| 1 | SMB Server Shares |
SMB Server Shares |
| 3 | 此计数器集显示有关 SMB 服务器共享的信息。该服务器共享使用 SMB 协议版本 2 或更高版本进行共享。 |
This counter set displays information about SMB server shares that are shared using SMB protocol version 2 or higher. |
| 9 | Received Bytes/sec |
Received Bytes/sec |
| 11 | 接收与此共享有关的请求字节的速率。该值包括应用程序数据以及 SMB 协议数据(如数据包标头)。 |
The rate at which bytes are being received for requests related to this share. This value includes application data as well as SMB protocol data (such as packet headers). |
| 17 | Requests/sec |
Requests/sec |
| 19 | 正在为此共享接收请求的速率 |
The rate at which requests are being received for this share |
| 21 | Tree Connect Count |
Tree Connect Count |
| 23 | 当前连接到此共享的树数量 |
The current number of tree connects to this share |
| 25 | Current Open File Count |
Current Open File Count |
| 27 | 当前在此共享中打开的文件句柄的数量 |
The number of file handles that are currently open in this share |
| 1005 | 从与此共享有关的 SMB 文件服务器向其客户端发送字节的速率(以秒为单位)。该值包括数据字节和协议字节。 |
The rate, in seconds, at which bytes are being sent from the SMB File Server related to this share to its clients. This value includes both data bytes and protocol bytes. |
| 1007 | Sent Bytes/sec |
Sent Bytes/sec |
| 1013 | 此共享每秒发送和接收的字节数总和。 |
The sum of Sent Bytes/sec and Received Bytes/sec for this share. |
| 1015 | Transferred Bytes/sec |
Transferred Bytes/sec |
| 1017 | 正在等待 SMB 文件服务器处理的与此共享有关的请求数量。 |
The number of requests related to this share that are waiting to be processed by the SMB File Server. |
| 1019 | Current Pending Requests |
Current Pending Requests |
| 1025 | 在 SMB 文件服务器接收此共享请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which the SMB File Server receives a request for this share and the time at which the SMB File Server sends the corresponding response. |
| 1027 | Avg. sec/Request |
Avg. sec/Request |
| 1033 | 每秒处理的与此共享有关的写入请求。 |
Write requests processed/sec related to this share. |
| 1035 | Write Requests/sec |
Write Requests/sec |
| 1037 | 收到此共享的写入请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a write request to this share is received and the time at which the SMB File Server sends the corresponding response. |
| 1039 | Avg. sec/Write |
Avg. sec/Write |
| 1045 | 向此共享写入数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being written to this share. |
| 1047 | Write Bytes/sec |
Write Bytes/sec |
| 1053 | 每秒处理的与此共享有关的读取请求。 |
Read requests processed/sec related to this share. |
| 1055 | Read Requests/sec |
Read Requests/sec |
| 1057 | 收到此共享的读取请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a read request to this share is received and the time at which the SMB File Server sends the corresponding response. |
| 1059 | Avg. sec/Read |
Avg. sec/Read |
| 1065 | 从此共享读取数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being read from this share. |
| 1067 | Read Bytes/sec |
Read Bytes/sec |
| 1069 | 自服务器启动以来，SMB 文件服务器代表其客户端在此共享上打开的文件数量。 |
The number of files that have been opened by the SMB File Server on behalf of its clients on this share since the server started. |
| 1071 | Total File Open Count |
Total File Open Count |
| 1073 | 在此共享上为 SMB 文件服务器的客户端打开文件的速率(以秒为单位)。 |
The rate, in seconds, at which files are being opened for the SMB File Server’s clients on this share. |
| 1075 | Files Opened/sec |
Files Opened/sec |
| 1077 | 此共享上当前打开的持久文件句柄的数目 |
The number of durable file handles that are currently open on this share |
| 1079 | Current Durable Open File Count |
Current Durable Open File Count |
| 1081 | 自 SMB 文件服务器启动以来，临时断开网络连接之后已恢复的此共享上持久打开的数量。 |
The number of durable opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 1083 | Total Durable Handle Reopen Count |
Total Durable Handle Reopen Count |
| 1085 | 自 SMB 文件服务器启动以来，临时断开网络连接之后无法恢复的此共享上持久打开的数量。 |
The number of durable opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 1087 | Total Failed Durable Handle Reopen Count |
Total Failed Durable Handle Reopen Count |
| 1089 | 为请求复原的客户端打开的总数的百分比。 |
The percentage of total opens for which clients requested resiliency. |
| 1091 | % Resilient Handles |
% Resilient Handles |
| 1093 | 自 SMB 文件服务器启动以来，临时断开网络连接之后已恢复的此共享上弹性打开的数量。 |
The number of resilient opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 1095 | Total Resilient Handle Reopen Count |
Total Resilient Handle Reopen Count |
| 1097 | 自 SMB 文件服务器启动以来，临时断开网络连接之后无法恢复的此共享上弹性打开的数量。 |
The number of resilient opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 1099 | Total Failed Resilient Handle Reopen Count |
Total Failed Resilient Handle Reopen Count |
| 1101 | 客户端请求的持久句柄总数百分比。 |
The percentage of total handles for which clients requested persistency. |
| 1103 | % Persistent Handles |
% Persistent Handles |
| 1107 | Total Persistent Handle Reopen Count |
Total Persistent Handle Reopen Count |
| 1111 | Total Failed Persistent Handle Reopen Count |
Total Failed Persistent Handle Reopen Count |
| 1117 | 将元数据请求发送到此共享的速率(以秒为单位)。 |
The rate, in seconds, at which metadata requests are being sent to this share. |
| 1119 | Metadata Requests/sec |
Metadata Requests/sec |
| 1121 | 收到此共享的读取或写入请求的时间和 SMB 文件服务器处理该请求的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a read or write request to this share is received and the time at which the SMB File Server processes the request. |
| 1123 | Avg. sec/Data Request |
Avg. sec/Data Request |
| 1125 | 每个读取或写入请求的平均字节数。 |
The average number of bytes per read or write request. |
| 1127 | Avg. Data Bytes/Request |
Avg. Data Bytes/Request |
| 1129 | 每个读取请求的平均字节数。 |
The average number of bytes per read request. |
| 1131 | Avg. Bytes/Read |
Avg. Bytes/Read |
| 1133 | 每个写入请求的平均字节数。 |
The average number of bytes per write request. |
| 1135 | Avg. Bytes/Write |
Avg. Bytes/Write |
| 1137 | 为此共享列队的平均读取请求数。 |
The average number of read requests that were queued for this share. |
