| 1 | SMB Server Shares |
SMB Server Shares |
| 3 | This counter set displays information about SMB server shares that are shared using SMB protocol version 2 or higher. |
This counter set displays information about SMB server shares that are shared using SMB protocol version 2 or higher. |
| 9 | Received Bytes/sec |
Received Bytes/sec |
| 11 | The rate at which bytes are being received for requests related to this share. This value includes application data as well as SMB protocol data (such as packet headers). |
The rate at which bytes are being received for requests related to this share. This value includes application data as well as SMB protocol data (such as packet headers). |
| 17 | Requests/sec |
Requests/sec |
| 19 | The rate at which requests are being received for this share |
The rate at which requests are being received for this share |
| 21 | Tree Connect Count |
Tree Connect Count |
| 23 | The current number of tree connects to this share |
The current number of tree connects to this share |
| 25 | Current Open File Count |
Current Open File Count |
| 27 | The number of file handles that are currently open in this share |
The number of file handles that are currently open in this share |
| 1005 | The rate, in seconds, at which bytes are being sent from the SMB File Server related to this share to its clients. This value includes both data bytes and protocol bytes. |
The rate, in seconds, at which bytes are being sent from the SMB File Server related to this share to its clients. This value includes both data bytes and protocol bytes. |
| 1007 | Sent Bytes/sec |
Sent Bytes/sec |
| 1013 | The sum of Sent Bytes/sec and Received Bytes/sec for this share. |
The sum of Sent Bytes/sec and Received Bytes/sec for this share. |
| 1015 | Transferred Bytes/sec |
Transferred Bytes/sec |
| 1017 | The number of requests related to this share that are waiting to be processed by the SMB File Server. |
The number of requests related to this share that are waiting to be processed by the SMB File Server. |
| 1019 | Current Pending Requests |
Current Pending Requests |
| 1025 | The average number of seconds that elapse between the time at which the SMB File Server receives a request for this share and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which the SMB File Server receives a request for this share and the time at which the SMB File Server sends the corresponding response. |
| 1027 | Avg. sec/Request |
Avg. sec/Request |
| 1033 | Write requests processed/sec related to this share. |
Write requests processed/sec related to this share. |
| 1035 | Write Requests/sec |
Write Requests/sec |
| 1037 | The average number of seconds that elapse between the time at which a write request to this share is received and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which a write request to this share is received and the time at which the SMB File Server sends the corresponding response. |
| 1039 | Avg. sec/Write |
Avg. sec/Write |
| 1045 | The rate, in seconds, at which data is being written to this share. |
The rate, in seconds, at which data is being written to this share. |
| 1047 | Write Bytes/sec |
Write Bytes/sec |
| 1053 | Read requests processed/sec related to this share. |
Read requests processed/sec related to this share. |
| 1055 | Read Requests/sec |
Read Requests/sec |
| 1057 | The average number of seconds that elapse between the time at which a read request to this share is received and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which a read request to this share is received and the time at which the SMB File Server sends the corresponding response. |
| 1059 | Avg. sec/Read |
Avg. sec/Read |
| 1065 | The rate, in seconds, at which data is being read from this share. |
The rate, in seconds, at which data is being read from this share. |
| 1067 | Read Bytes/sec |
Read Bytes/sec |
| 1069 | The number of files that have been opened by the SMB File Server on behalf of its clients on this share since the server started. |
The number of files that have been opened by the SMB File Server on behalf of its clients on this share since the server started. |
| 1071 | Total File Open Count |
Total File Open Count |
| 1073 | The rate, in seconds, at which files are being opened for the SMB File Server’s clients on this share. |
The rate, in seconds, at which files are being opened for the SMB File Server’s clients on this share. |
| 1075 | Files Opened/sec |
Files Opened/sec |
| 1077 | The number of durable file handles that are currently open on this share |
The number of durable file handles that are currently open on this share |
| 1079 | Current Durable Open File Count |
Current Durable Open File Count |
| 1081 | The number of durable opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of durable opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 1083 | Total Durable Handle Reopen Count |
Total Durable Handle Reopen Count |
| 1085 | The number of durable opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of durable opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 1087 | Total Failed Durable Handle Reopen Count |
Total Failed Durable Handle Reopen Count |
| 1089 | The percentage of total opens for which clients requested resiliency. |
The percentage of total opens for which clients requested resiliency. |
| 1091 | % Resilient Handles |
% Resilient Handles |
| 1093 | The number of resilient opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of resilient opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 1095 | Total Resilient Handle Reopen Count |
Total Resilient Handle Reopen Count |
| 1097 | The number of resilient opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of resilient opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 1099 | Total Failed Resilient Handle Reopen Count |
Total Failed Resilient Handle Reopen Count |
| 1101 | The percentage of total handles for which clients requested persistency. |
The percentage of total handles for which clients requested persistency. |
| 1103 | % Persistent Handles |
% Persistent Handles |
| 1105 | The number of persistent opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of persistent opens on this share that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 1107 | Total Persistent Handle Reopen Count |
Total Persistent Handle Reopen Count |
| 1109 | The number of persistent opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of persistent opens on this share that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 1111 | Total Failed Persistent Handle Reopen Count |
Total Failed Persistent Handle Reopen Count |
| 1117 | The rate, in seconds, at which metadata requests are being sent to this share. |
The rate, in seconds, at which metadata requests are being sent to this share. |
| 1119 | Metadata Requests/sec |
Metadata Requests/sec |
| 1121 | The average number of seconds that elapse between the time at which a read or write request to this share is received and the time at which the SMB File Server processes the request. |
The average number of seconds that elapse between the time at which a read or write request to this share is received and the time at which the SMB File Server processes the request. |
| 1123 | Avg. sec/Data Request |
Avg. sec/Data Request |
| 1125 | The average number of bytes per read or write request. |
The average number of bytes per read or write request. |
| 1127 | Avg. Data Bytes/Request |
Avg. Data Bytes/Request |
| 1129 | The average number of bytes per read request. |
The average number of bytes per read request. |
| 1131 | Avg. Bytes/Read |
Avg. Bytes/Read |
| 1133 | The average number of bytes per write request. |
The average number of bytes per write request. |
