Description

There are currently no IPv4 DNS servers configured for any interface on this host. Please configure DNS server settings, or renew your dynamic IP settings.

Message #

There are currently no IPv4 DNS servers configured for any interface on this host. Please configure DNS server settings, or renew your dynamic IP settings.

Fields #

Description

Interface: Interface Total DNS Server Count: TotalServerCount Index: Index Address: Address (DynamicAddress).

Message #

Interface: %1 Total DNS Server Count: %2 Index: %3 Address: %6 (%4)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1001,
    "version": 0,
    "level": 4,
    "task": 1001,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:40.334238+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Interface": "Ethernet",
    "TotalServerCount": 1,
    "Index": 1,
    "DynamicAddress": 0,
    "AddressLength": 16,
    "Address": "020000000A020A0B0000000000000000"
  },
  "message": ""
}

Description

The DNS server being queried for interface Interface has changed to Address.

Message #

The DNS server being queried for interface %1 has changed to %3

Fields #

Description

The following DNS server(s) were successfully validated as active servers that can service this client. Address.

Message #

The following DNS server(s) were successfully validated as active servers that can service this client. %2

Fields #

Description

The following DNS server(s) were successfully validated as active servers that can service this client. {Address}.

Message #

The following DNS server(s) were successfully validated as active servers that can service this client. {Address}

Fields #

Description

The client was unable to validate the following as active DNS server(s) that can service this client. The server(s) may be temporarily unavailable, or may be incorrectly configured. Address.

Message #

The client was unable to validate the following as active DNS server(s) that can service this client. The server(s) may be temporarily unavailable, or may be incorrectly configured. %2

Fields #

Description

The client was unable to validate the following as active DNS server(s) that can service this client. The server(s) may be temporarily unavailable; or may be incorrectly configured. {Address}.

Message #

The client was unable to validate the following as active DNS server(s) that can service this client. The server(s) may be temporarily unavailable; or may be incorrectly configured. {Address}

Fields #

Description

The primary DNS suffix for this machine is missing. In the absence of a primary DNS suffix, short unqualified names may not resolve through DNS.

Message #

The primary DNS suffix for this machine is missing. In the absence of a primary DNS suffix, short unqualified names may not resolve through DNS

Fields #

Description

The primary DNS suffix for this machine is missing. In the absence of a primary DNS suffix, short unqualified names may not resolve through DNS.

Message #

The primary DNS suffix for this machine is missing. In the absence of a primary DNS suffix, short unqualified names may not resolve through DNS

Fields #

Description

The primary DNS suffix for this machine (DnsSuffix) does not match the Active Directory domain (AdSuffix) that it is currently joined to.

Message #

The primary DNS suffix for this machine (%1) does not match the Active Directory domain (%2) that it is currently joined to.

Fields #

Description

The primary DNS suffix for this machine (DnsSuffix) does not match the Active Directory domain (AdSuffix) that it is currently joined to.

Message #

The primary DNS suffix for this machine (%1) does not match the Active Directory domain (%2) that it is currently joined to.

Fields #

Description

There was an error while attempting to read the local hosts file.

Message #

There was an error while attempting to read the local hosts file.

Fields #

Description

There was an error while attempting to read the local hosts file.

Message #

There was an error while attempting to read the local hosts file.

Fields #

Description

Name resolution for the name QueryName timed out after none of the configured DNS servers responded.

Message #

Name resolution for the name %1 timed out after none of the configured DNS servers responded.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1013,
    "version": 0,
    "level": 2,
    "task": 1013,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T21:48:42.710774+00:00",
    "event_record_id": 11625,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 7980
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "dns.msftncsi.com",
    "AddressLength": 16,
    "Address": "020000350A020A0B0000000000000000"
  },
  "message": ""
}

Description

Name resolution for the name QueryName timed out after none of the configured DNS servers responded.

Message #

Name resolution for the name %1 timed out after none of the configured DNS servers responded.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1014,
    "version": 1,
    "level": 3,
    "task": 1014,
    "opcode": 0,
    "keywords": 4611686018695823360,
    "time_created": "2023-11-06T06:25:49.753506+00:00",
    "event_record_id": 1706,
    "correlation": {},
    "execution": {
      "process_id": 1916,
      "thread_id": 3540
    },
    "channel": "System",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "wpad",
    "AddressLength": 128,
    "Address": "02000000C0A85C02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "ClientPID": 2556
  },
  "message": ""
}

References #

• Example event sourced from https://github.com/NextronSystems/evtx-baseline

Description

Name resolution for the name QueryName timed out after the DNS server Address did not respond.

Message #

Name resolution for the name %1 timed out after the DNS server %3 did not respond.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1015,
    "version": 1,
    "level": 4,
    "task": 1015,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.061199+00:00",
    "event_record_id": 11,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "AddressLength": 16,
    "Address": "020000350A020A0B0000000000000000",
    "ClientPID": 3384
  },
  "message": ""
}

Description

A name not found error was returned for the name QueryName. Check to ensure that the name is correct. The response was sent by the server at Address.