| 1139 | Avg. Read Queue Length |
Avg. Read Queue Length |
| 1141 | 为此共享列队的平均写入请求数。 |
The average number of write requests that were queued for this share. |
| 1143 | Avg. Write Queue Length |
Avg. Write Queue Length |
| 1145 | 为此共享列队的平均读写请求数。 |
The average number of read and write requests that were queued for this share. |
| 1147 | Avg. Data Queue Length |
Avg. Data Queue Length |
| 1149 | 将数据写入此共享或从此共享中读取数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being written to or read from this share. |
| 1151 | Data Bytes/sec |
Data Bytes/sec |
| 1153 | 接收此共享的读取或写入请求的速率(以秒为单位)。 |
The rate, in seconds, at which read or write requests are received for this share. |
| 1155 | Data Requests/sec |
Data Requests/sec |
| 1157 | 此共享上当前未完成的读取或写入请求数。 |
The current number of read or write requests outstanding on this share. |
| 1159 | Current Data Queue Length |
Current Data Queue Length |
| 2001 | 此计数器集显示有关使用 SMB 协议版本 2 或更高版本的 SMB 服务器会话的信息 |
This counter set displays information about SMB server sessions using SMB protocol version 2 or higher |
| 2003 | SMB Server Sessions |
SMB Server Sessions |
| 2009 | 在此会话中为请求接收字节的速率。该值包括应用程序数据以及 SMB 协议数据(如数据包标头)。 |
The rate at which bytes are being received for requests in this session. This value includes application data as well as SMB protocol data (such as packet headers). |
| 2017 | 在此会话中接收请求的速率 |
The rate at which requests are being received in this session |
| 2021 | 在此会话中树连接的数量 |
The number of tree connects in this session |
| 2025 | 当前在此会话中打开的文件句柄数量 |
The number of file handles that are currently open in this session |
| 2033 | 在此会话中从 SMB 文件服务器向客户端发送字节的速率(以秒为单位)。该值包括数据字节和协议字节。 |
The rate, in seconds, at which bytes are being sent from the SMB File Server in this session to the client. This value includes both data bytes and protocol bytes. |
| 2041 | 此会话每秒发送和接收的字节数总和。 |
The sum of Sent Bytes/sec and Received Bytes/sec for this session. |
| 2045 | 在此会话中等待 SMB 文件服务器处理的请求数。 |
The number of requests in this session that are waiting to be processed by the SMB File Server. |
| 2053 | 在此会话中 SMB 文件服务器接收请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which the SMB File Server receives a request in this session and the time at which the SMB File Server sends the corresponding response. |
| 2061 | 在此会话中每秒处理的写入请求数。 |
Write requests processed/sec in this session. |
| 2065 | 接收此会话中的写入请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a write request in this session is received and the time at which the SMB File Server sends the corresponding response. |
| 2073 | 在此会话中写入数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being written in this session. |
| 2083 | 在此会话中每秒处理的读取请求数。 |
Read requests processed/sec in this session. |
| 2087 | 接收此会话中的读取请求的时间和 SMB 文件服务器发送相应响应的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a read request in this session is received and the time at which the SMB File Server sends the corresponding response. |
| 2095 | 在此会话中读取数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being read in this session. |
| 2099 | 自服务器启动以来，SMB 文件服务器代表其客户端在此会话中打开的文件数。 |
The number of files that have been opened by the SMB File Server on behalf of its clients in this session since the server started. |
| 2103 | 在此会话中打开文件的速率(以秒为单位)。 |
The rate, in seconds, at which files are being opened in this session. |
| 2107 | 此会话中当前打开的持久文件句柄的数目 |
The number of durable file handles that are currently open in this session |
| 2111 | 自 SMB 文件服务器启动以来，临时断开网络连接之后已恢复的此会话中持久打开的数量。 |
The number of durable opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 2115 | 自 SMB 文件服务器启动以来，临时断开网络连接之后无法恢复的此会话中持久打开的数量。 |
The number of durable opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 2123 | 自 SMB 文件服务器启动以来，临时断开网络连接之后已恢复的此会话中弹性打开的数量。 |
The number of resilient opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 2127 | 自 SMB 文件服务器启动以来，临时断开网络连接之后无法恢复的此会话中弹性打开的数量。 |
The number of resilient opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 2131 | 客户端请求的持久打开总数的百分比。 |
The percentage of total opens for which clients requested persistency. |
| 2147 | 在此会话中发送元数据请求的速率(以秒为单位)。 |
The rate, in seconds, at which metadata requests are being sent in this session. |
| 2151 | 收到此会话的读取或写入请求的时间和 SMB 文件服务器处理该请求的时间之间经过的平均秒数。 |
The average number of seconds that elapse between the time at which a read or write request to this session is received and the time at which the SMB File Server processes the request. |
| 2167 | 在此会话中列队的平均读取请求数。 |
The average number of read requests that were queued in this session. |
| 2171 | 在此会话中列队的平均写入请求数。 |
The average number of write requests that were queued in this session. |
| 2175 | 在此会话中列队的平均读写请求数。 |
The average number of read and write requests that were queued in this session. |
| 2179 | 在此会话中写入或读取数据的速率(以秒为单位)。 |
The rate, in seconds, at which data is being written or read in this session. |
| 2183 | 在此会话中接收的读取或写入请求的速率(以秒为单位)。 |
The rate, in seconds, at which read or write requests are received in this session. |
| 2187 | 在此会话中当前未完成的读取或写入请求数。 |
The current number of read or write requests outstanding in this session. |
| 3001 | SMB 服务器性能计数器为 SMB 协议版本 2 和更高版本度量文件服务器活动 |
The SMB Server performance counters measure file server activity for SMB protocol versions 2 and higher |
| 3003 | SMB Server |
SMB Server |
| 3005 | 读取字节数/秒是指为满足 SMB 读取请求而采用的数据读取速率。 |
Read Bytes/sec is the rate at which data is being read to satisfy SMB read requests. |
| 3009 | 读取请求数/秒是指收到 SMB 读取请求的速率。 |
Read Requests/sec is the rate at which SMB read requests are being received. |
| 3013 | 写入字节数/秒是指为满足 SMB 写入请求而采用的数据写入速率。 |
Write Bytes/sec is the rate at which data is being written to satisfy SMB write requests. |
| 3017 | 写入请求数/秒是指收到 SMB 写入请求的速率。 |
Write Requests/sec is the rate at which SMB write requests are being received. |