| 1135 | Avg. Bytes/Write |
Avg. Bytes/Write |
| 1137 | The average number of read requests that were queued for this share. |
The average number of read requests that were queued for this share. |
| 1139 | Avg. Read Queue Length |
Avg. Read Queue Length |
| 1141 | The average number of write requests that were queued for this share. |
The average number of write requests that were queued for this share. |
| 1143 | Avg. Write Queue Length |
Avg. Write Queue Length |
| 1145 | The average number of read and write requests that were queued for this share. |
The average number of read and write requests that were queued for this share. |
| 1147 | Avg. Data Queue Length |
Avg. Data Queue Length |
| 1149 | The rate, in seconds, at which data is being written to or read from this share. |
The rate, in seconds, at which data is being written to or read from this share. |
| 1151 | Data Bytes/sec |
Data Bytes/sec |
| 1153 | The rate, in seconds, at which read or write requests are received for this share. |
The rate, in seconds, at which read or write requests are received for this share. |
| 1155 | Data Requests/sec |
Data Requests/sec |
| 1157 | The current number of read or write requests outstanding on this share. |
The current number of read or write requests outstanding on this share. |
| 1159 | Current Data Queue Length |
Current Data Queue Length |
| 2001 | This counter set displays information about SMB server sessions using SMB protocol version 2 or higher |
This counter set displays information about SMB server sessions using SMB protocol version 2 or higher |
| 2003 | SMB Server Sessions |
SMB Server Sessions |
| 2009 | The rate at which bytes are being received for requests in this session. This value includes application data as well as SMB protocol data (such as packet headers). |
The rate at which bytes are being received for requests in this session. This value includes application data as well as SMB protocol data (such as packet headers). |
| 2017 | The rate at which requests are being received in this session |
The rate at which requests are being received in this session |
| 2021 | The number of tree connects in this session |
The number of tree connects in this session |
| 2025 | The number of file handles that are currently open in this session |
The number of file handles that are currently open in this session |
| 2033 | The rate, in seconds, at which bytes are being sent from the SMB File Server in this session to the client. This value includes both data bytes and protocol bytes. |
The rate, in seconds, at which bytes are being sent from the SMB File Server in this session to the client. This value includes both data bytes and protocol bytes. |
| 2041 | The sum of Sent Bytes/sec and Received Bytes/sec for this session. |
The sum of Sent Bytes/sec and Received Bytes/sec for this session. |
| 2045 | The number of requests in this session that are waiting to be processed by the SMB File Server. |
The number of requests in this session that are waiting to be processed by the SMB File Server. |
| 2053 | The average number of seconds that elapse between the time at which the SMB File Server receives a request in this session and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which the SMB File Server receives a request in this session and the time at which the SMB File Server sends the corresponding response. |
| 2061 | Write requests processed/sec in this session. |
Write requests processed/sec in this session. |
| 2065 | The average number of seconds that elapse between the time at which a write request in this session is received and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which a write request in this session is received and the time at which the SMB File Server sends the corresponding response. |
| 2073 | The rate, in seconds, at which data is being written in this session. |
The rate, in seconds, at which data is being written in this session. |
| 2083 | Read requests processed/sec in this session. |
Read requests processed/sec in this session. |
| 2087 | The average number of seconds that elapse between the time at which a read request in this session is received and the time at which the SMB File Server sends the corresponding response. |
The average number of seconds that elapse between the time at which a read request in this session is received and the time at which the SMB File Server sends the corresponding response. |
| 2095 | The rate, in seconds, at which data is being read in this session. |
The rate, in seconds, at which data is being read in this session. |
| 2099 | The number of files that have been opened by the SMB File Server on behalf of its clients in this session since the server started. |
The number of files that have been opened by the SMB File Server on behalf of its clients in this session since the server started. |
| 2103 | The rate, in seconds, at which files are being opened in this session. |
The rate, in seconds, at which files are being opened in this session. |
| 2107 | The number of durable file handles that are currently open in this session |
The number of durable file handles that are currently open in this session |
| 2111 | The number of durable opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of durable opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 2115 | The number of durable opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of durable opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 2123 | The number of resilient opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of resilient opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 2127 | The number of resilient opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of resilient opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 2131 | The percentage of total opens for which clients requested persistency. |
The percentage of total opens for which clients requested persistency. |
| 2135 | The number of persistent opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
The number of persistent opens in this session that have been recovered after a temporary network disconnect since the SMB File Server started. |
| 2139 | The number of persistent opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
The number of persistent opens in this session that could not be recovered after a temporary network disconnect since the SMB File Server Started. |
| 2147 | The rate, in seconds, at which metadata requests are being sent in this session. |
The rate, in seconds, at which metadata requests are being sent in this session. |
| 2151 | The average number of seconds that elapse between the time at which a read or write request to this session is received and the time at which the SMB File Server processes the request. |
The average number of seconds that elapse between the time at which a read or write request to this session is received and the time at which the SMB File Server processes the request. |
| 2167 | The average number of read requests that were queued in this session. |
The average number of read requests that were queued in this session. |
| 2171 | The average number of write requests that were queued in this session. |
The average number of write requests that were queued in this session. |
| 2175 | The average number of read and write requests that were queued in this session. |
The average number of read and write requests that were queued in this session. |
| 2179 | The rate, in seconds, at which data is being written or read in this session. |
The rate, in seconds, at which data is being written or read in this session. |
| 2183 | The rate, in seconds, at which read or write requests are received in this session. |
The rate, in seconds, at which read or write requests are received in this session. |