Message #

A name not found error was returned for the name %1. Check to ensure that the name is correct. The response was sent by the server at %3.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1016,
    "version": 2,
    "level": 4,
    "task": 1016,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:58.824946+00:00",
    "event_record_id": 24,
    "correlation": {
      "ActivityID": "EF3E8619-3C1A-466E-87D4-27258CCCF136"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "85.65.42.20.in-addr.arpa",
    "AddressLength": 16,
    "Address": "020000350A020A0B0000000000000000",
    "ClientPID": 3516,
    "SendBlob": "0x1b11ff2c150",
    "SendBlobContext": "0x7ffa2a356170"
  },
  "message": ""
}

Description

The DNS server's response to a query for name QueryName indicates that no records of the type queried are available, but could indicate that other records for the same name are present.

Message #

The DNS server's response to a query for name %1 indicates that no records of the type queried are available, but could indicate that other records for the same name are present.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1017,
    "version": 0,
    "level": 4,
    "task": 1017,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:23:56.825954+00:00",
    "event_record_id": 4296,
    "correlation": {},
    "execution": {
      "process_id": 968,
      "thread_id": 9008
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "QueryName": "_kerberos._tcp.dc._msdcs.ludus.domain",
    "AddressLength": 16,
    "Address": "020000357F0000010000000000000000"
  },
  "message": ""
}

Description

The response for the query QueryName was a Link Local IP address Address. The response was sent by the server at DnsAddress.

Message #

The response for the query %1 was a Link Local IP address %3. The response was sent by the server at %5.

Fields #

Description

There are currently no IPv6 DNS servers configured for any interface on this host. Please configure DNS server settings, or renew your dynamic IP settings.

Message #

There are currently no IPv6 DNS servers configured for any interface on this host. Please configure DNS server settings, or renew your dynamic IP settings.

Fields #

Message #

Read DNS Name Resolution Policy Table: Key Name %1: DNSSEC Settings: DnsSecValidationRequired %2, DnsQueryOverIPSec %3, DnsEncryption %4 Direct Access Settings: DirectAccessServerList %5, EnableRemoteIPSEC %6  RemoteEncryption %7 ProxyType %8 ProxyName %9

Fields #

Description

Matched Effective policy for query name QueryName: Key Name KeyName: DnsSecValidationRequired DnsSecValidationRequired, DnsQueryOverIPSec DnsQueryOverIPSec, DnsEncryption DnsEncryption DirectAccessServerList DirectAccessServerList, ProxyType ProxyType ProxyName ProxyName.

Message #

Matched Effective policy for query name %1: Key Name %2: DnsSecValidationRequired %3, DnsQueryOverIPSec %4, DnsEncryption %5 DirectAccessServerList %6, ProxyType %7 ProxyName %8

Fields #

Description

Name resolution for the name, QueryName, will not fall back to LLMNR or NetBIOS.

Message #

Name resolution for the name, %1, will not fall back to LLMNR or NetBIOS

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1022,
    "version": 0,
    "level": 4,
    "task": 1022,
    "opcode": 0,
    "keywords": 9223372037391646720,
    "time_created": "2026-03-13T21:48:42.710909+00:00",
    "event_record_id": 11629,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 7980
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "dns.msftncsi.com"
  },
  "message": ""
}

Description

Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator. For more information: read policy table for rule failed with error.

Message #

Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator. For more information: read policy table for rule %1 failed with error %2

Fields #

Description

Transaction ID of the response for query QueryName from server Address did not match.

Message #

Transaction ID of the response for query %1 from server %3 did not match

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 1024,
    "version": 0,
    "level": 4,
    "task": 1024,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T21:48:46.782764+00:00",
    "event_record_id": 11899,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 8032
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "ludus.domain",
    "AddressLength": 16,
    "Address": "020000350A020A0B0000000000000000"
  },
  "message": ""
}

Description

The DNS server IP Address of the response for query QueryName is not configured on the client.

Message #

The DNS server IP %3 of the response for query %1 is not configured on the client

Fields #

Description

The question (ResponseQuestion) in the response from server Address does not match the original question QueryName.

Message #

The question (%2) in the response from server %4 does not match the original question %1

Fields #

Message #

DNS Name resolution for the name, %1, failed because the client was unable to contact DNS servers. At least one of the interfaces is not in a private network and name resolution will not fall back to LLMNR or NetBIOS

Fields #

Description

Matched effective policy for query name : Key Name : DnsSecValidationRequired , DnsQueryOverIPSec , DnsEncryption DirectAccessServerList , ProxyType ProxyName GenericServerList IdnConfig.

Message #

Matched effective policy for query name %1: Key Name %2: DnsSecValidationRequired %3, DnsQueryOverIPSec %4, DnsEncryption %5 DirectAccessServerList %6, ProxyType %7 ProxyName %8 GenericServerList %9 IdnConfig %10

Fields #

Description

DNS Query is initiated for the name QueryName and for the type QueryType with query options QueryOptions.

Message #

DNS Query is initiated for the name %1 and for the type %2 with query options %3

Fields #

Description

DNS Query operation is completed with result Status.