| 3021 | 发送字节数/秒是指在网络上传输数据的速率。此值包括应用程序数据以及 SMB 协议数据(例如包头)。 |
Send Bytes/sec is the rate at which data is being transmitted on the network. This value includes application data as well as SMB protocol data (such as packet headers). |
| 3023 | Send Bytes/sec |
Send Bytes/sec |
| 3025 | 接收字节数/秒是指从网络上接收数据的速率。此值包括应用程序数据以及 SMB 协议数据(例如包头)。 |
Receive Bytes/sec is the rate at which data is being received from the network. This value includes application data as well as SMB protocol data (such as packet headers). |
| 3027 | Receive Bytes/sec |
Receive Bytes/sec |
| 0x10000035 | 审核失败 |
Audit Failure |
| 0x30000000 | 信息 |
Info |
| 0x30000001 | 开始 |
Start |
| 0x30000002 | 停止 |
Stop |
| 0x30000009 | 发送 |
Send |
| 0x50000002 | 错误 |
Error |
| 0x50000003 | 警告 |
Warning |
| 0x90000001 | Microsoft-Windows-SMBServer/Performance |
Microsoft-Windows-SMBServer/Performance |
| 0x90000002 | Microsoft-Windows-SMBServer/Analytic |
Microsoft-Windows-SMBServer/Analytic |
| 0x90000003 | Microsoft-Windows-SMBServer/Operational |
Microsoft-Windows-SMBServer/Operational |
| 0x90000004 | Microsoft-Windows-SMBServer/Diagnostic |
Microsoft-Windows-SMBServer/Diagnostic |
| 0x90000005 | Microsoft-Windows-SMBServer/Security |
Microsoft-Windows-SMBServer/Security |
| 0x90000006 | Microsoft-Windows-SMBServer/Connectivity |
Microsoft-Windows-SMBServer/Connectivity |
| 0x90000007 | Microsoft-Windows-SMBServer/Audit |
Microsoft-Windows-SMBServer/Audit |
| 0xB00000C8 | SMB2 工作项组件转换 |
SMB2 Work Item Component Transition |
| 0xB00000C9 | SMB2 工作项已分配 |
SMB2 Work Item allocated |
| 0xB00000CA | SMB2 工作项已释放 |
SMB2 Work Item released |
| 0xB00000CB | SMB2 工作项活动 ID 转移 |
SMB2 Work Item activity id transfer |
| 0xB00000CC | SMB2 工作项外部活动 ID 停止 |
SMB2 Work Item external activity id stop |
| 0xB00001F4 | SMB2 连接已接受 |
SMB2 Connection accepted |
| 0xB00001F5 | SMB2 连接已由对等方断开 |
SMB2 Connection Disconnected by Peer |
| 0xB00001F6 | SMB2 连接已终止 |
SMB2 Connection Terminated |
| 0xB0000226 | SMB2 会话已分配 |
SMB2 Session Allocated |
| 0xB0000227 | SMB 会话身份验证失败 |
Smb Session Authentication Failure |
| 0xB0000228 | SMB2 会话身份验证成功 |
SMB2 Session Authentication Success |
| 0xB0000229 | SMB2 会话已绑定到连接 |
SMB2 Session Bound to Connection |
| 0xB000022A | SMB2 会话已终止 |
SMB2 Session Terminated |
| 0xB0000258 | SMB2 TreeConnect 已分配 |
SMB2 TreeConnect Allocated |
| 0xB0000259 | SMB2 TreeConnect 已断开
连接 |
SMB2 TreeConnect Disconnected |
| 0xB000025A | SMB2 TreeConnect 已终止 |
SMB2 TreeConnect Terminated |
| 0xB000025B | 由于群集终结点初始化，SMB2 TreeConnect 失败 |
SMB2 TreeConnect Failed due to Cluster Endpoint Initializing |
| 0xB000028A | SMB2 Open 已建立 |
SMB2 Open established |
| 0xB000028B | SMB2 Open 已断开连接 - 已保留 |
SMB2 Open Disconnected - Preserved |
| 0xB000028C | SMB2 Open 已重新连接 |
SMB2 Open Reconnected |
| 0xB000028D | SMB2 Open 已暂停 - 已保留 |
SMB2 Open Suspended - Preserved |
| 0xB000028E | SMB2 Open 已关闭 |
SMB2 Open Closed |
| 0xB000028F | SMB2 Open 已超时 |
SMB2 Open Timed Out |
| 0xB0000290 | SMB2 Open 已终止 |
SMB2 Open Terminated |
| 0xB0000291 | SMB2 Open 的群集客户端故障转移已关闭 |
SMB2 Open Clustered Client Failover Closed |
| 0xB0000292 | 文件“%8\\%2”的文件句柄被计算机 %6 中的用户 %4 设置为失效 |
File handle for file \"%8\\%2\" was invalidated by user %4 from computer %6 |
| 0xB00002BC | SMB2 共享已添加 |
SMB2 Share Added |
| 0xB00002BD | SMB2 共享已修改 |
SMB2 Share Modified |
| 0xB00002BE | SMB2 共享已删除 |
SMB2 Share Deleted |
| 0xB00003E8 | S4U2Self 身份验证失败 - 无法使用 S4U2Self 再次对客户端进行身份验证以获取声明。如果该帐户不是域帐户，则可能会发生这种情况。 |
S4U2Self authentication failure - The client could not be reauthenticated with S4U2Self to obtain claims. This may be expected if the account is not a domain account. |
| 0xB00003E9 | 已禁用 SRV - 由于 SMB1 被禁用导致 SMB1 协商请求失败。 |
SRV Disabled - The SMB1 negotiate request fails due to SMB1 is disabled. |
| 0xB00003EA | RKF 失败 - SRV2 无法从恢复密钥筛选器中获取关于永久处理请求的确认。 |
RKF failure - SRV2 failed to get acknowledgement from Resume Key filter for persistent handle request. |
| 0xB00003EB | 服务器收到来自客户端 %4 的未加密消息。消息被拒绝。%n%nGuidance:%n%n此事件表示即使在 SMB 共享需要加密的情况下，客户端仍会发送未加密的数据。 |
The server received an unencrypted message from client %4. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
| 0xB00003EC | 服务器收到来自客户端 %2 的签名错误的消息。消息被拒绝。%n%n指导:%n%n此事件表示客户端正在发送签名错误的请求。 |
The server received an incorrectly signed message from client %2. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
| 0xB00003ED | 服务器无法验证来自客户端 %2 的协商。连接被终止。 |
The server failed to validate negotiation from client %2. Connection was terminated. |
| 0xB00003EE | 共享已拒绝对客户端的访问。%n%n客户端名称: %10%n客户端地址: %6%n用户名: %8%n会话 ID: %17%n共享名称: %2%n共享路径: %4%n状态: %16 (%15)%n映射访问: %11%n被授访问权: %12%n安全描述符: %14%n%n指导:%n%n如果主体在没有必要权限的情况下访问共享，可能会发生拒绝访问错误。通常，这表示主体没有直接的安全权限，或缺乏拥有直接访问权限的组成员身份。要确定和更正指定共享中的权限，管理员可使用“文件资源管理器属性”对话框中的“安全”选项卡、SMBSHARE Windows PowerShell 模块或 NET SHARE 命令。你还可以使用“文件资源管理器”中的“有效访问”选项卡，以帮助诊断该问题。%n%n如果应用程序尝试先在可写模式下打开文件，然后再在只读模式下重新打开这些文件，则应用程序可能生成拒绝访问错误。在这种情况下，无需任何用户操作。%n%n如果对共享的访问被拒绝并且该事件未被记录，则你可以检查文件和文件夹的 NTFS/REFS 权限。%n%n此错误不表示身份验证存在问题，只表示授权有问题。 |
The share denied access to the client.%n%nClient Name: %10%nClient Address: %6%nUser Name: %8%nSession ID: %17%nShare Name: %2%nShare Path: %4%nStatus: %16 (%15)%nMapped Access: %11%nGranted Access: %12%nSecurity Descriptor: %14%n%nGuidance:%n%nYou should expect access denied errors when a principal accesses a share without the necessary permissions. Usually, this indicates that the principal does not have direct security permissions or lacks membership in a group that has direct access permissions. To determine and correct the permissions on the specified share, an administrator can use the Security tab in File Explorer Properties dialog, the SMBSHARE Windows PowerShell module, or the NET SHARE command. You can also use the Effective Access tab in File Explorer to help diagnose the issue.%n%nApplications may generate access denied errors if they attempt to open files in a writable mode first, and then reopen the files in a read-only mode. In this case, no user action is required.%n%nIf access to the share is denied and this event is not logged, you can examine the file and folder NTFS/REFS permissions.%n%nThis error does not indicate a problem with authentication, only authorization. |
