Microsoft-Windows-DfsSvc
102 events across 2 channels
Event ID 14318: Dfs received a referral request for "path"
#Fields #
| Name | Description |
|---|---|
unused UnicodeString | |
path UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14500: NetrDfsEnum received an enumeration
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14501: NetrDfsEnumEx received an enumeration
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14503: Dfs could not create reparse point for directory childDirectory under directory
#Fields #
| Name | Description |
|---|---|
childDirectory UnicodeString | |
parentDirectory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14504: Share share mapped to path does not support reparse points
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
path UnicodeString |
Event ID 14505: Share share mapped to directory directory overlaps an existing root
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
directory UnicodeString |
Event ID 14508: DFS re-established a connection to the PDC to initiate Domain DFS operations
#Event ID 14510: DFS could not initialize winsock library
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14511: DFS could not initialize security library
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14512: DFS could not create DFS support thread
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14513: DFS could not initialize IP site cache
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14514: DFS could not synchronize all DFS roots
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14515: DFS could not create event handle
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14516: DFS could not get required computer information
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14517: DFS could not get required cluster information
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14518: DFS could not get required DC information
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14519: DFS could not initialize prefix table
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14520: DFS could not initialize DFS namespace
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14521: DFS could not Register DFS Namespaces
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14522: DFS could not initialize User/kernel communication package
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14523: DFS could not contact any DC for Domain DFS operations
#Event ID 14524: DFS could not initialize site support table
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14526: DFS could not contact the dc Active Directory
#Fields #
| Name | Description |
|---|---|
dc UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14529: DFS has connected to the dc Active Directory
#Fields #
| Name | Description |
|---|---|
dc UnicodeString |
Event ID 14530: DFS could not access its private data from the Active Directory
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14531: DFS server has finished initializing
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"event_id": 14531,
"level": "Information",
"task": null,
"opcode": null,
"time_created": "2026-03-29T21:20:36.5156459+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "System"
},
"event_data": {}
}
Event ID 14531: DFS server has finished initializing
#Fields #
| Name | Description |
|---|---|
Name |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"guid": "{7DA4FE0E-FD42-4708-9AA5-89B77A224885}",
"event_source_name": "",
"event_id": 14531,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-29T16:33:04.4334246+00:00",
"event_record_id": 6762,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "telemetry-DC-a.cell-a.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": "DFS server has finished initializing."
}
Event ID 14532: DFS has recovered from an error and is able to read its private data from the Active Directory
#Fields #
| Name | Description |
|---|---|
share UnicodeString |
Event ID 14533: DFS has finished building all namespaces
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"event_id": 14533,
"level": "Information",
"task": null,
"opcode": null,
"time_created": "2026-03-29T21:20:36.5000098+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "System"
},
"event_data": {}
}
Event ID 14533: DFS has finished building all namespaces
#Fields #
| Name | Description |
|---|---|
Name |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"guid": "{7DA4FE0E-FD42-4708-9AA5-89B77A224885}",
"event_source_name": "",
"event_id": 14533,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-29T16:33:04.3240408+00:00",
"event_record_id": 6761,
"correlation": {},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "System",
"computer": "telemetry-DC-a.cell-a.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": "DFS has finished building all namespaces."
}
Event ID 14534: DFS Root share failed during initialization
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14535: DFS does not support multiple roots on Standard server SKU
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14536: DFS is unable to return the entire list of trusted domains to the client
#Event ID 14537: DFS is requesting the client for a larger buffer for trusted domain information
#Event ID 14538: DFS was unable to move all matching links of root: share for path oldPath to new path
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
oldPath UnicodeString | |
newPath UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14539: DFS was unable to resynchronize this root target for root:
#Fields #
| Name | Description |
|---|---|
share UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14540: DFS was unable to delete link: share for root: path during a link move operation
#Fields #
| Name | Description |
|---|---|
path UnicodeString | |
share UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14541: DFS link DFSLink was marked incorrectly as a DFS root
#Fields #
| Name | Description |
|---|---|
DFSLink UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14542: DFS metadata object DFSLink is empty in the metadata for DFS root
#Fields #
| Name | Description |
|---|---|
DFSLink UnicodeString | |
DFSRoot UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14543: The list of folder targets for the following Distributed File System (DFS) folder is corrupt
#Fields #
| Name | Description |
|---|---|
DFSLinkDN UnicodeString |
Event ID 14544: A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders
#Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSLink1 UnicodeString | |
DFSLink2 UnicodeString |
Event ID 14545: A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders
#Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSLink1 UnicodeString |
Event ID 14546: Dfs successfully created the reparse point for directory childDirectory under directory
#Fields #
| Name | Description |
|---|---|
childDirectory UnicodeString | |
parentDirectory UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14547: A Distributed File System (DFS) folder was created with conflicting descriptions
#Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSFolderPath UnicodeString | |
DFSLinkDN1 UnicodeString | |
DFSLinkDN2 UnicodeString |
Event ID 14548: The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14549: The DFS Namespace service successfully initialized the trusted domain information on this domain controller
#Event ID 14550: The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation
#Fields #
| Name | Description |
|---|---|
__binLength UInt32 | |
binary Binary |
Event ID 14551: The DFS Namespace service successfully initialized cross forest trust information on this domain controller
#Event ID 14552: The DFS Namespaces service has successfully initialized the following namespace:
#Fields #
| Name | Description |
|---|---|
DFSRoot UnicodeString |
Event ID 14553: The DFS Namespaces service failed to initialize the shared folder that hosts the namespace root
#Fields #
| Name | Description |
|---|---|
SMBShare UnicodeString | |
__binLength UInt32 | |
binary Binary |
Event ID 14554: The DFS Namespaces service has successfully initialized the shared folder that hosts the namespace root
#Fields #
| Name | Description |
|---|---|
SMBShare UnicodeString |
Event ID 1073756142: Dfs received a referral request for "path".
