SYSTEM
Computer:      [redacted]
Beschreibung:
Fehler beim Festlegen von Merkmalen für den Anbieter {[redacted]}. Fehler: 0xC0000001
Ereignis-XML:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
    <EventID>28</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>25</Opcode>
    <Keywords>0x8000000000000a20</Keywords>
    <TimeCreated SystemTime="2019-05-03T05:21:24.238467500Z" />
    <EventRecordID>855</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="364" />
    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
    <Computer>[redacted]</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="ProviderGuid">{[redacted]}</Data>
    <Data Name="ErrorCode">3221225473</Data>
  </EventData>
</Event>

There might be some correlation to one Hyper-V machine being set up to launch on boot even though that also uses the external switch. Maybe the VLAN-ID setting is relevant as well... I'll try some reboots with that machine deactivated or delayed, but of course any input here is appreciated as well.

edit3 So, several reboots later I can say this happens the moment Hyper-V has an external or internal switch in its configuration. This sucks. But am I the only one experiencing this?

Where do all the little vEthernet (Default Switch) come from?

0 Answers0