| 0xB00003EF | 共享已拒绝对客户端的匿名访问。%n%n客户端名称: %8%n客户端地址: %6%n共享名称: %2%n共享路径: %4%n%n指导:%n%n如果客户端尝试连接到共享并且没有提供任何凭据，则可能会发生此错误。这表示客户端没有提供用户名(和域凭据，如有必要)。默认情况下，对共享的匿名访问会被拒绝。%n%n此错误并不总是表示授权存在问题，但主要还是与身份验证有关。非 Windows 客户端更容易出现这类问题。 |
The share denied anonymous access to the client.%n%nClient Name: %8%nClient Address: %6%nShare Name: %2%nShare Path: %4%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, anonymous access to shares is denied.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
| 0xB00003F1 | 服务器已拒绝对客户端的匿名访问。%n%n客户端名称: %4%n 客户端地址: %2%n会话 ID: %5%n%n指导:%n%n如果客户端尝试连接到共享并且没有提供任何凭据，可能会发生此错误。这表示客户端没有提供用户名(和域凭据，如有必要)。默认情况下，Windows Server 拒绝匿名访问共享。%n%n此错误并不总是表示授权存在问题，但主要还是与身份验证有关。非 Windows 客户端更容易出现这类问题。 |
The server denied anonymous access to the client.%n%nClient Name: %4%n Client Address: %2%nSession ID: %5%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, Windows Server denies anonymous access to shares.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
| 0xB00003F2 | 终结点已添加。%n%n名称: %2%n域名: %4%n传输名称: %6%n传输标志: %7%n%n指导:%n%n在服务器开始侦听接口时(例如在系统重启过程中或启用网络适配器时)，可能会发生此事件。无需任何用户操作。 |
Endpoint added.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%nTransport Flags: %7%n%nGuidance:%n%nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. |
| 0xB00003F3 | 终结点已删除。%n%n名称: %2%n域名: %4%n传输名称: %6%n%n指导:%n%n在服务器停止侦听接口时(例如在关闭期间或禁用网络适配器时)，可能会发生此事件。无需任何用户操作。 |
Endpoint removed.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%n%nGuidance:%n%nYou should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. |
| 0xB00003F4 | 网络名称信息已更改。%n%n更改类型: %1%n网络名称: %3%nIP 地址: %9%n标志: %4%n接口索引: %5%n功能: %6%n链接速度: %7%n%n指导:%n%n在故障转移操作的过程中、在系统启动时、或在网络配置期间，Windows 故障转移群集节点上可能会发生此事件。无需任何用户操作。 |
The network name information changed.%n%nChange Type: %1%nNet Name: %3%nIP Address: %9%nFlags: %4%nInterface Index: %5%nCapability: %6%nLink Speed: %7%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. |
| 0xB00003F5 | 终结点正在联机。%n%n终结点名称: %2%n传输名称: %4%n%n指导:%n%n在故障转移操作的过程中，Windows 故障转移群集节点上可能会发生此事件。无需任何用户操作。 |
Endpoint coming online.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
| 0xB00003F6 | 终结点正在脱机。%n%n终结点名称: %2%n传输名称: %4%n%n指导:%n%n在故障转移操作的过程中，Windows 故障转移群集节点上可能会发生此事件。无需任何用户操作。 |
Endpoint going offline.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
| 0xB00003F7 | 解密调用失败。%n%n客户端名称: %2%n客户端地址: %4%n会话 ID: %7%n状态: %6 (%5)%n%n指导:%n%n此事件通常会在上一个 SMB 会话不再存在时发生。计算机网络上因错误或“中间人”攻击而更改的数据包也可能引发该事件。 |
Decrypt call failed.%n%nClient Name: %2%nClient Address: %4%nSession ID: %7%nStatus: %6 (%5)%n%nGuidance:%n%nThis event commonly occurs because a previous SMB session no longer exists. It may also be caused by packets that are altered on the network between the computers due to either errors or a \"man-in-the-middle\" attack. |
| 0xB00003F8 | 重新打开失败。%n%n客户端名称: %7%n客户端地址: %9%n用户名: %13%n会话 ID: %14%n共享名称: %11%n文件名称: %16%n恢复密钥: %20%n状态: %2 (%1)%nRKF 状态: %4 (%3)%n持久: %17%n弹性: %18%n永久: %19%n原因: %21%n%n指导:%n%n客户端尝试重新打开一个持续可用的句柄，但是尝试失败。这通常表示网络存在问题或基本文件被重新打开。 |
Reopen failed.%n%nClient Name: %7%nClient Address: %9%nUser Name: %13%nSession ID: %14%nShare Name: %11%nFile Name: %16%nResume Key: %20%nStatus: %2 (%1)%nRKF Status: %4 (%3)%nDurable: %17%nResilient: %18%nPersistent: %19%nReason: %21%n%nGuidance:%n%nThe client attempted to reopen a continuously available handle, but the attempt failed. This typically indicates a problem with the network or underlying file being re-opened. |
| 0xB00003F9 | 句柄已清理。%n%n共享名称: %7%n文件名称: %9%n恢复密钥: %5%n永久文件 ID: %3%n可变文件 ID: %4%n持久: %1%n弹性或永久: %2%n%n指导:%n%n服务器在 60 秒后关闭了之前为客户端保留的句柄。在其中的客户端没有正常关闭其会话的持续可用的计算机上，可能会发生此事件。例如，在客户端意外重启时，可能会发生此事件。 |
Handle scavenged.%n%nShare Name: %7%nFile Name: %9%nResume Key: %5%nPersistent File ID: %3%nVolatile File ID: %4%nDurable: %1%nResilient or Persistent: %2%n%nGuidance:%n%nThe server closed a handle that was previously reserved for a client after 60 seconds. You should expect this event on a computer that is continuously available where a client did not gracefully close its session. For instance, this may occur when the client unexpectedly restarted. |
| 0xB00003FA | 已完成会话的反向通道失效操作。%n%n会话 ID: %1%n状态: %3 (%2)%n任务状态: %5 (%4)%n%n指导:%n%n在持续可用的计算机上可能会发生此事件。无需任何用户操作 |
Backchannel invalidation of session completed.%n%nSession ID: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
| 0xB00003FB | 已完成文件的反向通道失效操作。%n%n恢复密钥: %1%n状态: %3 (%2)%n任务状态: %5 (%4)%n%n指导:%n%n在持续可用的计算机上可能会发生此事件。无需任何用户操作 |
Backchannel invalidation of file completed.%n%nResume Key: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
| 0xB00003FC | 文件系统操作所花费的时间超过预期。%n%n客户端名称: %8%n客户端地址: %10%n用户名称: %6%n会话 ID: %3%n共享名称: %12%n文件名称: %14%n命令: %1%n持续时间(以毫秒为单位): %15%n警告阈值(以毫秒为单位): %16%n%n指导:%n%n基本文件系统的操作响应时间过长。这通常表示存储存在问题，而不是 SMB。 |
File system operation has taken longer than expected.%n%nClient Name: %8%nClient Address: %10%nUser Name: %6%nSession ID: %3%nShare Name: %12%nFile Name: %14%nCommand: %1%nDuration (in milliseconds): %15%nWarning Threshold (in milliseconds): %16%n%nGuidance:%n%nThe underlying file system has taken too long to respond to an operation. This typically indicates a problem with the storage and not SMB. |