| 2187 | The current number of read or write requests outstanding in this session. |
The current number of read or write requests outstanding in this session. |
| 3001 | The SMB Server performance counters measure file server activity for SMB protocol versions 2 and higher |
The SMB Server performance counters measure file server activity for SMB protocol versions 2 and higher |
| 3003 | SMB Server |
SMB Server |
| 3005 | Read Bytes/sec is the rate at which data is being read to satisfy SMB read requests. |
Read Bytes/sec is the rate at which data is being read to satisfy SMB read requests. |
| 3009 | Read Requests/sec is the rate at which SMB read requests are being received. |
Read Requests/sec is the rate at which SMB read requests are being received. |
| 3013 | Write Bytes/sec is the rate at which data is being written to satisfy SMB write requests. |
Write Bytes/sec is the rate at which data is being written to satisfy SMB write requests. |
| 3017 | Write Requests/sec is the rate at which SMB write requests are being received. |
Write Requests/sec is the rate at which SMB write requests are being received. |
| 3021 | Send Bytes/sec is the rate at which data is being transmitted on the network. This value includes application data as well as SMB protocol data (such as packet headers). |
Send Bytes/sec is the rate at which data is being transmitted on the network. This value includes application data as well as SMB protocol data (such as packet headers). |
| 3023 | Send Bytes/sec |
Send Bytes/sec |
| 3025 | Receive Bytes/sec is the rate at which data is being received from the network. This value includes application data as well as SMB protocol data (such as packet headers). |
Receive Bytes/sec is the rate at which data is being received from the network. This value includes application data as well as SMB protocol data (such as packet headers). |
| 3027 | Receive Bytes/sec |
Receive Bytes/sec |
| 0x10000035 | Audit Failure |
Audit Failure |
| 0x30000000 | Info |
Info |
| 0x30000001 | Start |
Start |
| 0x30000002 | Stop |
Stop |
| 0x30000009 | Send |
Send |
| 0x50000002 | Error |
Error |
| 0x50000003 | Warning |
Warning |
| 0x50000004 | Information |
Information |
| 0x90000001 | Microsoft-Windows-SMBServer/Performance |
Microsoft-Windows-SMBServer/Performance |
| 0x90000002 | Microsoft-Windows-SMBServer/Analytic |
Microsoft-Windows-SMBServer/Analytic |
| 0x90000003 | Microsoft-Windows-SMBServer/Operational |
Microsoft-Windows-SMBServer/Operational |
| 0x90000004 | Microsoft-Windows-SMBServer/Diagnostic |
Microsoft-Windows-SMBServer/Diagnostic |
| 0x90000005 | Microsoft-Windows-SMBServer/Security |
Microsoft-Windows-SMBServer/Security |
| 0x90000006 | Microsoft-Windows-SMBServer/Connectivity |
Microsoft-Windows-SMBServer/Connectivity |
| 0x90000007 | Microsoft-Windows-SMBServer/Audit |
Microsoft-Windows-SMBServer/Audit |
| 0xB00000C8 | SMB2 Work Item Component Transition |
SMB2 Work Item Component Transition |
| 0xB00000C9 | SMB2 Work Item allocated |
SMB2 Work Item allocated |
| 0xB00000CA | SMB2 Work Item released |
SMB2 Work Item released |
| 0xB00000CB | SMB2 Work Item activity id transfer |
SMB2 Work Item activity id transfer |
| 0xB00000CC | SMB2 Work Item external activity id stop |
SMB2 Work Item external activity id stop |
| 0xB00001F4 | SMB2 Connection accepted |
SMB2 Connection accepted |
| 0xB00001F5 | SMB2 Connection Disconnected by Peer |
SMB2 Connection Disconnected by Peer |
| 0xB00001F6 | SMB2 Connection Terminated |
SMB2 Connection Terminated |
| 0xB0000226 | SMB2 Session Allocated |
SMB2 Session Allocated |
| 0xB0000227 | Smb Session Authentication Failure |
Smb Session Authentication Failure |
| 0xB0000228 | SMB2 Session Authentication Success |
SMB2 Session Authentication Success |
| 0xB0000229 | SMB2 Session Bound to Connection |
SMB2 Session Bound to Connection |
| 0xB000022A | SMB2 Session Terminated |
SMB2 Session Terminated |
| 0xB0000258 | SMB2 TreeConnect Allocated |
SMB2 TreeConnect Allocated |
| 0xB0000259 | SMB2 TreeConnect Disconnected |
SMB2 TreeConnect Disconnected |
| 0xB000025A | SMB2 TreeConnect Terminated |
SMB2 TreeConnect Terminated |
| 0xB000025B | SMB2 TreeConnect Failed due to Cluster Endpoint Initializing |
SMB2 TreeConnect Failed due to Cluster Endpoint Initializing |
| 0xB000028A | SMB2 Open established |
SMB2 Open established |
| 0xB000028B | SMB2 Open Disconnected - Preserved |
SMB2 Open Disconnected - Preserved |
| 0xB000028C | SMB2 Open Reconnected |
SMB2 Open Reconnected |
| 0xB000028D | SMB2 Open Suspended - Preserved |
SMB2 Open Suspended - Preserved |
| 0xB000028E | SMB2 Open Closed |
SMB2 Open Closed |
| 0xB000028F | SMB2 Open Timed Out |
SMB2 Open Timed Out |
| 0xB0000290 | SMB2 Open Terminated |
SMB2 Open Terminated |
| 0xB0000291 | SMB2 Open Clustered Client Failover Closed |
SMB2 Open Clustered Client Failover Closed |
| 0xB0000292 | File handle for file \"%8\\%2\" was invalidated by user %4 from computer %6 |
File handle for file \"%8\\%2\" was invalidated by user %4 from computer %6 |
| 0xB00002BC | SMB2 Share Added |
SMB2 Share Added |
| 0xB00002BD | SMB2 Share Modified |
SMB2 Share Modified |
| 0xB00002BE | SMB2 Share Deleted |
SMB2 Share Deleted |
| 0xB00003E8 | S4U2Self authentication failure - The client could not be reauthenticated with S4U2Self to obtain claims. This may be expected if the account is not a domain account. |
S4U2Self authentication failure - The client could not be reauthenticated with S4U2Self to obtain claims. This may be expected if the account is not a domain account. |
| 0xB00003E9 | SRV Disabled - The SMB1 negotiate request fails due to SMB1 is disabled. |
SRV Disabled - The SMB1 negotiate request fails due to SMB1 is disabled. |
| 0xB00003EA | RKF failure - SRV2 failed to get acknowledgement from Resume Key filter for persistent handle request. |
RKF failure - SRV2 failed to get acknowledgement from Resume Key filter for persistent handle request. |
| 0xB00003EB | The server received an unencrypted message from client %4. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
The server received an unencrypted message from client %4. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
| 0xB00003EC | The server received an incorrectly signed message from client %2. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
The server received an incorrectly signed message from client %2. Message was rejected.%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
| 0xB00003ED | The server failed to validate negotiation from client %2. Connection was terminated. |
The server failed to validate negotiation from client %2. Connection was terminated. |
| 0xB00003EE | The share denied access to the client.%n%nClient Name: %10%nClient Address: %6%nUser Name: %8%nSession ID: %17%nShare Name: %2%nShare Path: %4%nStatus: %16 (%15)%nMapped Access: %11%nGranted Access: %12%nSecurity Descriptor: %14%n%nGuidance:%n%nYou should expect access denied errors when a principal accesses a share without the necessary permissions. Usually, this indicates that the principal does not have direct security permissions or lacks membership in a group that has direct access permissions. To determine and correct the permissions on the specified share, an administrator can use the Security tab in File Explorer Properties dialog, the SMBSHARE Windows PowerShell module, or the NET SHARE command. You can also use the Effective Access tab in File Explorer to help diagnose the issue.%n%nApplications may generate access denied errors if they attempt to open files in a writable mode first, and then reopen the files in a read-only mode. In this case, no user action is required.%n%nIf access to the share is denied and this event is not logged, you can examine the file and folder NTFS/REFS permissions.%n%nThis error does not indicate a problem with authentication, only authorization. |
