How to Configure Log Link State Event on Network Adapters in Windows 11 Using PowerShell

In Windows 11 enterprise environments and automated network infrastructures, diagnosing intermittent connectivity problems requires accurate visibility into physical Ethernet link states. When a network cable is unplugged, a patch switch reboots, or an adapter renegotiates link speed due to Energy Efficient Ethernet (EEE) power transitions, the network interface card (NIC) driver can log an event to the Windows System Event Log. However, depending on network controller defaults, these status changes may either be completely silent—hindering root-cause analysis—or excessively verbose, flooding event logs with hundreds of duplicate link up/down entries. The Log Link State Event driver property governs whether physical link state transitions are recorded into the Windows event log. This article demonstrates how to inspect, configure, and validate Log Link State Event on network adapters in Windows 11 using PowerShell.

Understanding Log Link State Event Architecture

Physical layer Ethernet controllers manufactured by vendors such as Intel, Realtek, Broadcom, and Marvell monitor link integrity by continuously checking for physical carrier pulses and Auto-Negotiation link pulses. When the physical link transitions between operational states (for example, moving from 1 Gbps Full Duplex to Link Down, or establishing link at 100 Mbps):

• The hardware transceiver triggers an interrupt to the Network Driver Interface Specification (NDIS) miniport driver.
• The miniport driver evaluates whether link state event logging is enabled.
• If enabled, the driver writes an entry into the System event log under provider sources such as e1dexpress, e2fnexpress (Intel), or rt640x64 (Realtek), typically utilizing Event ID 27 (Network link is disconnected) and Event ID 32 (Network link has been established).

Administrators regulate this behavior using the driver’s advanced properties to achieve two operational objectives:

1. Network Forensic Auditing: Enabling link state logging on mission-critical servers, remote workstations, and Hyper-V virtualization hosts to detect loose cabling, faulty switch ports, and unauthorized cable disconnections.
2. Log Flood Prevention: Disabling link state logging on endpoints connected to aggressive green-energy switches or portable USB-C docking stations that flap link state frequently upon system sleep, preventing event log bloat.

Identifying Adapters and Querying Log Link State Event

To inspect your current network adapter driver parameters, launch an elevated Windows PowerShell console (Run as Administrator). First, retrieve all physical network interfaces:

Get-NetAdapter -Physical | Select-Object Name, InterfaceDescription, Status, LinkSpeed

Next, search the advanced property schema of your target Ethernet adapter for the link logging property:

Get-NetAdapterAdvancedProperty -Name "Ethernet" | Where-Object { $_.DisplayName -like "*Link State*" -or $_.RegistryKeyword -like "*LogLinkState*" }

To examine the allowable configuration choices and active values defined by the hardware vendor, pipe the command to Format-List:

Get-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "*Log Link State*" | Format-List DisplayName, DisplayValue, RegistryKeyword, RegistryValue, ValidDisplayValues

Review the ValidDisplayValues output, which typically presents choices such as "Enabled" and "Disabled", or detailed modes such as "Link Up and Down", "Link Down Only", and "Disabled".

Configuring Log Link State Event via PowerShell

To ensure that all physical link connect and disconnect events are captured in the event log for audit compliance, enable the setting using Set-NetAdapterAdvancedProperty:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Log Link State Event" -DisplayValue "Enabled"

On advanced Intel multi-gigabit controllers that provide granular selection between link establishment and disconnects, configure logging for both events:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Log Link State Event" -DisplayValue "Link Up and Down"

If you are deploying this configuration across automated scripts or mixed-language enterprise images where localized display strings differ, assign the property directly using the standardized registry keyword:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -RegistryKeyword "*LogLinkStateEvent" -RegistryValue 1

Conversely, if an unstable switch port or dock connection is generating excessive event log noise, silence the notifications by setting the value to disabled:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Log Link State Event" -DisplayValue "Disabled"

Applying this setting momentary restarts the miniport driver stack to register the update, causing a sub-second link refresh.

Verifying Registry Persistence and Device Configuration

To confirm that the driver has successfully activated the setting, re-query the advanced properties table:

Get-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "*Log Link State*" | Select-Object DisplayName, DisplayValue, RegistryValue

You can also verify that the parameter is written to the active Windows hardware device registry hive:

$Adapter = Get-NetAdapter -Name "Ethernet"
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}\$($Adapter.DeviceID)"
Get-ItemProperty -Path $RegPath -Name "*LogLinkStateEvent" -ErrorAction SilentlyContinue

Testing and Querying Generated Link Events in Event Viewer

To test link logging in practice, temporarily unplug and reconnect the physical Ethernet cable. Then query the Windows System event log using PowerShell to verify that the link events were recorded:

Get-WinEvent -FilterHashtable @{
    LogName = 'System'
    Id = 27, 32
} -MaxEvents 5 -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, ProviderName, Message | Format-List

A successful configuration outputs clear timestamped records:

• Event ID 27: “Intel(R) Ethernet Controller: Network link is disconnected.”
• Event ID 32: “Intel(R) Ethernet Controller: Network link has been established at 1Gbps full duplex.”

By managing Log Link State Event via PowerShell, administrators maintain full control over physical layer event logging, ensuring robust network telemetry without risking event log saturation.