| 0xB00003FD | LmCompatibilityLevel 值不同于默认值。%n%n已配置的 LM 兼容级别: %1%n默认的 LM 兼容级别: %2%n%n指导:%n%nLAN Manager (LM)身份验证是用于对执行网络操作的 Windows 客户端进行身份验证的协议。它包括加入域、访问网络资源、以及对用户或计算机进行身份验证。它决定在客户端和服务器计算机之间协商哪些质询/响应身份验证协议。具体来说，LM 身份验证级别决定客户端将尝试协商或服务器将接受哪些身份验证协议。为 LmCompatibilityLevel 设置的值决定哪些质询/响应身份验证协议将被用于网络登录。此值会影响客户端所使用的身份验证协议的级别、协商的会话安全级别、以及服务器可接受的身份验证级别。%n%n值(设置) - 描述%n%n0 (发送 LM 和 NTLM 响应) - 客户端使用 LM 和 NTLM 身份验证，并且从不使用 NTLMv2 会话安全。域控制器接受 LM、NTLM 和 NTLMv2 身份验证。%n%n1 (发送 LM 和 NTLM - 如果已协商，则使用 NTLMv2 会话安全) - 客户端使用 LM 和 NTLM 身份验证，并使用受服务器支持的 NTLMv2 会话安全。域控制器接受 LM、NTLM 和 NTLMv2 身份验证。%n%n2 (只发送 NTLM 响应) - 客户端只使用 NTLM 身份验证，并使用受服务器支持的 NTLMv2 会话安全。域控制器接受 LM、NTLM 和 NTLMv2 身份验证。%n%n3 (只发送 NTLM v2 响应) - 客户端只使用 NTLMv2 身份验证，并使用受服务器支持的 NTLMv2 会话安全。域控制器接受 LM、NTLM 和 NTLMv2 身份验证。%n%n4 (只发送 NTLMv2 响应/拒绝 LM) - 客户端只使用 NTLMv2 身份验证，并使用受服务器支持的 NTLMv2 会话安全。域控制器拒绝 LM 而只接受 NTLM 和 NTLMv2 身份验证。%n%n5 (只发送 NTLM v2 响应/拒绝 LM 和 NTLM) - 客户端只使用 NTLMv2 身份验证，并使用受服务器支持的 NTLMv2 会话安全。域控制器拒绝 LM 和 NTLM 而只接受 NTLMv2 身份验证。%n%n客户端和服务器之间配置不兼容的 LmCompatibility 级别(例如客户端上是 0 而服务器上是 5)会阻止访问服务器。非 Microsoft 客户端和服务器也提供这些配置设置。 |
LmCompatibilityLevel value is different from the default.%n%nConfigured LM Compatibility Level: %1%nDefault LM Compatibility Level: %2%n%nGuidance:%n%nLAN Manager (LM) authentication is the protocol used to authenticate Windows clients for network operations. This includes joining a domain, accessing network resources, and authenticating users or computers. This determines which challenge/response authentication protocol is negotiated between the client and the server computers. Specifically, the LM authentication level determines which authentication protocols the client will try to negotiate or the server will accept. The value set for LmCompatibilityLevel determines which challenge/response authentication protocol is used for network logons. This value affects the level of authentication protocol that clients use, the level of session security negotiated, and the level of authentication accepted by servers.%n%nValue (Setting) - Description%n%n0 (Send LM & NTLM responses) - Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n1 (Send LM & NTLM - use NTLMv2 session security if negotiated) - Clients use LM and NTLM authentication, and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n2 (Send NTLM response only) - Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n3 (Send NTLM v2 response only) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n4 (Send NTLMv2 response only/refuse LM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and accept only NTLM and NTLMv2 authentication.%n%n5 (Send NTLM v2 response only/refuse LM & NTLM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM and accept only NTLMv2 authentication.%n%nIncompatibly configured LmCompatibility levels between a client and server (such as 0 on a client and 5 on a server) prevent access to the server. Non-Microsoft clients and servers also provide these configuration settings. |
| 0xB00003FE | 文件和打印机共享防火墙规则已启用。%n%n指导:%n%n当 Windows 防火墙配置为启用文件和打印机共享规则，从而允许入站 SMB 流量时，可能会发生此事件。此事件会在配置了自定义共享的计算机上发生。 |
File and printer sharing firewall rule enabled.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that has custom shares configured. |
| 0xB00003FF | 此服务器存在的一个或多个共享已启用了基于存取的枚举。%n%n指南:%n%n如果使用服务器管理器或 Set-SmbShare Windows PowerShell cmdlet 在一个或多个共享上启用了基于存取的枚举，则可能会发生此事件。若客户端连接到共享，并且其文件夹包含用户无权访问的许多对等方级别的资源，则基于存取的枚举将提升 CPU 使用率。你可以通过在 Windows 注册表中配置 ABELevel 值来控制 CPU 使用率:%n%nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\ABELevel [DWORD]%n%n你可以将 ABELevel 的值设置为较大的深度，以最大程度减少 CPU 开销，但是这样做会降低基于存取的枚举的效率:%n%n值 = 0: 基于存取的枚举在所有级别上启用%n%nValue = 1: 基于存取的枚举在深度级别 1 启用(例如: \\server\\share)%n%n值 = 2: 基于存取的枚举在深度级别 2 启用(例如: \\server\\share\\folder)%n%n你可以继续设置值以对应多个深度级别。 |
One or more shares present on this server have access based enumeration enabled.%n%nGuidance:%n%nYou should expect this event when enabling access-based enumeration on one or more shares by using either Server Manager or the Set-SmbShare Windows PowerShell cmdlet. Access-based enumeration can raise CPU utilization when clients connect to shares with folders containing many peer-level resources to which a user does not have access. You can control the CPU utilization by configuring the ABELevel value in the Windows registry:%n%nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\ABELevel [DWORD]%n%nYou can set the value for ABELevel to greater depths to minimize CPU overhead, but doing so diminishes the effectiveness of access-based enumeration:%n%nValue = 0: access-based enumeration is enabled for all levels%n%nValue = 1: access-based enumeration is enabled for a depth of 1 (example: \\server\\share)%n%nValue = 2: access-based enumeration is enabled for a depth of 2 (example: \\server\\share\\folder)%n%nYou can continue setting values for multiple depth levels. |
| 0xB0000400 | 在此服务器上已禁用 SMB2 和 SMB3。这会导致功能和性能的降低。%n%n注册表项: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%n注册表值: Smb2%n默认值: 1 (或不存在)%n当前值: 0%n%n指导:%n%n在禁用 SMB2/SMB3 时，可能会发生此事件。Microsoft 不建议禁用 SMB2/SMB3。如果禁用 SMB3，则你将无法使用 SMB 透明故障转移、SMB 横向扩展、SMB 多通道、SMB 直通(RDMA)、SMB 加密、SMB 文件共享的 VSS 和 SMB 目录租赁等功能。在大多数情况下，SMB 提供一套故障排除解决方法，以作为禁用 SMB2/SMB3 的替代方案。使用 Set-SmbServerConfiguration Windows PowerShell cmdlet 以启用 SMB2/SMB3。 |
SMB2 and SMB3 have been disabled on this server. This results in reduced functionality and performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: Smb2%nDefault Value: 1 (or not present)%nCurrent Value: 0%n%nGuidance:%n%nYou should expect this event when disabling SMB2/SMB3. Microsoft does not recommend disabling SMB2/SMB3. When SMB3 is disabled, you cannot use features such as SMB Transparent Failover, SMB Scale Out, SMB Multichannel, SMB Direct (RDMA), SMB Encryption, VSS for SMB file shares, and SMB Directory Leasing. In most scenarios, SMB provides a troubleshooting workaround as an alternative to disabling SMB2/SMB3. Use the Set-SmbServerConfiguration Windows PowerShell cmdlet to enable SMB2/SMB3. |
