Windows Event ID 219 – Kernel-PnP: Device Driver Installation or Removal Event

Start by examining the specific Event ID 219 details to understand what device operation occurred:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 219 in the Event IDs field and click OK
5. Double-click on recent Event ID 219 entries to view detailed information
6. Review the General tab for device instance IDs and operation descriptions
7. Check the Details tab for XML data containing hardware IDs and driver information

Look for patterns in the event timing and device information to identify specific hardware or driver-related activities.

Use PowerShell to extract and analyze Event ID 219 data programmatically:

# Get recent Event ID 219 entries with detailed information
Get-WinEvent -FilterHashtable @{LogName='System'; Id=219} -MaxEvents 50 | 
  Select-Object TimeCreated, Id, LevelDisplayName, Message | 
  Format-Table -AutoSize

# Filter events from the last 24 hours
$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=219; StartTime=$StartTime} | 
  ForEach-Object {
    [PSCustomObject]@{
      Time = $_.TimeCreated
      Message = $_.Message
      ProcessId = $_.ProcessId
    }
  } | Format-Table -Wrap

This approach helps identify patterns in device operations and correlate events with specific timeframes or system activities.

Correlate Event ID 219 occurrences with actual device changes in Device Manager:

1. Open Device Manager by right-clicking This PC and selecting Manage → Device Manager
2. Look for devices with warning icons or recently installed devices
3. Right-click on suspicious devices and select Properties
4. Check the Events tab to see device-specific event history
5. Note the timestamps and compare with Event ID 219 entries
6. Use PowerShell to get detailed device information:

# List all PnP devices with their status
Get-PnpDevice | Where-Object {$_.Status -ne 'OK'} | 
  Select-Object FriendlyName, Status, Class, InstanceId | 
  Format-Table -AutoSize

# Get device installation events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=20001,20002,20003} -MaxEvents 20

This method helps identify which specific devices are generating the Event ID 219 entries.

Examine Windows driver installation logs to understand the context of Event ID 219 occurrences:

1. Navigate to the Windows driver log directory:

# Check driver installation logs
Get-ChildItem C:\Windows\inf\setupapi.dev.log -ErrorAction SilentlyContinue
Get-ChildItem C:\Windows\Panther\setupact.log -ErrorAction SilentlyContinue

2. Review the Setup API logs for detailed driver installation information
3. Check Windows Update logs for automatic driver installations:

# Get Windows Update events related to drivers
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WindowsUpdateClient'} -MaxEvents 50 | 
  Where-Object {$_.Message -like '*driver*'} | 
  Select-Object TimeCreated, Message

4. Examine the Application log for driver-related events:

# Check for driver installation events in Application log
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=11707,11708} -MaxEvents 20 -ErrorAction SilentlyContinue

Set up comprehensive monitoring for ongoing Plug and Play activity analysis:

1. Create a custom Event Viewer view for PnP monitoring:

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(EventID=219 or EventID=20001 or EventID=20002 or EventID=20003 or EventID=10016)]]</Select>
  </Query>
</QueryList>

2. Save this query as a custom view named "PnP Device Activity"
3. Use PowerShell to create a real-time monitor:

# Real-time PnP event monitoring
Register-WinEvent -Query "*[System[EventID=219]]" -Action {
  $Event = $Event.SourceEventArgs.NewEvent
  Write-Host "$(Get-Date): PnP Event - $($Event.Message)" -ForegroundColor Yellow
}

# Monitor for 5 minutes then stop
Start-Sleep 300
Get-EventSubscriber | Unregister-Event

4. Check registry keys for PnP configuration:

# Examine PnP registry settings
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\PlugPlay" -ErrorAction SilentlyContinue
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Enum" | Select-Object -First 10