Network Adapter Disconnected

Summary

This rule generates an alert when Windows® detects that the network adapter has been disconnected from the network and no longer has network connectivity.

If the computer has only a single network adapter, this alert arrives only after network connectivity has been reestablished. In this case, you can resolve the alert without taking any additional action.

If the computer has multiple network adapters, the alert may arrive before network connectivity for the effected adapter has been reestablished. However, remote clients and applications may still have difficulty accessing resources on the computer despite the other adapter or adapters. In addition, the local computer may not be able to access some network resources.

Causes

Your computer's network adapter lost its connection to the network.

The adapter's connection to the network can be lost if you remove a network cable from your network adapter or if you are roaming between wireless access points with a mobile system. Other possible causes include network issues, firewall issues, or a malfunction of the network adapter or its driver.

Resolutions

If your computer is connected to the network by cable, confirm that the cable is plugged in properly. If you have a wireless network connection, confirm that you have a signal and the proper credentials for the wireless network.

If the network connection is working properly, check the following possible causes and take corrective action:

• The network is down.

• The firewall on your computer is blocking network broadcast traffic.

• Your computer's network adapter or driver is not functioning correctly.

Additional

Sample Event:

This rule generates an alert when any of the following events occur and are recorded in the System Event Log:

The system detected that network adapter %2 was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers.

• Source: TCPIP; Event ID: 4201 The system detected that network adapter %2 was disconnected from the network, and the adapter's network configuration has been released. If the network adapter was not disconnected, this may indicate that it has malfunctioned. Please contact your vendor for updated drivers.

Related Events:

The following event in the System Event Log indicates that the network adapter has resumed normal operation and connectivity.

The system detected that network adapter %2 was connected to the network, and has initiated normal operation over the network adapter.

• Source: TCPIP; Event ID: 4202 The system detected that network adapter %2 was connected to the network, and has initiated normal operation over the network adapter.

External

For more information, see Microsoft Knowledge Base Article: 325487, “How to Troubleshoot Network Connectivity Problems,” at http://go.microsoft.com/fwlink/?LinkId=28867.