#Event ID 1073756324: NetrDfsEnum received an enumeration.
#Event ID 1073756325: NetrDfsEnumEx received an enumeration.
#Event ID 1073756332: DFS re-established a connection to the PDC to initiate Domain DFS operations.
#Description
DFS re-established a connection to the PDC to initiate Domain DFS operations.
Message #
Event ID 1073756353: DFS has connected to the dc Active Directory.
#Event ID 1073756355: DFS server has finished initializing.
#Description
DFS server has finished initializing.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"event_id": 14531,
"level": "Information",
"task": null,
"opcode": null,
"time_created": "2026-03-29T21:20:36.5156459+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "System"
},
"event_data": {}
}
Event ID 1073756356: DFS has recovered from an error and is able to read its private data from the Active Directory.
#Event ID 1073756357: DFS has finished building all namespaces.
#Description
DFS has finished building all namespaces.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-DfsSvc",
"event_id": 14533,
"level": "Information",
"task": null,
"opcode": null,
"time_created": "2026-03-29T21:20:36.5000098+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "System"
},
"event_data": {}
}
Event ID 1073756361: DFS is requesting the client for a larger buffer for trusted domain information.
#Description
DFS is requesting the client for a larger buffer for trusted domain information. Some Win98 clients may not be able to access DFS namespaces.
Message #
Event ID 1073756373: The DFS Namespace service successfully initialized the trusted domain information on this domain controller.
#Description
The DFS Namespace service successfully initialized the trusted domain information on this domain controller.
Message #
Event ID 1073756375: The DFS Namespace service successfully initialized cross forest trust information on this domain controller.
#Description
The DFS Namespace service successfully initialized cross forest trust information on this domain controller.
Message #
Event ID 1073756376: The DFS Namespaces service has successfully initialized the following namespace: DFSRoot.
#Event ID 1073756378: The DFS Namespaces service has successfully initialized the shared folder that hosts the namespace root.
#Event ID 2147498174: DFS could not contact the dc Active Directory.
#Event ID 2147498182: DFS Root share failed during initialization.
#Event ID 2147498184: DFS is unable to return the entire list of trusted domains to the client.
#Description
DFS is unable to return the entire list of trusted domains to the client. There are too many trusted domains.
Message #
Event ID 2147498186: DFS was unable to move all matching links of root: share for path oldPath to new path newPath.
#Event ID 2147498189: DFS link DFSLink was marked incorrectly as a DFS root.
#Description
DFS link DFSLink was marked incorrectly as a DFS root. The DFS namespace is operational on this server. If this namespace is hosted on servers running Windows Server 2003 prior to Service Pack 2 (SP2), or if the server is running Windows 2000 Server, the namespace might not be fully functional on those servers. Please consult the Microsoft Knowledge Base for more information on correcting this issue.
Message #
Fields #
| Name | Description |
|---|---|
DFSLink UnicodeString | |
binary Binary |
Event ID 2147498190: DFS metadata object DFSLink is empty in the metadata for DFS root DFSRoot.
#Description
DFS metadata object DFSLink is empty in the metadata for DFS root DFSRoot. The DFS namespace is operational on this server. If this namespace is hosted on servers running Windows Server 2003 prior to Service Pack 2 (SP2), or if the server is running Windows 2000 Server, the namespace might not be fully functional on those servers. Please consult the Microsoft Knowledge Base for more information on correcting this issue.