The share denied access to the client.%n%nClient Name: %10%nClient Address: %6%nUser Name: %8%nSession ID: %17%nShare Name: %2%nShare Path: %4%nStatus: %16 (%15)%nMapped Access: %11%nGranted Access: %12%nSecurity Descriptor: %14%n%nGuidance:%n%nYou should expect access denied errors when a principal accesses a share without the necessary permissions. Usually, this indicates that the principal does not have direct security permissions or lacks membership in a group that has direct access permissions. To determine and correct the permissions on the specified share, an administrator can use the Security tab in File Explorer Properties dialog, the SMBSHARE Windows PowerShell module, or the NET SHARE command. You can also use the Effective Access tab in File Explorer to help diagnose the issue.%n%nApplications may generate access denied errors if they attempt to open files in a writable mode first, and then reopen the files in a read-only mode. In this case, no user action is required.%n%nIf access to the share is denied and this event is not logged, you can examine the file and folder NTFS/REFS permissions.%n%nThis error does not indicate a problem with authentication, only authorization. |
| 0xB00003EF | The share denied anonymous access to the client.%n%nClient Name: %8%nClient Address: %6%nShare Name: %2%nShare Path: %4%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, anonymous access to shares is denied.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
The share denied anonymous access to the client.%n%nClient Name: %8%nClient Address: %6%nShare Name: %2%nShare Path: %4%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, anonymous access to shares is denied.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
| 0xB00003F1 | The server denied anonymous access to the client.%n%nClient Name: %4%n Client Address: %2%nSession ID: %5%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, Windows Server denies anonymous access to shares.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
The server denied anonymous access to the client.%n%nClient Name: %4%n Client Address: %2%nSession ID: %5%n%nGuidance:%n%nYou should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, Windows Server denies anonymous access to shares.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients. |
| 0xB00003F2 | Endpoint added.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%nTransport Flags: %7%n%nGuidance:%n%nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. |
Endpoint added.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%nTransport Flags: %7%n%nGuidance:%n%nYou should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required. |
| 0xB00003F3 | Endpoint removed.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%n%nGuidance:%n%nYou should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. |
Endpoint removed.%n%nName: %2%nDomain Name: %4%nTransport Name: %6%n%nGuidance:%n%nYou should expect this event when the server stops listening on an interface, such as during shutdown or when disabling a network adaptor. No user action is required. |
| 0xB00003F4 | The network name information changed.%n%nChange Type: %1%nNet Name: %3%nIP Address: %9%nFlags: %4%nInterface Index: %5%nCapability: %6%nLink Speed: %7%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. |
The network name information changed.%n%nChange Type: %1%nNet Name: %3%nIP Address: %9%nFlags: %4%nInterface Index: %5%nCapability: %6%nLink Speed: %7%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations, at system startup, or during network configuration. No user action is required. |
| 0xB00003F5 | Endpoint coming online.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
Endpoint coming online.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
| 0xB00003F6 | Endpoint going offline.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
Endpoint going offline.%n%nEndpoint Name: %2%nTransport Name: %4%n%nGuidance:%n%nYou should expect this event on a Windows Failover Cluster node during failover operations. No user action is required. |
| 0xB00003F7 | Decrypt call failed.%n%nClient Name: %2%nClient Address: %4%nSession ID: %7%nStatus: %6 (%5)%n%nGuidance:%n%nThis event commonly occurs because a previous SMB session no longer exists. It may also be caused by packets that are altered on the network between the computers due to either errors or a \"man-in-the-middle\" attack. |
Decrypt call failed.%n%nClient Name: %2%nClient Address: %4%nSession ID: %7%nStatus: %6 (%5)%n%nGuidance:%n%nThis event commonly occurs because a previous SMB session no longer exists. It may also be caused by packets that are altered on the network between the computers due to either errors or a \"man-in-the-middle\" attack. |
| 0xB00003F8 | Reopen failed.%n%nClient Name: %7%nClient Address: %9%nUser Name: %13%nSession ID: %14%nShare Name: %11%nFile Name: %16%nResume Key: %20%nStatus: %2 (%1)%nRKF Status: %4 (%3)%nDurable: %17%nResilient: %18%nPersistent: %19%nReason: %21%n%nGuidance:%n%nThe client attempted to reopen a continuously available handle, but the attempt failed. This typically indicates a problem with the network or underlying file being re-opened. |
Reopen failed.%n%nClient Name: %7%nClient Address: %9%nUser Name: %13%nSession ID: %14%nShare Name: %11%nFile Name: %16%nResume Key: %20%nStatus: %2 (%1)%nRKF Status: %4 (%3)%nDurable: %17%nResilient: %18%nPersistent: %19%nReason: %21%n%nGuidance:%n%nThe client attempted to reopen a continuously available handle, but the attempt failed. This typically indicates a problem with the network or underlying file being re-opened. |
| 0xB00003F9 | Handle scavenged.%n%nShare Name: %7%nFile Name: %9%nResume Key: %5%nPersistent File ID: %3%nVolatile File ID: %4%nDurable: %1%nResilient or Persistent: %2%n%nGuidance:%n%nThe server closed a handle that was previously reserved for a client after 60 seconds. You should expect this event on a computer that is continuously available where a client did not gracefully close its session. For instance, this may occur when the client unexpectedly restarted. |
Handle scavenged.%n%nShare Name: %7%nFile Name: %9%nResume Key: %5%nPersistent File ID: %3%nVolatile File ID: %4%nDurable: %1%nResilient or Persistent: %2%n%nGuidance:%n%nThe server closed a handle that was previously reserved for a client after 60 seconds. You should expect this event on a computer that is continuously available where a client did not gracefully close its session. For instance, this may occur when the client unexpectedly restarted. |
| 0xB00003FA | Backchannel invalidation of session completed.%n%nSession ID: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
Backchannel invalidation of session completed.%n%nSession ID: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
| 0xB00003FB | Backchannel invalidation of file completed.%n%nResume Key: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
Backchannel invalidation of file completed.%n%nResume Key: %1%nStatus: %3 (%2)%nTask Status: %5 (%4)%n%nGuidance:%n%nYou should expect this event on a computer that is continuously available. No user action is required |
| 0xB00003FC | File system operation has taken longer than expected.%n%nClient Name: %8%nClient Address: %10%nUser Name: %6%nSession ID: %3%nShare Name: %12%nFile Name: %14%nCommand: %1%nDuration (in milliseconds): %15%nWarning Threshold (in milliseconds): %16%n%nGuidance:%n%nThe underlying file system has taken too long to respond to an operation. This typically indicates a problem with the storage and not SMB. |