| 0xB0000401 | 一个或多个命名管道或共享已被标记为可供匿名用户访问。这会允许未经身份验证的用户连接到此服务器，从而增加计算机的安全风险。%n%n注册表项: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%n注册表值: NullSessionPipes、NullSessionShares%n默认值: 空值(或不存在)%n当前值: 非空值%n%n指导:%n%n在修改 NullSessionShares 和 NullSessionPipes 的默认值时，可能会发生此事件。在一台典型的文件服务器上，这些设置并不存在或不包含任何值，这才是最安全的配置。默认情况下，域控制器会在 NullSessionShares 项中填入 netlogon、samr 和 lsarpc，以允许传统访问方法。 |
One or more named pipes or shares have been marked for access by anonymous users. This increases the security risk of the computer by allowing unauthenticated users to connect to this server.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Values: NullSessionPipes, NullSessionShares%nDefault Value: Empty (or not present)%nCurrent Value: Non-empty%n%nGuidance:%n%nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods. |
| 0xB0000402 | 已对 SMB2 和 SMB3 协议禁用文件租赁。这会减弱功能并降低性能。%n%n注册表项: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%n注册表值: DisableLeasing%n默认值: 0 (或不存在)%n当前值: 非零值%n%n指导:%n%n在禁用 SMB 3 租赁时，可能会发生此事件。Microsoft 不建议禁用 SMB 租赁。而一旦禁用，从客户端到服务器的流量就会增加，因为系统可能不会再从本地缓存中检索元数据和数据。 |
File leasing has been disabled for the SMB2 and SMB3 protocols. This reduces functionality and can decrease performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: DisableLeasing%nDefault Value: 0 (or not present)%nCurrent Value: non-zero%n%nGuidance:%n%nYou should expect this event when disabling SMB 3 Leasing. Microsoft does not recommend disabling SMB Leasing. Once disabled, traffic from client to server may increase since metadata and data may no longer be retrieved from a local cache. |
| 0xB0000403 | 文件和打印机共享防火墙端口当前处于关闭状态。这是没有共享内容或位于公用网络的系统的默认配置。%n%n指导:%n%n若 Windows 防火墙未配置为启用文件和打印机共享规则，从而允许入站 SMB 流量，则可能会发生此事件。此事件会在没有配置自定义共享的计算机上发生。客户端无法访问此计算机上的 SMB 共享，除非允许 SMB 流量通过防火墙。 |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. |
| 0xB0000404 | 群集支持的最大 SMB 方言已更改。%n%nNewMaxDialect: %1%nOldMaxDialect: %2%n%n指导:%n%n在 Windows 故障转移群集升级期间，可能会发生此事件。无需任何用户操作。 |
The maximum cluster-supported SMB dialect has changed.%n%nNewMaxDialect: %1%nOldMaxDialect: %2%n%nGuidance:%n%nYou should expect this event during a Windows Failover Cluster upgrade. No user action is required. |
| 0xB0000405 | 密码套件顺序组策略设置无效。%n%n指导:%n%n此事件表明管理员为“Computer Configuration\\Administrative Templates\\Network\\Lanman Server\\Cipher Suite Order”组策略设置配置了无效值。在解决此错误之前，服务器将使用默认的密码套件顺序“%1”。 |
The Cipher Suite Order group policy setting is invalid.%n%nGuidance:%n%nThis event indicates that an administrator has configured an invalid value for the \"Computer Configuration\\Administrative Templates\\Network\\Lanman Server\\Cipher Suite Order\" group policy setting. The server will use the default cipher suite order \"%1\" until this error is resolved. |
| 0xB0000406 | MDL 读取或写入完成请求失败。%n%n服务器名称: %2%n共享名称: %4%n文件名: %6%nIsRead: %7%n状态: %8%n%n指导:%n%n在缓冲 I/O 完成系统资源的释放后，SMB 服务器会向文件系统发送 MDL 完成请求。文件系统及其筛选器驱动程序不能让 MDL 完成请求失败。失败可能会导致内存泄漏以及系统性能和稳定性降低。非 Microsoft 文件系统筛选器驱动程序是导致 MDL 完成请求失败的最常见原因。 |
An MDL read or write completion request failed.%n%nServer Name: %2%nShare Name: %4%nFile Name: %6%nIsRead: %7%nStatus: %8%n%nGuidance:%n%nThe SMB server sends MDL completion requests to a file system upon completion of a buffered I/O to release system resources. The file system and its filter drivers must not fail MDL completion requests. Failures may result in memory leaks and degraded system performance and stability. Non-Microsoft file system filter drivers are the most common cause of failed MDL completion requests. |
| 0xB0000407 | 服务器检测到问题，并已捕获实时内核转储以收集调试信息。%n%n 原因: %1%n转储位置: %SystemRoot%\\LiveKernelReports%n%n指导:%n%n服务器支持实时转储功能，在检测到问题时会进行核心内存转储，但不会检查错误和重新启动。因此，Microsoft 支持人员无需重新启动或手动干预即可检查内存转储。原因代码指示已检测到的问题的类型。%n%n失速的 I/O%n%nI/O 将需要不合理的较长时间才能完成。运行不正常的第三方文件系统微筛选器驱动程序是此问题的常见源。其他原因包括磁盘出现故障或客户端驱动的 I/O 工作负荷大大超过服务器的容量。 |
The server detected a problem and has captured a live kernel dump to collect debug information.%n%nReason: %1%nDump Location: %SystemRoot%\\LiveKernelReports%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
| 0xB0000408 | 服务器检测到问题，但无法捕获实时内核转储以收集调试信息。%n%n原因: %1%n%n指导:%n%n 服务器支持实时转储功能，在检测到问题时会进行核心内存转储，但不会检查错误和重新启动。因此，Microsoft 支持人员无需重新启动或手动干预即可检查内存转储。原因代码指示已检测到的问题的类型。在这种情况下，服务器的创建实时内核转储的请求已被拒绝。这通常是由于阻止频繁转储占用太多磁盘空间的实时内核转储限制导致。可等待阻止限制过期(默认情况下为 7 天)，也可以与 Microsoft 支持人员联系以了解覆盖该限制的步骤。此事件写入日志的频率为每天不超过一次。导致服务器请求实时内核转储的问题可能会更频繁地发生。%n%n失速的 I/O%n%nI/O 将需要不合理的较长时间才能完成。运行不正常的第三方文件系统微筛选器驱动程序是此问题的常见源。其他原因包括磁盘出现故障或客户端驱动的 I/O 工作负荷大大超过服务器的容量。 |
The server detected a problem but was unable to capture a live kernel dump to collect debug information.%n%nReason: %1%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected. In this case, the server's request to create a live kernel dump was rejected. This is usually due to the live kernel dump throttle, which prevents frequent dumps from consuming too much disk space. Either wait for the throttle limit to expire (by default, 7 days), or contact Microsoft Support for steps to override the throttle. This event is written to the log no more than once per day. The problem that caused the server to the request a live kernel dump may be occuring more frequently.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
| 0xB0000409 | 已将 RDMA %1 事件发送到接口 %3 的 LanmanServer。 |
Sent RDMA %1 event to LanmanServer for interface %3. |
| 0xB000040A | 发送 RDMA 终结点通知失败 - %1 |
Send RDMA Endpoint notification failure - %1 |
| 0xB000040B | 接口 %2 的 RDMA 终结点 %4 为 %1。 |
RDMA Endpoint %4 for interface %2 was %1. |
| 0xB000040C | RDMA 终结点分配失败 - 接口 %1 的终结点分配失败。%2 |
RDMA Endpoint allocation failure - Endpoint allocation failed for interface %1. %2 |
| 0xB000040D | RDMA 侦听器创建失败 - %1 |
RDMA listener creation failure - %1 |
| 0xB000040E | RDMA 为设备 %3 发送终结点通知 RPC 失败 - %1 |
RDMA Send endpoint notification RPC failure for device %3 - %1 |
| 0xB000040F | 接口 %2 已收到 %1 类型的 Nsi 通知，并显示 NdkOperationalState %3 |
Received Nsi notification type %1 for interface %2 with NdkOperationalState %3 |
