Microsoft-Windows-DFSN-Server

74 events across 3 channels

Event ID	Title	Channel
1		Operational
1	A referral request has been received.	Analytic
2		Operational
2	A DC referral request has been processed.	Analytic
3		Operational
3	A root referral request has been processed.	Analytic
4		Operational
4	A normal referral request has been processed.	Analytic
5		Operational
5	A referral response has been generated.	Analytic
6		Operational
6	A referral response has been posted.	Analytic
7		Operational
7	IP address %1 resolved to site %2.	Analytic
11		Operational
11	NetrDfsAdd arrived.	Analytic
21		Operational
21	NetrDfsRemove arrived.	Analytic
31		Operational
31	NetrDfsSetInfo arrived.	Analytic
41		Operational
41	NetrDfsGetInfo arrived.	Analytic
61		Operational
61	NetrDfsMove arrived.	Analytic
71		Operational
71	NetrDfsAddFtRoot arrived.	Analytic
81		Operational
81	NetrDfsRemoveFtRoot arrived.	Analytic
91		Operational
91	NetrDfsAddStdRoot arrived.	Analytic
101		Operational
101	NetrDfsRemoveStdRoot arrived.	Analytic
112		Operational
112	LockAcquiredDomainInfo.	Analytic
121		Operational
121	LookupRootFolderDone.	Analytic
131		Operational
131	LookupLinkFolderDone.	Analytic
191		Operational
191	NetrDfsEnum arrived.	Analytic
501	Referral request received for dfspath %1 from client with IPAddress %2 and site …	Operational
502	DFS has resolved server %1 to IPAddress %2 and site %3.	Operational
503	Failed to obtain IPAddress for server %1.	Operational
504	Failed to resolve IPAddress %1 to site name.	Operational
505	Referral generated for DFS path %2 and client whose site is %3.	Operational
506	Request for creating new folder or adding target to existing folder completed …	Operational
507	Request for deleting a link or removing target of existing link completed with …	Operational
508	Request to modify properties of %1 completed with status %5.	Operational
509		Operational
509	Request to retrieve properties of %1 completed with status %5.	Analytic
510		Operational
510	Request to enumerate contents of \\.	Analytic
511	Request to move dfs folders from %1 to %2 completed with status %4.	Operational
512		Operational
512	Request to create a new dfs namespace or add target to existing namespace …	Admin
513		Operational
513	Request to remove a dfs namespace or remove target from existing namespace …	Admin
514		Operational
514	Request to create a new standalone or clustered dfs namespace completed with …	Admin
515		Operational
515	Request to remove standalone or clustered dfs namespace completed with status …	Admin
516		Operational
516	DFSN service has started performing complete refresh of metadata for namespace …	Admin
517		Operational
517	DFSN service completed performing refresh of metadata for namespace %1 with …	Admin
518		Operational
518	DFSN service has successfully deleted DFS reparse point %1 on volume %3.	Admin
519		Operational
519	DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status …	Admin
520	The DFS Namespace service could not obtain site costs for the following Active …	Operational
521		Operational
521	The DFS Namespace service is unable to contact Active Directory Domain Services.	Admin
522		Operational
522	A DFS folder has incorrect metadata in the registry.	Admin

Event ID 1 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`RequestBuffer`	—
`RequestBufferLength`	—

Event ID 1 — A referral request has been received.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A referral request has been received.

Fields

Name	Description
`RequestBuffer`	—
`RequestBufferLength`	—

Event ID 2 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Status`	—

Event ID 2 — A DC referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A DC referral request has been processed.

Fields

Name	Description
`Status`	—

Event ID 3 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Status`	—

Event ID 3 — A root referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A root referral request has been processed.

Fields

Name	Description
`Status`	—

Event ID 4 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Status`	—

Event ID 4 — A normal referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A normal referral request has been processed.

Fields

Name	Description
`Status`	—

Event ID 5 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Request`	—
`Response`	—
`Status`	—
`ResponseLength`	—

Event ID 5 — A referral response has been generated.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A referral response has been generated.

Fields

Name	Description
`Request`	—
`Response`	—
`Status`	—
`ResponseLength`	—

Event ID 6 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Response`	—
`Status`	—

Event ID 6 — A referral response has been posted.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

A referral response has been posted.