File system operation has taken longer than expected.%n%nClient Name: %8%nClient Address: %10%nUser Name: %6%nSession ID: %3%nShare Name: %12%nFile Name: %14%nCommand: %1%nDuration (in milliseconds): %15%nWarning Threshold (in milliseconds): %16%n%nGuidance:%n%nThe underlying file system has taken too long to respond to an operation. This typically indicates a problem with the storage and not SMB. |
| 0xB00003FD | LmCompatibilityLevel value is different from the default.%n%nConfigured LM Compatibility Level: %1%nDefault LM Compatibility Level: %2%n%nGuidance:%n%nLAN Manager (LM) authentication is the protocol used to authenticate Windows clients for network operations. This includes joining a domain, accessing network resources, and authenticating users or computers. This determines which challenge/response authentication protocol is negotiated between the client and the server computers. Specifically, the LM authentication level determines which authentication protocols the client will try to negotiate or the server will accept. The value set for LmCompatibilityLevel determines which challenge/response authentication protocol is used for network logons. This value affects the level of authentication protocol that clients use, the level of session security negotiated, and the level of authentication accepted by servers.%n%nValue (Setting) - Description%n%n0 (Send LM & NTLM responses) - Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n1 (Send LM & NTLM - use NTLMv2 session security if negotiated) - Clients use LM and NTLM authentication, and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n2 (Send NTLM response only) - Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n3 (Send NTLM v2 response only) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n4 (Send NTLMv2 response only/refuse LM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and accept only NTLM and NTLMv2 authentication.%n%n5 (Send NTLM v2 response only/refuse LM & NTLM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM and accept only NTLMv2 authentication.%n%nIncompatibly configured LmCompatibility levels between a client and server (such as 0 on a client and 5 on a server) prevent access to the server. Non-Microsoft clients and servers also provide these configuration settings. |
LmCompatibilityLevel value is different from the default.%n%nConfigured LM Compatibility Level: %1%nDefault LM Compatibility Level: %2%n%nGuidance:%n%nLAN Manager (LM) authentication is the protocol used to authenticate Windows clients for network operations. This includes joining a domain, accessing network resources, and authenticating users or computers. This determines which challenge/response authentication protocol is negotiated between the client and the server computers. Specifically, the LM authentication level determines which authentication protocols the client will try to negotiate or the server will accept. The value set for LmCompatibilityLevel determines which challenge/response authentication protocol is used for network logons. This value affects the level of authentication protocol that clients use, the level of session security negotiated, and the level of authentication accepted by servers.%n%nValue (Setting) - Description%n%n0 (Send LM & NTLM responses) - Clients use LM and NTLM authentication and never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n1 (Send LM & NTLM - use NTLMv2 session security if negotiated) - Clients use LM and NTLM authentication, and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n2 (Send NTLM response only) - Clients use NTLM authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n3 (Send NTLM v2 response only) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.%n%n4 (Send NTLMv2 response only/refuse LM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and accept only NTLM and NTLMv2 authentication.%n%n5 (Send NTLM v2 response only/refuse LM & NTLM) - Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it. Domain controllers refuse LM and NTLM and accept only NTLMv2 authentication.%n%nIncompatibly configured LmCompatibility levels between a client and server (such as 0 on a client and 5 on a server) prevent access to the server. Non-Microsoft clients and servers also provide these configuration settings. |
| 0xB00003FE | File and printer sharing firewall rule enabled.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that has custom shares configured. |
File and printer sharing firewall rule enabled.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that has custom shares configured. |
| 0xB00003FF | One or more shares present on this server have access based enumeration enabled.%n%nGuidance:%n%nYou should expect this event when enabling access-based enumeration on one or more shares by using either Server Manager or the Set-SmbShare Windows PowerShell cmdlet. Access-based enumeration can raise CPU utilization when clients connect to shares with folders containing many peer-level resources to which a user does not have access. You can control the CPU utilization by configuring the ABELevel value in the Windows registry:%n%nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\ABELevel [DWORD]%n%nYou can set the value for ABELevel to greater depths to minimize CPU overhead, but doing so diminishes the effectiveness of access-based enumeration:%n%nValue = 0: access-based enumeration is enabled for all levels%n%nValue = 1: access-based enumeration is enabled for a depth of 1 (example: \\server\\share)%n%nValue = 2: access-based enumeration is enabled for a depth of 2 (example: \\server\\share\\folder)%n%nYou can continue setting values for multiple depth levels. |
One or more shares present on this server have access based enumeration enabled.%n%nGuidance:%n%nYou should expect this event when enabling access-based enumeration on one or more shares by using either Server Manager or the Set-SmbShare Windows PowerShell cmdlet. Access-based enumeration can raise CPU utilization when clients connect to shares with folders containing many peer-level resources to which a user does not have access. You can control the CPU utilization by configuring the ABELevel value in the Windows registry:%n%nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\ABELevel [DWORD]%n%nYou can set the value for ABELevel to greater depths to minimize CPU overhead, but doing so diminishes the effectiveness of access-based enumeration:%n%nValue = 0: access-based enumeration is enabled for all levels%n%nValue = 1: access-based enumeration is enabled for a depth of 1 (example: \\server\\share)%n%nValue = 2: access-based enumeration is enabled for a depth of 2 (example: \\server\\share\\folder)%n%nYou can continue setting values for multiple depth levels. |
| 0xB0000400 | SMB2 and SMB3 have been disabled on this server. This results in reduced functionality and performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: Smb2%nDefault Value: 1 (or not present)%nCurrent Value: 0%n%nGuidance:%n%nYou should expect this event when disabling SMB2/SMB3. Microsoft does not recommend disabling SMB2/SMB3. When SMB3 is disabled, you cannot use features such as SMB Transparent Failover, SMB Scale Out, SMB Multichannel, SMB Direct (RDMA), SMB Encryption, VSS for SMB file shares, and SMB Directory Leasing. In most scenarios, SMB provides a troubleshooting workaround as an alternative to disabling SMB2/SMB3. Use the Set-SmbServerConfiguration Windows PowerShell cmdlet to enable SMB2/SMB3. |
