Description

A referral request has been received.

Message #

A referral request has been received.

Fields #

Description

A referral request has been received.

Fields #

Description

A DC referral request has been processed.

Message #

A DC referral request has been processed.

Fields #

Description

A DC referral request has been processed.

Fields #

Description

A root referral request has been processed.

Message #

A root referral request has been processed.

Fields #

Description

A root referral request has been processed.

Fields #

Description

A normal referral request has been processed.

Message #

A normal referral request has been processed.

Fields #

Description

A normal referral request has been processed.

Fields #

Description

A referral response has been generated.

Message #

A referral response has been generated.

Fields #

Description

A referral response has been generated.

Fields #

Description

A referral response has been posted.

Message #

A referral response has been posted.

Fields #

Description

A referral response has been posted.

Fields #

Description

IP address IpAddress resolved to site SiteName.

Message #

IP address %1 resolved to site %2.

Fields #

Description

IP address resolved to site .

Fields #

Description

NetrDfsAdd arrived.

Message #

NetrDfsAdd arrived.

Description

NetrDfsAdd arrived.

Description

NetrDfsRemove arrived.

Message #

NetrDfsRemove arrived.

Description

NetrDfsRemove arrived.

Description

NetrDfsSetInfo arrived.

Message #

NetrDfsSetInfo arrived.

Description

NetrDfsSetInfo arrived.

Description

NetrDfsGetInfo arrived.

Message #

NetrDfsGetInfo arrived.

Description

NetrDfsGetInfo arrived.

Description

NetrDfsMove arrived.

Message #

NetrDfsMove arrived.

Description

NetrDfsMove arrived.

Description

NetrDfsAddFtRoot arrived.

Message #

NetrDfsAddFtRoot arrived.

Description

NetrDfsAddFtRoot arrived.

Description

NetrDfsRemoveFtRoot arrived.

Message #

NetrDfsRemoveFtRoot arrived.

Description

NetrDfsRemoveFtRoot arrived.

Description

NetrDfsAddStdRoot arrived.

Message #

NetrDfsAddStdRoot arrived.

Description

NetrDfsAddStdRoot arrived.

Description

NetrDfsRemoveStdRoot arrived.

Message #

NetrDfsRemoveStdRoot arrived.

Description

NetrDfsRemoveStdRoot arrived.

Description

LockAcquiredDomainInfo.

Message #

LockAcquiredDomainInfo.

Description

LockAcquiredDomainInfo.

Description

LookupRootFolderDone.

Message #

LookupRootFolderDone.

Fields #

Description

LookupRootFolderDone.

Fields #

Description

LookupLinkFolderDone.

Message #

LookupLinkFolderDone.

Fields #

Description

LookupLinkFolderDone.

Fields #

Description

NetrDfsEnum arrived.

Message #

NetrDfsEnum arrived.

Description

NetrDfsEnum arrived.

Description

Referral request received for dfspath DfsPath from client with IPAddress ClientIpAddress and site ClientSite.

Message #

Referral request received for dfspath %1 from client with IPAddress %2 and site %3.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 1152921504606846977,
    "time_created": "2026-03-13T20:05:06.467486+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-000B-87F7-838B21B3DC01"
    },
    "execution": {
      "process_id": 4148,
      "thread_id": 4796
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "",
    "ClientIpAddress": "10.2.10.21",
    "ClientSite": "Default-First-Site-Name"
  },
  "message": ""
}

Description

DFS has resolved server ServerName to IPAddress ServerIpAddress and site ServerSite.

Message #

DFS has resolved server %1 to IPAddress %2 and site %3.

Fields #

Description

Failed to obtain IPAddress for server ServerName. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to obtain IPAddress for server %1. This may cause the client to access high-cost or out-of-site targets.

Fields #

Description

Failed to resolve IPAddress IpAddress to site name. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to resolve IPAddress %1 to site name. This may cause the client to access high-cost or out-of-site targets.