Fields

Name	Description
`Response`	—
`Status`	—

Event ID 7 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`IpAddress`	—
`SiteName`	—
`TimeConsumedToResolveInMilliSeconds`	—

Event ID 7 — IP address %1 resolved to site %2.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

IP address %1 resolved to site %2.

Fields

Name	Description
`IpAddress`	—
`SiteName`	—
`TimeConsumedToResolveInMilliSeconds`	—

Event ID 11 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 11 — NetrDfsAdd arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsAdd arrived.

Event ID 21 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 21 — NetrDfsRemove arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsRemove arrived.

Event ID 31 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 31 — NetrDfsSetInfo arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsSetInfo arrived.

Event ID 41 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 41 — NetrDfsGetInfo arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsGetInfo arrived.

Event ID 61 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 61 — NetrDfsMove arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsMove arrived.

Event ID 71 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 71 — NetrDfsAddFtRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsAddFtRoot arrived.

Event ID 81 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 81 — NetrDfsRemoveFtRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsRemoveFtRoot arrived.

Event ID 91 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 91 — NetrDfsAddStdRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsAddStdRoot arrived.

Event ID 101 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 101 — NetrDfsRemoveStdRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsRemoveStdRoot arrived.

Event ID 112 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 112 — LockAcquiredDomainInfo.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

LockAcquiredDomainInfo.

Event ID 121 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Status`	—

Event ID 121 — LookupRootFolderDone.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

LookupRootFolderDone.

Fields

Name	Description
`Status`	—

Event ID 131 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`Status`	—

Event ID 131 — LookupLinkFolderDone.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

LookupLinkFolderDone.

Fields

Name	Description
`Status`	—

Event ID 191 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Event ID 191 — NetrDfsEnum arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

NetrDfsEnum arrived.

Event ID 501 — Referral request received for dfspath %1 from client with IPAddress %2 and site %3.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Referral request received for dfspath %1 from client with IPAddress %2 and site %3.

Fields

Name	Description
`DfsPath`	—
`ClientIpAddress`	—
`ClientSite`	—

Event ID 502 — DFS has resolved server %1 to IPAddress %2 and site %3.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

DFS has resolved server %1 to IPAddress %2 and site %3.

Fields

Name	Description
`ServerName`	—
`ServerIpAddress`	—
`ServerSite`	—
`TimeConsumedToResolveInMilliSeconds`	—

Event ID 503 — Failed to obtain IPAddress for server %1.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Failed to obtain IPAddress for server %1. This may cause the client to access high-cost or out-of-site targets.

Fields

Name	Description
`ServerName`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 504 — Failed to resolve IPAddress %1 to site name.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Failed to resolve IPAddress %1 to site name. This may cause the client to access high-cost or out-of-site targets.

Fields

Name	Description
`IpAddress`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 505 — Referral generated for DFS path %2 and client whose site is %3.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Referral generated for DFS path %2 and client whose site is %3. Targets information can be found in the event payload.

Fields

Name	Description
`DfsPathLength`	—
`DfsPath`	—
`ClientSite`	—
`TargetCount`	—
`DfsTarget`	—

Event ID 506 — Request for creating new folder or adding target to existing folder completed with status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Request for creating new folder or adding target to existing folder completed with status:%6. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields

Name	Description
`DfsPath`	—
`ServerName`	—
`ShareName`	—
`Comment`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 507 — Request for deleting a link or removing target of existing link completed with status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Request for deleting a link or removing target of existing link completed with status:%4. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields

Name	Description
`DfsPath`	—
`ServerName`	—
`ShareName`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 508 — Request to modify properties of %1 completed with status %5.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Request to modify properties of %1 completed with status %5.

Fields

Name	Description
`DfsPath`	—
`ServerName`	—
`ShareName`	—
`Level`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 509 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsPath`	—
`ServerName`	—
`ShareName`	—
`Level`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 509 — Request to retrieve properties of %1 completed with status %5.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

Request to retrieve properties of %1 completed with status %5.