SMB2 and SMB3 have been disabled on this server. This results in reduced functionality and performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: Smb2%nDefault Value: 1 (or not present)%nCurrent Value: 0%n%nGuidance:%n%nYou should expect this event when disabling SMB2/SMB3. Microsoft does not recommend disabling SMB2/SMB3. When SMB3 is disabled, you cannot use features such as SMB Transparent Failover, SMB Scale Out, SMB Multichannel, SMB Direct (RDMA), SMB Encryption, VSS for SMB file shares, and SMB Directory Leasing. In most scenarios, SMB provides a troubleshooting workaround as an alternative to disabling SMB2/SMB3. Use the Set-SmbServerConfiguration Windows PowerShell cmdlet to enable SMB2/SMB3. |
| 0xB0000401 | One or more named pipes or shares have been marked for access by anonymous users. This increases the security risk of the computer by allowing unauthenticated users to connect to this server.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Values: NullSessionPipes, NullSessionShares%nDefault Value: Empty (or not present)%nCurrent Value: Non-empty%n%nGuidance:%n%nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods. |
One or more named pipes or shares have been marked for access by anonymous users. This increases the security risk of the computer by allowing unauthenticated users to connect to this server.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Values: NullSessionPipes, NullSessionShares%nDefault Value: Empty (or not present)%nCurrent Value: Non-empty%n%nGuidance:%n%nYou should expect this event when modifying the default values of NullSessionShares and NullSessionPipes. On a typical file server, these settings do not exist or do not contain values, which is the most secure configuration. By default, domain controllers populate the NullSessionShares entry with netlogon, samr, and lsarpc to allow legacy access methods. |
| 0xB0000402 | File leasing has been disabled for the SMB2 and SMB3 protocols. This reduces functionality and can decrease performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: DisableLeasing%nDefault Value: 0 (or not present)%nCurrent Value: non-zero%n%nGuidance:%n%nYou should expect this event when disabling SMB 3 Leasing. Microsoft does not recommend disabling SMB Leasing. Once disabled, traffic from client to server may increase since metadata and data may no longer be retrieved from a local cache. |
File leasing has been disabled for the SMB2 and SMB3 protocols. This reduces functionality and can decrease performance.%n%nRegistry Key: HKLM\\System\\CurrentControlSet\\Services\\LanmanServer\\Parameters%nRegistry Value: DisableLeasing%nDefault Value: 0 (or not present)%nCurrent Value: non-zero%n%nGuidance:%n%nYou should expect this event when disabling SMB 3 Leasing. Microsoft does not recommend disabling SMB Leasing. Once disabled, traffic from client to server may increase since metadata and data may no longer be retrieved from a local cache. |
| 0xB0000403 | The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. |
The file and printer sharing firewall ports are currently closed. This is the default configuration for a system that is not sharing content or is on a Public network.%n%nGuidance:%n%nYou should expect this event when Windows Firewall is not configured to enable the File and Printer Sharing rule, which allows inbound SMB traffic. This event occurs on a computer that does not have custom shares configured. Clients cannot access SMB shares on this computer until SMB traffic is allowed through the firewall. |
| 0xB0000404 | The maximum cluster-supported SMB dialect has changed.%n%nNewMaxDialect: %1%nOldMaxDialect: %2%n%nGuidance:%n%nYou should expect this event during a Windows Failover Cluster upgrade. No user action is required. |
The maximum cluster-supported SMB dialect has changed.%n%nNewMaxDialect: %1%nOldMaxDialect: %2%n%nGuidance:%n%nYou should expect this event during a Windows Failover Cluster upgrade. No user action is required. |
| 0xB0000405 | The Cipher Suite Order group policy setting is invalid.%n%nGuidance:%n%nThis event indicates that an administrator has configured an invalid value for the \"Computer Configuration\\Administrative Templates\\Network\\Lanman Server\\Cipher Suite Order\" group policy setting. The server will use the default cipher suite order \"%1\" until this error is resolved. |
The Cipher Suite Order group policy setting is invalid.%n%nGuidance:%n%nThis event indicates that an administrator has configured an invalid value for the \"Computer Configuration\\Administrative Templates\\Network\\Lanman Server\\Cipher Suite Order\" group policy setting. The server will use the default cipher suite order \"%1\" until this error is resolved. |
| 0xB0000406 | An MDL read or write completion request failed.%n%nServer Name: %2%nShare Name: %4%nFile Name: %6%nIsRead: %7%nStatus: %8%n%nGuidance:%n%nThe SMB server sends MDL completion requests to a file system upon completion of a buffered I/O to release system resources. The file system and its filter drivers must not fail MDL completion requests. Failures may result in memory leaks and degraded system performance and stability. Non-Microsoft file system filter drivers are the most common cause of failed MDL completion requests. |
An MDL read or write completion request failed.%n%nServer Name: %2%nShare Name: %4%nFile Name: %6%nIsRead: %7%nStatus: %8%n%nGuidance:%n%nThe SMB server sends MDL completion requests to a file system upon completion of a buffered I/O to release system resources. The file system and its filter drivers must not fail MDL completion requests. Failures may result in memory leaks and degraded system performance and stability. Non-Microsoft file system filter drivers are the most common cause of failed MDL completion requests. |
| 0xB0000407 | The server detected a problem and has captured a live kernel dump to collect debug information.%n%nReason: %1%nDump Location: %SystemRoot%\\LiveKernelReports%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
The server detected a problem and has captured a live kernel dump to collect debug information.%n%nReason: %1%nDump Location: %SystemRoot%\\LiveKernelReports%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
| 0xB0000408 | The server detected a problem but was unable to capture a live kernel dump to collect debug information.%n%nReason: %1%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected. In this case, the server's request to create a live kernel dump was rejected. This is usually due to the live kernel dump throttle, which prevents frequent dumps from consuming too much disk space. Either wait for the throttle limit to expire (by default, 7 days), or contact Microsoft Support for steps to override the throttle. This event is written to the log no more than once per day. The problem that caused the server to the request a live kernel dump may be occuring more frequently.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
The server detected a problem but was unable to capture a live kernel dump to collect debug information.%n%nReason: %1%n%nGuidance:%n%nThe server supports the Live Dump feature, where the detection of a problem results in a kernel memory dump, but no bugcheck and reboot. This allows Microsoft Support to examine memory dumps without requiring a reboot or manual intervention. The reason code indicates the type of problem that was detected. In this case, the server's request to create a live kernel dump was rejected. This is usually due to the live kernel dump throttle, which prevents frequent dumps from consuming too much disk space. Either wait for the throttle limit to expire (by default, 7 days), or contact Microsoft Support for steps to override the throttle. This event is written to the log no more than once per day. The problem that caused the server to the request a live kernel dump may be occuring more frequently.%n%nStalled I/O%n%nAn I/O is taking an unreasonably long time to complete. Malfunctioning third-party file system minifilter drivers are a common source of this problem. Other causes include failed disks or a client-driven I/O workload that greatly exceeds the server's capacity. |