| 0xB0000410 | 接口 %2 已收到 %1 类型的 Mib 通知 |
Received Mib notification type %1 for interface %2 |
| 0xB0000411 | 从注册表中读取 FSCTL 属性信息时出错。将忽略注册表值项 %3。错误: %1 |
Error reading FSCTL properties information from the registry. Registry value entry %3 will be ignored. Error: %1 |
| 0xB0000708 | CA 失败 - 由于文件共享不是群集共享，因此无法在新文件共享或现有文件共享上设置连续可用的属性。 |
CA failure - Failed to set continuously available property on a new or existing file share as the file share is not a cluster share. |
| 0xB0000709 | CA 失败 - 由于恢复密钥筛选器未启动或无法连接到基础卷，无法在新文件共享或现有文件共享上设置连续可用的属性。 |
CA failure - Failed to set continuously available property on a new or existing file share as Resume Key filter is not started or has failed to attach to the underlying volume. |
| 0xB000070A | 服务器无法在群集注册表中保留下一个 ID 区域。 |
The server failed to reserve the next ID region in the cluster registry. |
| 0xB000070B | 安全描述符与默认值不同。%n%n路径: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity\\%1%n%n指导:%n%n这通常是由于管理员或第三方手动更改对象的安全性而导致的。若要将安全性重置回默认值，请删除上面所示的路径。%nMicrosoft 建议不要更改 %1 的默认安全性，因为它可能会导致应用程序不兼容或安全问题。 |
The security descriptor differs from the default value.%n%nPath: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity\\%1%n%nGuidance:%n%nThis is typically caused by an administrator or a third party changing the security on the object manually. To reset the security back to the default value, delete the path shown above.%nMicrosoft does not recommend changing the default security of %1 as it may cause application incompatibilities or security concerns. |
| 0xB00007D0 | 数据包碎片(%2 个字节) |
Packet Fragment (%2 bytes) |
| 0xB0000BB8 | SMB1 访问%n%n客户端地址: %1%n%n指导:%n%n此事件表明客户端尝试使用 SMB1 访问服务器。若要停止审核 SMB1 访问，请使用 Windows PowerShell cmdlet Set-SmbServerConfiguration。 |
SMB1 access%n%nClient Address: %1%n%nGuidance:%n%nThis event indicates that a client attempted to access the server using SMB1. To stop auditing SMB1 access, use the Windows PowerShell cmdlet Set-SmbServerConfiguration. |
| 0xB0009C40 | 数据包(%4 个字节) |
Packet (%4 bytes) |
| 0xB0010227 | SMB 会话身份验证失败%n%n客户端名称: %11%n客户端地址: %6%n用户名: %9%n会话 ID: %7%n状态: %4 (%3)%n%n指导:%n%n在尝试使用错误凭据连接到共享时，可能会发生此错误。%n%n此错误并不总是表示授权存在问题，而主要是与身份验证有关。非 Windows 客户端更容易出现这类问题。%n%n在使用了错误的 NTLM 用户名和密码、客户端和服务器之间不匹配的 LmCompatibility 设置、重复的 Kerberos 服务主体名称、错误的 Kerberos 票证授予服务票证、或未启用来宾访问权限的来宾帐户等情况下，会出现此错误。 |
SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
| 0xB00103E9 | 客户端尝试使用 SMB1 访问服务器并已被拒绝，因为已禁用或卸载了 SMB1 文件共享支持。%n%n指导:%n%n管理员已禁用或卸载了 SMB1 的服务器支持。运行 Windows XP / Windows Server 2003 R2 和更低版本的客户端将无法访问此服务器。运行 Windows Vista / Windows Server 2008 和更高版本的客户端不再需要 SMB1。若要确定哪些客户端正在尝试使用 SMB1 访问此服务器，请使用 Windows PowerShell cmdlet Set-SmbServerConfiguration 来启用 SMB1 访问审核。 |
A client attempted to access the server using SMB1 and was rejected because SMB1 file sharing support is disabled or has been uninstalled.%n%nGuidance:%n%nAn administrator has disabled or uninstalled server support for SMB1. Clients running Windows XP / Windows Server 2003 R2 and earlier will not be able to access this server. Clients running Windows Vista / Windows Server 2008 and later no longer require SMB1. To determine which clients are attempting to access this server using SMB1, use the Windows PowerShell cmdlet Set-SmbServerConfiguration to enable SMB1 access auditing. |
| 0xB00103EB | 在需要加密的情况下，服务器收到来自客户端的未加密消息。消息被拒绝。%n%n客户端名称: %4%n客户端地址: %8%n用户名: %6%n会话 ID: %9%n共享名称: %2%n%n指导:%n%n此事件表示即使在 SMB 共享需要加密的情况下，客户端仍在发送未加密的数据。 |
The server received an unencrypted message from client when encryption was required. Message was rejected.%n%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%nShare Name: %2%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
| 0xB00103EC | 服务器拒绝了一个签名错误的消息。%n%n客户端名称: %2%n客户端地址: %6%n用户名: %4%n会话 ID: %7%n%n指导:%n%n此事件表示客户端正在发送一个签名错误的请求。 |
The server rejected an incorrectly signed message.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %7%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
| 0xB00103ED | 服务器拒绝了一个无效的协商请求。连接已终止。%n%n客户端名称: %2%n客户端地址: %6%n用户名: %4%n会话 ID: %13%n预期的方言: %7%n预期的功能: %8%n预期的安全模式: %9%n收到的方言: %10%n收到的功能: %11%n收到的安全模式: %12%n%n指导:%n%n此事件表示客户端正在尝试使用不匹配的方言或功能协商第二次连接。 |
The server rejected an invalid negotiation request. Connection was terminated.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %13%nExpected Dialect: %7%nExpected Capabilities: %8%nExpected Security Mode: %9%nReceived Dialect: %10%nReceived Capabilities: %11%nReceived Security Mode: %12%n%nGuidance:%n%nThis event indicates that a client is attempting to negotiate a second connection using a mismatched dialect or capabilities. |
| 0xB0020001 | SMB2 请求协商 |
SMB2 Request Negotiate |
| 0xB0020002 | SMB2 请求会话设置 |
SMB2 Request Session Setup |
| 0xB0020003 | SMB2 请求注销 |
SMB2 Request Logoff |
| 0xB0020004 | SMB2 请求树连接 |
SMB2 Request Tree Connect |
| 0xB0020005 | SMB2 请求树断开连接 |
SMB2 Request Tree Disconnect |
| 0xB0020006 | SMB2 请求回显 |
SMB2 Request Echo |
| 0xB0020007 | SMB2 请求取消 |
SMB2 Request Cancel |
| 0xB0020008 | SMB2 请求创建 |
SMB2 Request Create |
| 0xB0020009 | SMB2 请求关闭 |
SMB2 Request Close |
| 0xB002000A | SMB2 请求刷新 |
SMB2 Request Flush |
| 0xB002000B | SMB2 请求读取 |
SMB2 Request Read |
| 0xB002000C | SMB2 请求写入 |
SMB2 Request Write |
| 0xB002000D | SMB2 请求中断操作锁定 |
SMB2 Request Break Oplock |
| 0xB002000E | SMB2 请求通知中断租约 |
SMB2 Request Notify Break Lease |
| 0xB002000F | SMB2 请求确认中断租约 |
SMB2 Request Acknowledge Break Lease |
| 0xB0020010 | SMB2 请求锁定 |
SMB2 Request Lock |
| 0xB0020011 | SMB2 请求 IOCTL |
SMB2 Request Ioctl |
| 0xB0020012 | SMB2 请求查询目录 |
SMB2 Request Query Directory |
| 0xB0020013 | SMB2 请求更改通知 |
SMB2 Request Change Notify |
| 0xB0020014 | SMB2 请求查询信息 |
SMB2 Request Query Info |
| 0xB0020015 | SMB2 请求设置信息 |
SMB2 Request Set Info |
| 0xB0020065 | SMB2 响应协商 |
SMB2 Response Negotiate |
| 0xB0020066 | SMB2 响应会话设置 |