Fields

Name	Description
`DfsPath`	—
`ServerName`	—
`ShareName`	—
`Level`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 510 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsPath`	—
`Level`	—
`PreferredMaxLength`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 510 — Request to enumerate contents of \\.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic

Message

Request to enumerate contents of \\%1 completed with status %4.

Fields

Name	Description
`DfsPath`	—
`Level`	—
`PreferredMaxLength`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 511 — Request to move dfs folders from %1 to %2 completed with status %4.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

Request to move dfs folders from %1 to %2 completed with status %4.

Fields

Name	Description
`DfsPath`	—
`NewDfsPath`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 512 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`FtDfsName`	—
`Comment`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 512 — Request to create a new dfs namespace or add target to existing namespace completed with status %6.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

Request to create a new dfs namespace or add target to existing namespace completed with status %6. The namespace server and share name are DfsServer:%1 Share:%2.

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`FtDfsName`	—
`Comment`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 513 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`FtDfsName`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 513 — Request to remove a dfs namespace or remove target from existing namespace completed with status %5.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

Request to remove a dfs namespace or remove target from existing namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`FtDfsName`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 514 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`Comment`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 514 — Request to create a new standalone or clustered dfs namespace completed with status %5.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

Request to create a new standalone or clustered dfs namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`Comment`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 515 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 515 — Request to remove standalone or clustered dfs namespace completed with status %4.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

Request to remove standalone or clustered dfs namespace completed with status %4. The namespace server and share name are DfsServer:%1 Share:%2.

Fields

Name	Description
`ServerName`	—
`RootShare`	—
`Flags`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 516 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsNamespace`	—
`SyncFromPDC`	—
`SyncType`	—

Event ID 516 — DFSN service has started performing complete refresh of metadata for namespace %1.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

DFSN service has started performing complete refresh of metadata for namespace %1. This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Fields

Name	Description
`DfsNamespace`	—
`SyncFromPDC`	—
`SyncType`	—

Event ID 517 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsNamespace`	—
`SyncFromPDC`	—
`SyncType`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 517 — DFSN service completed performing refresh of metadata for namespace %1 with status %4.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

DFSN service completed performing refresh of metadata for namespace %1 with status %4. Time taken to perform this operation %5 milliseconds.

Fields

Name	Description
`DfsNamespace`	—
`SyncFromPDC`	—
`SyncType`	—
`Status`	—
`TimeConsumedInMilliSeconds`	—

Event ID 518 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsReparsepoint`	—
`VolumeNameLength`	—
`VolumeName`	—
`Status`	—

Event ID 518 — DFSN service has successfully deleted DFS reparse point %1 on volume %3.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

DFSN service has successfully deleted DFS reparse point %1 on volume %3. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields

Name	Description
`DfsReparsepoint`	—
`VolumeNameLength`	—
`VolumeName`	—
`Status`	—

Event ID 519 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsReparsepoint`	—
`VolumeNameLength`	—
`VolumeName`	—
`Status`	—

Event ID 519 — DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status %4.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status %4. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields

Name	Description
`DfsReparsepoint`	—
`VolumeNameLength`	—
`VolumeName`	—
`Status`	—

Event ID 520 — The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Message

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: %1. This might cause clients to access folder targets in other sites. Error code: %2.

Fields

Name	Description
`ADSite`	—
`Status`	—

Event ID 521 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DomainName`	—
`DomainControllerName`	—
`LdapError`	—

Event ID 521 — The DFS Namespace service is unable to contact Active Directory Domain Services.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

The DFS Namespace service is unable to contact Active Directory Domain Services. 

Domain: %1 
Domain Controller: %2 
LDAP Error: %3

Fields

Name	Description
`DomainName`	—
`DomainControllerName`	—
`LdapError`	—

Event ID 522 —

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Fields

Name	Description
`DfsFolderMetadataRegistryPath`	—
`Status`	—

Event ID 522 — A DFS folder has incorrect metadata in the registry.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Message

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.
To bring the namespace back online, delete the following registry entry and then restart the DFS Namespace service. After the namespace is online, recreate the missing DFS folder or restore the DFS folder from a backup of the DFS namespace.

Registry Path: %1 
Status: %2

Fields

Name	Description
`DfsFolderMetadataRegistryPath`	—
`Status`	—