| 0xB0000409 | Sent RDMA %1 event to LanmanServer for interface %3. |
Sent RDMA %1 event to LanmanServer for interface %3. |
| 0xB000040A | Send RDMA Endpoint notification failure - %1 |
Send RDMA Endpoint notification failure - %1 |
| 0xB000040B | RDMA Endpoint %4 for interface %2 was %1. |
RDMA Endpoint %4 for interface %2 was %1. |
| 0xB000040C | RDMA Endpoint allocation failure - Endpoint allocation failed for interface %1. %2 |
RDMA Endpoint allocation failure - Endpoint allocation failed for interface %1. %2 |
| 0xB000040D | RDMA listener creation failure - %1 |
RDMA listener creation failure - %1 |
| 0xB000040E | RDMA Send endpoint notification RPC failure for device %3 - %1 |
RDMA Send endpoint notification RPC failure for device %3 - %1 |
| 0xB000040F | Received Nsi notification type %1 for interface %2 with NdkOperationalState %3 |
Received Nsi notification type %1 for interface %2 with NdkOperationalState %3 |
| 0xB0000410 | Received Mib notification type %1 for interface %2 |
Received Mib notification type %1 for interface %2 |
| 0xB0000411 | Error reading FSCTL properties information from the registry. Registry value entry %3 will be ignored. Error: %1 |
Error reading FSCTL properties information from the registry. Registry value entry %3 will be ignored. Error: %1 |
| 0xB0000708 | CA failure - Failed to set continuously available property on a new or existing file share as the file share is not a cluster share. |
CA failure - Failed to set continuously available property on a new or existing file share as the file share is not a cluster share. |
| 0xB0000709 | CA failure - Failed to set continuously available property on a new or existing file share as Resume Key filter is not started or has failed to attach to the underlying volume. |
CA failure - Failed to set continuously available property on a new or existing file share as Resume Key filter is not started or has failed to attach to the underlying volume. |
| 0xB000070A | The server failed to reserve the next ID region in the cluster registry. |
The server failed to reserve the next ID region in the cluster registry. |
| 0xB000070B | The security descriptor differs from the default value.%n%nPath: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity\\%1%n%nGuidance:%n%nThis is typically caused by an administrator or a third party changing the security on the object manually. To reset the security back to the default value, delete the path shown above.%nMicrosoft does not recommend changing the default security of %1 as it may cause application incompatibilities or security concerns. |
The security descriptor differs from the default value.%n%nPath: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity\\%1%n%nGuidance:%n%nThis is typically caused by an administrator or a third party changing the security on the object manually. To reset the security back to the default value, delete the path shown above.%nMicrosoft does not recommend changing the default security of %1 as it may cause application incompatibilities or security concerns. |
| 0xB00007D0 | Packet Fragment (%2 bytes) |
Packet Fragment (%2 bytes) |
| 0xB0000BB8 | SMB1 access%n%nClient Address: %1%n%nGuidance:%n%nThis event indicates that a client attempted to access the server using SMB1. To stop auditing SMB1 access, use the Windows PowerShell cmdlet Set-SmbServerConfiguration. |
SMB1 access%n%nClient Address: %1%n%nGuidance:%n%nThis event indicates that a client attempted to access the server using SMB1. To stop auditing SMB1 access, use the Windows PowerShell cmdlet Set-SmbServerConfiguration. |
| 0xB0009C40 | Packet (%4 bytes) |
Packet (%4 bytes) |
| 0xB0010227 | SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
| 0xB00103E9 | A client attempted to access the server using SMB1 and was rejected because SMB1 file sharing support is disabled or has been uninstalled.%n%nGuidance:%n%nAn administrator has disabled or uninstalled server support for SMB1. Clients running Windows XP / Windows Server 2003 R2 and earlier will not be able to access this server. Clients running Windows Vista / Windows Server 2008 and later no longer require SMB1. To determine which clients are attempting to access this server using SMB1, use the Windows PowerShell cmdlet Set-SmbServerConfiguration to enable SMB1 access auditing. |
A client attempted to access the server using SMB1 and was rejected because SMB1 file sharing support is disabled or has been uninstalled.%n%nGuidance:%n%nAn administrator has disabled or uninstalled server support for SMB1. Clients running Windows XP / Windows Server 2003 R2 and earlier will not be able to access this server. Clients running Windows Vista / Windows Server 2008 and later no longer require SMB1. To determine which clients are attempting to access this server using SMB1, use the Windows PowerShell cmdlet Set-SmbServerConfiguration to enable SMB1 access auditing. |
| 0xB00103EB | The server received an unencrypted message from client when encryption was required. Message was rejected.%n%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%nShare Name: %2%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
The server received an unencrypted message from client when encryption was required. Message was rejected.%n%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%nShare Name: %2%n%nGuidance:%n%nThis event indicates that a client is sending unencrypted data even though the SMB share requires encryption. |
| 0xB00103EC | The server rejected an incorrectly signed message.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %7%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
The server rejected an incorrectly signed message.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %7%n%nGuidance:%n%nThis event indicates that a client is sending an incorrectly signed request. |
| 0xB00103ED | The server rejected an invalid negotiation request. Connection was terminated.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %13%nExpected Dialect: %7%nExpected Capabilities: %8%nExpected Security Mode: %9%nReceived Dialect: %10%nReceived Capabilities: %11%nReceived Security Mode: %12%n%nGuidance:%n%nThis event indicates that a client is attempting to negotiate a second connection using a mismatched dialect or capabilities. |
The server rejected an invalid negotiation request. Connection was terminated.%n%nClient Name: %2%nClient Address: %6%nUser Name: %4%nSession ID: %13%nExpected Dialect: %7%nExpected Capabilities: %8%nExpected Security Mode: %9%nReceived Dialect: %10%nReceived Capabilities: %11%nReceived Security Mode: %12%n%nGuidance:%n%nThis event indicates that a client is attempting to negotiate a second connection using a mismatched dialect or capabilities. |
| 0xB0020001 | SMB2 Request Negotiate |
SMB2 Request Negotiate |
| 0xB0020002 | SMB2 Request Session Setup |
SMB2 Request Session Setup |
| 0xB0020003 | SMB2 Request Logoff |
SMB2 Request Logoff |
| 0xB0020004 | SMB2 Request Tree Connect |
SMB2 Request Tree Connect |
| 0xB0020005 | SMB2 Request Tree Disconnect |
SMB2 Request Tree Disconnect |
| 0xB0020006 | SMB2 Request Echo |
SMB2 Request Echo |
| 0xB0020007 | SMB2 Request Cancel |
SMB2 Request Cancel |
| 0xB0020008 | SMB2 Request Create |
SMB2 Request Create |
| 0xB0020009 | SMB2 Request Close |
SMB2 Request Close |
| 0xB002000A | SMB2 Request Flush |
SMB2 Request Flush |
| 0xB002000B | SMB2 Request Read |
SMB2 Request Read |
| 0xB002000C | SMB2 Request Write |
SMB2 Request Write |
| 0xB002000D | SMB2 Request Break Oplock |
SMB2 Request Break Oplock |
| 0xB002000E | SMB2 Request Notify Break Lease |