Message #
Fields #
| Name | Description |
|---|---|
DFSLink UnicodeString | |
DFSRoot UnicodeString | |
binary Binary |
Event ID 2147498201: The DFS Namespaces service failed to initialize the shared folder that hosts the namespace root.
#Event ID 3221239975: Dfs could not create reparse point for directory childDirectory under directory parentDirectory.
#Event ID 3221239976: Share share mapped to path does not support reparse points.
#Event ID 3221239977: Share share mapped to directory directory overlaps an existing root.
#Event ID 3221239981: Root share has too many errors.
#Event ID 3221239982: DFS could not initialize winsock library.
#Event ID 3221239983: DFS could not initialize security library.
#Event ID 3221239984: DFS could not create DFS support thread.
#Event ID 3221239985: DFS could not initialize IP site cache.
#Event ID 3221239986: DFS could not synchronize all DFS roots.
#Event ID 3221239987: DFS could not create event handle.
#Event ID 3221239988: DFS could not get required computer information.
#Event ID 3221239989: DFS could not get required cluster information.
#Event ID 3221239990: DFS could not get required DC information.
#Event ID 3221239991: DFS could not initialize prefix table.
#Event ID 3221239992: DFS could not initialize DFS namespace.
#Event ID 3221239993: DFS could not Register DFS Namespaces.
#Event ID 3221239994: DFS could not initialize User/kernel communication package.
#Event ID 3221239995: DFS could not contact any DC for Domain DFS operations.
#Description
DFS could not contact any DC for Domain DFS operations. This operation will be retried periodically.
Message #
Event ID 3221239996: DFS could not initialize site support table.
#Event ID 3221240002: DFS could not access its private data from the Active Directory.
#Event ID 3221240007: DFS does not support multiple roots on Standard server SKU.
#Event ID 3221240011: DFS was unable to resynchronize this root target for root.
#Description
DFS was unable to resynchronize this root target for root: share. This may lead to inaccessability of portions of the DFS namespace. Please verify the share share has all the link directories created for the DFS links. This error may occur if there are directories on this share that may be preventing creation of links.
Message #
Fields #
| Name | Description |
|---|---|
share UnicodeString | |
binary Binary |
Event ID 3221240012: DFS was unable to delete link: share for root: path during a link move operation.
#Event ID 3221240015: The list of folder targets for the following Distributed File System (DFS) folder is corrupt.
#Event ID 3221240016: A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders.
#Description
A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders. This can occur if two administrators on different namespace servers create conflicting folder structures at approximately the same time. Namespace: DFSNamespace DFS folder 1: DFSLink1 DFS folder 2: DFSLink2
Message #
Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSLink1 UnicodeString | |
DFSLink2 UnicodeString |
Event ID 3221240017: A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders.
#Description
A Distributed File System (DFS) folder with folder targets was created that contains other DFS folders. This can occur if two administrators on different namespace servers create conflicting folder structures at approximately the same time. Namespace: DFSNamespace DFS folder: DFSLink1
Message #
Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSLink1 UnicodeString |
Event ID 3221240018: Dfs successfully created the reparse point for directory childDirectory under directory parentDirectory.
#Event ID 3221240019: A Distributed File System (DFS) folder was created with conflicting descriptions.
#Description
A Distributed File System (DFS) folder was created with conflicting descriptions. This can occur if two administrators on different namespace servers create conflicting folder structures at approximately the same time. Namespace: DFSNamespace DFS folder path: DFSFolderPath DFS folder 1: DFSLinkDN1 DFS folder 2: DFSLinkDN2
Message #
Fields #
| Name | Description |
|---|---|
DFSNamespace UnicodeString | |
DFSFolderPath UnicodeString | |
DFSLinkDN1 UnicodeString | |
DFSLinkDN2 UnicodeString |
Event ID 3221240020: The DFS Namespace service could not initialize the trusted domain information on this domain controller, but it will periodically retry the operation.
#Event ID 3221240022: The DFS Namespace service could not initialize cross forest trust information on this domain controller, but it will periodically retry the operation.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 7da4fe0e-fd42-4708-9aa5-89b77a224885
Defined in netevent.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02
- Win11-26200.6584 · schema read from the registered manifest · binary version 10.0.26100.1 · captured 2026-06-02
Downloads
- Microsoft-Windows-DfsSvc registered manifest XML (WS2022-20348.4893) manifest-xml
- Microsoft-Windows-DfsSvc registered manifest XML (Win11-26200.6584) manifest-xml