SMB2 Response Session Setup |
| 0xB0020067 | SMB2 响应注销 |
SMB2 Response Logoff |
| 0xB0020068 | SMB2 响应树连接 |
SMB2 Response Tree Connect |
| 0xB0020069 | SMB2 响应树断开连接 |
SMB2 Response Tree Disconnect |
| 0xB002006A | SMB2 响应回显 |
SMB2 Response Echo |
| 0xB002006C | SMB2 响应创建 |
SMB2 Response Create |
| 0xB002006D | SMB2 响应关闭 |
SMB2 Response Close |
| 0xB002006E | SMB2 响应刷新 |
SMB2 Response Flush |
| 0xB002006F | SMB2 响应读取 |
SMB2 Response Read |
| 0xB0020070 | SMB2 响应写入 |
SMB2 Response Write |
| 0xB0020071 | SMB2 响应中断操作锁定 |
SMB2 Response Break Oplock |
| 0xB0020073 | SMB2 响应确认中断租约 |
SMB2 Response Acknowledge Break Lease |
| 0xB0020074 | SMB2 响应锁定 |
SMB2 Response Lock |
| 0xB0020075 | SMB2 响应 IOCTL |
SMB2 Response Ioctl |
| 0xB0020076 | SMB2 响应查询目录 |
SMB2 Response Query Directory |
| 0xB0020077 | Smb2 响应更改通知 |
SMB2 Response Change Notify |
| 0xB0020078 | SMB2 响应查询信息 |
SMB2 Response Query Info |
| 0xB0020079 | SMB2 响应设置信息 |
SMB2 Response Set Info |
| 0xB002007A | SMB2 响应错误 |
SMB2 Response Error |
| 0xB0020227 | SMB 会话身份验证失败%n%n客户端名称: %11%n客户端地址: %6%n用户名: %9%n会话 ID: %7%n状态: %4 (%3)%nSPN: %12%nSPN 验证策略: %13%n%n指导:%n%n当你尝试使用不正确的凭据连接到共享时，会出现此错误。%n%n此错误并不总是指示授权有问题，而主要是身份验证有问题。此错误在非 Windows 客户端上更常见。%n%n在以下情况下会出现此错误: 对 NTLM 使用不正确的用户名和密码、客户端和服务器之间的 LmCompatibility 设置不匹配、服务主体名称不正确、Kerberos 服务主体名称重复、Kerberos 票证授予服务票证不正确、来宾帐户未启用来宾访问权限 |
SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%nSPN: %12%nSPN Validation Policy: %13%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, an incorrect service principal name, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
| 0xB00203ED | 协商完整性检查失败。%n%n状态: %2%n客户端名称: %4%n客户端地址: %8%n用户名: %6%n会话 ID: %9%n%n指导:%n%n此事件表明客户端的协商请求由于错误或“中间人”攻击已在客户端与服务器之间的网络上更改。客户端已断开连接以防止安全性降低。 |
Negotiate integrity check failed.%n%nStatus: %2%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%n%nGuidance:%n%nThis event indicates that the client's negotiate request was altered on the network between the client and server due to errors or a \"man-in-the-middle\" attack. The client has been disconnected to prevent a security downgrade. |
| 0xD0000001 | SPN optional / no validation |
SPN optional / no validation |
| 0xD0000002 | SPN optional / validate service name |
SPN optional / validate service name |
| 0xD0000003 | SPN optional / validate full |
SPN optional / validate full |
| 0xD0000004 | 需要 SPN/验证服务名称 |
SPN required / validate service name |
| 0xD0000005 | 需要 SPN/验证完整 |
SPN required / validate full |
| 0xD0000006 | 已停止 I/O |
Stalled I/O |
| 0xD0000007 | Tdi |
Tdi |
| 0xD0000008 | Wsk |
Wsk |
| 0xD0000009 | Rdma |
Rdma |
| 0xD000000A | 添加 |
Add |
| 0xD000000B | 更新 |
Update |
| 0xD000000C | Remove |
Remove |
| 0xD000000D | None |
None |
| 0xD000000E | Reconnect durable file |
Reconnect durable file |
| 0xD000000F | RKF resume create |
RKF resume create |
| 0xD0000010 | Build create response |
Build create response |
| 0xD0000011 | N/A |
N/A |
| 0xD0000012 | 2.0.2 |
2.0.2 |
| 0xD0000013 | 2.1 |
2.1 |
| 0xD0000014 | 3.0 |
3.0 |
| 0xD0000015 | 3.0.2 |
3.0.2 |
| 0xD0000016 | 3.1.1 |
3.1.1 |
| 0xD0000017 | 已关闭 |
closed |
| 0xD0000018 | 已创建 |
created |
| 0xD0000019 | 已禁用 |
disabled |
| 0xD000001A | 已启用 |
enabled |
| 0xD000001B | 获取接口 %2 的单播 IP 地址表时出错。%3 |
Error getting unicast ip address table for interface %2. %3 |
| 0xD000001C | 获取接口 %2 的单播 IP 地址条目时出错。%3 |
Error getting unicast ip address entry for interface %2. %3 |
| 0xD000001D | 查找或添加接口 %2 时出错。 |
Error finding or adding the interface %2. |
| 0xD000001E | DadState 与接口 %2 的 IpDadStatePreferred 不同。当前 DadState: %6。 |
DadState is different from IpDadStatePreferred for interface %2. Current DadState: %6. |
| 0xD000001F | 获取接口 %2 的 Nsi 参数时出错。%3 |
Error getting Nsi parameters for interface %2. %3 |
| 0xD0000020 | 分配池内存时出错 |
Error allocating pool memory |
| 0xD0000021 | 更新设备 %5 的传输列表时出错。%3。 |
Error updating transport list for device %5. %3. |
| 0xD0000022 | 分配和获取表时出错。%3。 |
Error allocating and getting table. %3. |
| 0xD0000023 | 不支持通知类型 %6。未执行任何操作。 |
Notification type %6 is not supported. Nothing was done. |
| 0xD0000024 | 从接口 %2 的 TransportName 获取地址时出错。%3 |
Error getting Address from TransportName for interface %2. %3 |
| 0xD0000025 | 查找接口 %2 的地址时出错。%3 |
Error finding the address of the interface %2. %3 |
| 0xD0000026 | 因接口 %2 不支持 SMB 直通而出错。%3 |
Error because SMB Direct is not supported in interface %2. %3 |
| 0xD0000027 | 在接口 %2 中初始化 SMB 时出错。%3 |
Error initializing SMB in interface %2. %3 |
| 0xD0000028 | 初始化异步句柄时出错。%4 |
Error initilizing the async handle. %4 |
| 0xD0000029 | XsActSrv 未处于活动状态。 |
XsActSrv is not active. |
| 0xD000002A | Pnp 异常。%4 |
Pnp exception. %4 |
| 0xD000002B | 完成 pnp 操作时超时。%4 |
Timeout on comleting pnp operation. %4 |
| 0xD000002C | Pnp 操作所花时间太长，且从来没有完成过，因此必须取消。%4 |
Pnp operation took too long and it was never completed so it must be cancelled. %4 |
| 0xD000002D | 取消 Pnp 操作时出错。%4 |
Error cancelling Pnp opearion. %4 |
| 0xD000002E | NsiParameterNotification |
NsiParameterNotification |
| 0xD000002F | NsiAddInstance |
NsiAddInstance |
| 0xD0000030 | NsiDeleteInstance |
NsiDeleteInstance |
| 0xD0000031 | NsiInitialNotification |
NsiInitialNotification |
| 0xD0000032 | MibParameterNotification |
MibParameterNotification |
| 0xD0000033 | MibAddInstance |
MibAddInstance |
| 0xD0000034 | MibDeleteInstance |
MibDeleteInstance |
| 0xD0000035 | MibInitialNotification |
MibInitialNotification |
| 0xD0000036 | 注册表值为某个 FSCTL 定义了属性，但该 FSCTL 已在另一个注册表值中定义。 |
Registry value defines properties for an FSCTL that has already been defined in another registry value. |
| 0xD0000037 | 指定 FSCTL 属性的注册表值还必须指定非零 FSCTL 代码。 |
Registry value specifying FSCTL properties must also specify a non-zero FSCTL code. |
| 0xD0000038 | 指定 FSCTL 属性的注册表值采用了错误的格式。 |
Registry value specifying FSCTL properties have the wrong format. |