Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 12 Source: PlugPlayManager

The device <device> disappeared from the system without first being prepared for removal.
I received this code after a Windows Vista Home Premium laptop had an external USB wireless antenna unplugged. It also threw up event ID 15 and no USB device would work. They came up with "device unknown". I have to remove all power from laptop for a few minutes and restart to restore any USB function.
This event is logged in the System log when you back up or compact a Hyper-V virtual hard disk on a Windows Server 2008-based computer because the "MSFT Virtual HD SCSI Disk Device" device or the "Storage miniport driver" device is removed from the system after the backup or compact actions are finished. See ME958669 for details.

In Windows Vista, this issue may occur if the disk is "surprise removed." For example, this behavior may occur if you remove the disk without using the Safely Remove Hardware icon in the notification area to stop the disk first. This issue may occur even though the disk uses an interface that supports surprise removal, such as a universal serial bus (USB) interface or an IEEE 1394 interface. See ME938940 for additional information on this issue.

This event may be logged if high-volume disk I/O operations are performed and a time-out occurs while the LDM (Logical Disk Manager) is interacting with PNP (Plug and Play). See WITP80579 for details on this situation.

See ME945926 for additional information about this event.
If this error appears when you delete a hardware volume shadow copy that was created with the Volume Shadow Copy Service on a Microsoft Windows Server 2003-based server, this issue occurs because Windows Server 2003 identifies the hardware volume shadow copy in the same way that it identifies a hard disk. Therefore, when you delete a hardware volume shadow copy, Windows Server 2003 generates the same error message that is generated when a hard disk is removed.
As per Microsoft: "You can ignore this event in the system event log if you have deleted a hardware volume shadow copy from your computer". See ME828285 for more details.

From a newsgroup post: "This happened to me on my Windows XP Pro when certain data CDís are inserted into CDRW drive. After lots of time on the phone with Dell tech support and trying a different drive, they could not solve it and chalk it up to some problems with XP itself, perhaps with the atapi subsystem".

From a newsgroup post: "I had this problem with a CD-RW. It turned out to be a loose connection in the power socket".

From a newsgroup post: "The same problem happened to me with my CD-RW. Opening up the computer and disconnecting and reconnecting cables fixed this problem and now I can burn a CD, but when done the CD is unreadable".

From a newsgroup post: "What may be happening is that the CDROM is taking too long to read the disk, or the firmware in the CDROM is causing the CDROM to become uncontrollable when certain CD's are inserted. I have seen this happen on old CDROM drives when the laser malfunctions and the drive's electronics are trying to revive and read the CD. What eventually happens is that Windows checks the drive periodically to check if a disk is inserted. When it does this, the CDROM driver in Windows will only wait for so long, and then check again for the device state. If the drive won't respond, the driver reports to Windows that the CDROM has been removed (it isn't answering back, and won't respond). Replace the drive and I bet that fixes it".

Also from a newsgroup post: "Appears when I cut an external SCSI peripheral, the CD-RW or the CDROM. In this case the internal hdd disappears. Just do not cut, or do a hot detect".

See ME833167, ME835473, and MSW2KDB for more details about this event.
I received this very same error when a NIC disappeared in device manager. However, it seems that certain laptop NICs have this feature built-in to save power. Plug in the external power-supply to enable the NIC again. Disabling this feature varies depending on the driver. On some HP NICs, it is in the driver itself (Device Manager). On some Dell NICs, it is in the Dell QuickSet application.
I had this error with a SATA drive that was not a system or primary drive. It would simply go offline.  I rebooted, went into BIOS and the BIOS would not detect it either. When I unplugged the power connector and reconnected it, it then detected it. At this point it is either a bad SATA power connector or the power supply itself.

This event can occur when a drive that is part of a software RAID in Windows Server 2003 suddenly dies. If this is the case, then a few seconds later, there will be an LDM 500 event that breaks the volumes in the software RAID into distinct drives in the disk manager (i.e. if it is a RAID1 mirror, then the mirror is broken).
In my case, this event occurred after a series of events Disk 51 and Dmio 30. This sequence of events is the sign of a legitimate hardware problem that should be addressed.
This happened to me on my Windows XP Pro when certain data CDís are inserted into CDRW drive. After lots of time on the phone with Dell tech support and trying a different drive, they could not solve it and chalk it up to some problems with XP itself, perhaps with the atapi subsystem.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.