SMB2 Request Notify Break Lease |
| 0xB002000F | SMB2 Request Acknowledge Break Lease |
SMB2 Request Acknowledge Break Lease |
| 0xB0020010 | SMB2 Request Lock |
SMB2 Request Lock |
| 0xB0020011 | SMB2 Request Ioctl |
SMB2 Request Ioctl |
| 0xB0020012 | SMB2 Request Query Directory |
SMB2 Request Query Directory |
| 0xB0020013 | SMB2 Request Change Notify |
SMB2 Request Change Notify |
| 0xB0020014 | SMB2 Request Query Info |
SMB2 Request Query Info |
| 0xB0020015 | SMB2 Request Set Info |
SMB2 Request Set Info |
| 0xB0020065 | SMB2 Response Negotiate |
SMB2 Response Negotiate |
| 0xB0020066 | SMB2 Response Session Setup |
SMB2 Response Session Setup |
| 0xB0020067 | SMB2 Response Logoff |
SMB2 Response Logoff |
| 0xB0020068 | SMB2 Response Tree Connect |
SMB2 Response Tree Connect |
| 0xB0020069 | SMB2 Response Tree Disconnect |
SMB2 Response Tree Disconnect |
| 0xB002006A | SMB2 Response Echo |
SMB2 Response Echo |
| 0xB002006C | SMB2 Response Create |
SMB2 Response Create |
| 0xB002006D | SMB2 Response Close |
SMB2 Response Close |
| 0xB002006E | SMB2 Response Flush |
SMB2 Response Flush |
| 0xB002006F | SMB2 Response Read |
SMB2 Response Read |
| 0xB0020070 | SMB2 Response Write |
SMB2 Response Write |
| 0xB0020071 | SMB2 Response Break Oplock |
SMB2 Response Break Oplock |
| 0xB0020073 | SMB2 Response Acknowledge Break Lease |
SMB2 Response Acknowledge Break Lease |
| 0xB0020074 | SMB2 Response Lock |
SMB2 Response Lock |
| 0xB0020075 | SMB2 Response Ioctl |
SMB2 Response Ioctl |
| 0xB0020076 | SMB2 Response Query Directory |
SMB2 Response Query Directory |
| 0xB0020077 | SMB2 Response Change Notify |
SMB2 Response Change Notify |
| 0xB0020078 | SMB2 Response Query Info |
SMB2 Response Query Info |
| 0xB0020079 | SMB2 Response Set Info |
SMB2 Response Set Info |
| 0xB002007A | SMB2 Response Error |
SMB2 Response Error |
| 0xB0020227 | SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%nSPN: %12%nSPN Validation Policy: %13%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, an incorrect service principal name, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
SMB Session Authentication Failure%n%nClient Name: %11%nClient Address: %6%nUser Name: %9%nSession ID: %7%nStatus: %4 (%3)%nSPN: %12%nSPN Validation Policy: %13%n%nGuidance:%n%nYou should expect this error when attempting to connect to shares using incorrect credentials.%n%nThis error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.%n%nThis error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, an incorrect service principal name, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled |
| 0xB00203ED | Negotiate integrity check failed.%n%nStatus: %2%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%n%nGuidance:%n%nThis event indicates that the client's negotiate request was altered on the network between the client and server due to errors or a \"man-in-the-middle\" attack. The client has been disconnected to prevent a security downgrade. |
Negotiate integrity check failed.%n%nStatus: %2%nClient Name: %4%nClient Address: %8%nUser Name: %6%nSession ID: %9%n%nGuidance:%n%nThis event indicates that the client's negotiate request was altered on the network between the client and server due to errors or a \"man-in-the-middle\" attack. The client has been disconnected to prevent a security downgrade. |
| 0xD0000001 | SPN optional / no validation |
SPN optional / no validation |
| 0xD0000002 | SPN optional / validate service name |
SPN optional / validate service name |
| 0xD0000003 | SPN optional / validate full |
SPN optional / validate full |
| 0xD0000004 | SPN required / validate service name |
SPN required / validate service name |
| 0xD0000005 | SPN required / validate full |
SPN required / validate full |
| 0xD0000006 | Stalled I/O |
Stalled I/O |
| 0xD0000007 | Tdi |
Tdi |
| 0xD0000008 | Wsk |
Wsk |
| 0xD0000009 | Rdma |
Rdma |
| 0xD000000A | Add |
Add |
| 0xD000000B | Update |
Update |
| 0xD000000C | Remove |
Remove |
| 0xD000000D | None |
None |
| 0xD000000E | Reconnect durable file |
Reconnect durable file |
| 0xD000000F | RKF resume create |
RKF resume create |
| 0xD0000010 | Build create response |
Build create response |
| 0xD0000011 | N/A |
N/A |
| 0xD0000012 | 2.0.2 |
2.0.2 |
| 0xD0000013 | 2.1 |
2.1 |
| 0xD0000014 | 3.0 |
3.0 |
| 0xD0000015 | 3.0.2 |
3.0.2 |
| 0xD0000016 | 3.1.1 |
3.1.1 |
| 0xD0000017 | closed |
closed |
| 0xD0000018 | created |
created |
| 0xD0000019 | disabled |
disabled |
| 0xD000001A | enabled |
enabled |
| 0xD000001B | Error getting unicast ip address table for interface %2. %3 |
Error getting unicast ip address table for interface %2. %3 |
| 0xD000001C | Error getting unicast ip address entry for interface %2. %3 |
Error getting unicast ip address entry for interface %2. %3 |
| 0xD000001D | Error finding or adding the interface %2. |
Error finding or adding the interface %2. |
| 0xD000001E | DadState is different from IpDadStatePreferred for interface %2. Current DadState: %6. |
DadState is different from IpDadStatePreferred for interface %2. Current DadState: %6. |
| 0xD000001F | Error getting Nsi parameters for interface %2. %3 |
Error getting Nsi parameters for interface %2. %3 |
| 0xD0000020 | Error allocating pool memory |
Error allocating pool memory |
| 0xD0000021 | Error updating transport list for device %5. %3. |
Error updating transport list for device %5. %3. |
| 0xD0000022 | Error allocating and getting table. %3. |
Error allocating and getting table. %3. |
| 0xD0000023 | Notification type %6 is not supported. Nothing was done. |
Notification type %6 is not supported. Nothing was done. |
| 0xD0000024 | Error getting Address from TransportName for interface %2. %3 |
Error getting Address from TransportName for interface %2. %3 |
| 0xD0000025 | Error finding the address of the interface %2. %3 |
Error finding the address of the interface %2. %3 |
| 0xD0000026 | Error because SMB Direct is not supported in interface %2. %3 |
Error because SMB Direct is not supported in interface %2. %3 |
| 0xD0000027 | Error initializing SMB in interface %2. %3 |
Error initializing SMB in interface %2. %3 |
| 0xD0000028 | Error initilizing the async handle. %4 |
Error initilizing the async handle. %4 |
| 0xD0000029 | XsActSrv is not active. |
XsActSrv is not active. |
| 0xD000002A | Pnp exception. %4 |
Pnp exception. %4 |
| 0xD000002B | Timeout on comleting pnp operation. %4 |
Timeout on comleting pnp operation. %4 |
| 0xD000002C | Pnp operation took too long and it was never completed so it must be cancelled. %4 |
Pnp operation took too long and it was never completed so it must be cancelled. %4 |
| 0xD000002D | Error cancelling Pnp opearion. %4 |
Error cancelling Pnp opearion. %4 |
| 0xD000002E | NsiParameterNotification |
NsiParameterNotification |
| 0xD000002F | NsiAddInstance |
NsiAddInstance |
| 0xD0000030 | NsiDeleteInstance |
NsiDeleteInstance |
| 0xD0000031 | NsiInitialNotification |
NsiInitialNotification |
| 0xD0000032 | MibParameterNotification |
MibParameterNotification |
| 0xD0000033 | MibAddInstance |
MibAddInstance |
| 0xD0000034 | MibDeleteInstance |
MibDeleteInstance |
| 0xD0000035 | MibInitialNotification |
MibInitialNotification |
| 0xD0000036 | Registry value defines properties for an FSCTL that has already been defined in another registry value. |
Registry value defines properties for an FSCTL that has already been defined in another registry value. |
| 0xD0000037 | Registry value specifying FSCTL properties must also specify a non-zero FSCTL code. |
Registry value specifying FSCTL properties must also specify a non-zero FSCTL code. |
| 0xD0000038 | Registry value specifying FSCTL properties have the wrong format. |
Registry value specifying FSCTL properties have the wrong format. |