Fields #

Description

Referral generated for DFS path DfsPath and client whose site is ClientSite. Targets information can be found in the event payload.

Message #

Referral generated for DFS path %2 and client whose site is %3. Targets information can be found in the event payload.

Fields #

Description

Request for creating new folder or adding target to existing folder completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for creating new folder or adding target to existing folder completed with status:%6. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 506,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 41,
    "keywords": 1152921504606846978,
    "time_created": "2026-03-13T20:45:53.834051+00:00",
    "event_record_id": 296,
    "correlation": {},
    "execution": {
      "process_id": 4148,
      "thread_id": 3744
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "\\ludus.domain\\TestDFS\\Folder1",
    "ServerName": "LAB-DC01",
    "ShareName": "TestDFS\\Folder1",
    "Comment": "NULL",
    "Flags": 1,
    "Status": 1168,
    "TimeConsumedInMilliSeconds": 0
  },
  "message": ""
}

Description

Request for deleting a link or removing target of existing link completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for deleting a link or removing target of existing link completed with status:%4. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Description

Request to modify properties of DfsPath completed with status Status.

Message #

Request to modify properties of %1 completed with status %5.

Fields #

Description

Request to retrieve properties of DfsPath completed with status Status.

Message #

Request to retrieve properties of %1 completed with status %5.

Fields #

Description

Request to retrieve properties of completed with status .

Fields #

Description

Request to enumerate contents of \\DfsPath completed with status Status.

Message #

Request to enumerate contents of \\%1 completed with status %4.

Fields #

Description

Request to enumerate contents of \\ completed with status .

Fields #

Description

Request to move dfs folders from DfsPath to NewDfsPath completed with status Status.

Message #

Request to move dfs folders from %1 to %2 completed with status %4.

Fields #

Description

Request to create a new dfs namespace or add target to existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new dfs namespace or add target to existing namespace completed with status %6. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Description

Request to create a new dfs namespace or add target to existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove a dfs namespace or remove target from existing namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Description

Request to create a new standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new standalone or clustered dfs namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Description

Request to create a new standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Description

Request to remove standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove standalone or clustered dfs namespace completed with status %4. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Description

Request to remove standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Description

DFSN service has started performing complete refresh of metadata for namespace . This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Message #

DFSN service has started performing complete refresh of metadata for namespace %1. This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Fields #

Description

DFSN service has started performing complete refresh of metadata for namespace . This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Fields #

Description

DFSN service completed performing refresh of metadata for namespace DfsNamespace with status Status. Time taken to perform this operation TimeConsumedInMilliSeconds milliseconds.

Message #

DFSN service completed performing refresh of metadata for namespace %1 with status %4. Time taken to perform this operation %5 milliseconds.

Fields #

Description

DFSN service completed performing refresh of metadata for namespace with status . Time taken to perform this operation milliseconds.

Fields #

Description

DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume VolumeName. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Message #

DFSN service has successfully deleted DFS reparse point %1 on volume %3. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Description

DFSN service has successfully deleted DFS reparse point on volume . The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Description

DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status Status. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Message #

DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status %4. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Description

DFSN service has failed to deleted DFS reparse point on volume with status . The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Description

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: ADSite. This might cause clients to access folder targets in other sites. Error code: Status.

Message #

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: %1. This might cause clients to access folder targets in other sites. Error code: %2.

Fields #

Description

The DFS Namespace service is unable to contact Active Directory Domain Services.

Message #

The DFS Namespace service is unable to contact Active Directory Domain Services. 

Domain: %1 
Domain Controller: %2 
LDAP Error: %3

Fields #

Description

The DFS Namespace service is unable to contact Active Directory Domain Services.

Fields #

Description

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.

Message #

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.
To bring the namespace back online, delete the following registry entry and then restart the DFS Namespace service. After the namespace is online, recreate the missing DFS folder or restore the DFS folder from a backup of the DFS namespace.

Registry Path: %1 
Status: %2

Fields #

Description

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.

Fields #