Message #

DNS Query operation is completed with result %1

Fields #

Description

DNS Cache lookup is initiated for the name QueryName and for the type QueryType with query options QueryOptions.

Message #

DNS Cache lookup is initiated for the name %1 and for the type %2 with query options %3

Fields #

Description

DNS Cache lookup operation for the name QueryName and for the type QueryType is completed with result Status.

Message #

DNS Cache lookup operation for the name %1 and for the type %2 is completed with result %3

Fields #

Description

DNS FQDN Query is initiated for the name QueryName and for the type QueryType with query options QueryOptions.

Message #

DNS FQDN Query is initiated for the name %1 and for the type %2 with query options %3

Fields #

Description

DNS FQDN Query operation for the name QueryName and for the type QueryType is completed with result Status.

Message #

DNS FQDN Query operation for the name %1 and for the type %2 is completed with result %3

Fields #

Description

DNS query is called for the name QueryName, type QueryType, query options QueryOptions, Server List ServerList, isNetwork query IsNetworkQuery, network index NetworkQueryIndex, interface index InterfaceIndex, is asynchronous query IsAsyncQuery.

Message #

DNS query is called for the name %1, type %2, query options %3, Server List %4, isNetwork query %5, network index %6, interface index %7, is asynchronous query %8

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3006,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.033511+00:00",
    "event_record_id": 2,
    "correlation": {
      "ActivityID": "30000002-0002-FE00-D015-D40C380D840C"
    },
    "execution": {
      "process_id": 3384,
      "thread_id": 3204
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 28,
    "QueryOptions": 720575941453176832,
    "ServerList": "",
    "IsNetworkQuery": 0,
    "NetworkQueryIndex": 0,
    "InterfaceIndex": 0,
    "IsAsyncQuery": 0
  },
  "message": ""
}

Related Events #

Description

DnsQueryEx for the name QueryName is pending.

Message #

DnsQueryEx for the name %1 is pending

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T21:48:42.710899+00:00",
    "event_record_id": 11627,
    "correlation": {},
    "execution": {
      "process_id": 1860,
      "thread_id": 7980
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "dns.msftncsi.com"
  },
  "message": ""
}

Description

DNS query is completed for the name QueryName, type QueryType, query options QueryOptions with status QueryStatus Results QueryResults.

Message #

DNS query is completed for the name %1, type %2, query options %3 with status %4 Results %5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.033539+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "30000002-0002-FE00-D015-D40C380D840C"
    },
    "execution": {
      "process_id": 3384,
      "thread_id": 7344
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "QueryOptions": 720575941453045760,
    "QueryStatus": 87,
    "QueryResults": ""
  },
  "message": ""
}

Description

Network query initiated for the name QueryName (is parallel query IsParallelNetworkQuery) on network index NetworkIndex with interface count InterfaceCount with first interface name AdapterName, local addresses LocalAddress and Dns Servers DNSServerAddress.

Message #

Network query initiated for the name %1 (is parallel query %2) on network index %3 with interface count %4 with first interface name %5, local addresses %6 and Dns Servers %7

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3009,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.037113+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "IsParallelNetworkQuery": 1,
    "NetworkIndex": 0,
    "InterfaceCount": 1,
    "AdapterName": "Ethernet",
    "LocalAddress": "10.2.10.21",
    "DNSServerAddress": "10.2.10.11",
    "ClientPID": 3384,
    "QueryBlob": "0x1b11f66d1a0",
    "ParentBlob": "0x0"
  },
  "message": ""
}

Description

DNS Query sent to DNS Server DnsServerIpAddress for name QueryName and type QueryType.

Message #

DNS Query sent to DNS Server %3 for name %1 and type %2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3010,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.037163+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "DnsServerIpAddress": "10.2.10.11",
    "ClientPID": 3384
  },
  "message": ""
}

Description

Received response from DNS Server DnsServerIpAddress for name QueryName and type QueryType with response status ResponseStatus.

Message #

Received response from DNS Server %3 for name %1 and type %2 with response status %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3011,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.072575+00:00",
    "event_record_id": 13,
    "correlation": {
      "ActivityID": "7D9A141D-3061-4B6F-A6EE-D4CEE18DB90D"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "DnsServerIpAddress": "10.2.10.11",
    "ResponseStatus": 0,
    "ClientPID": 3384,
    "SendBlob": "0x1b11ff2c630",
    "SendBlobContext": "0x7ffa2a356170"
  },
  "message": ""
}

Description

NETBIOS query is initiated for name QueryName on network index NetworkIndex with inteface count InterfaceCount with first interface name AdapterName and local addresses LocalAddress.

Message #

NETBIOS query is initiated for name %1 on network index %2 with inteface count %3 with first interface name %4 and local addresses %5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3012,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:59.235084+00:00",
    "event_record_id": 27,
    "correlation": {
      "ActivityID": "EF3E8619-3C1A-466E-87D4-27258CCCF136"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "85.65.42.20.in-addr.arpa.",
    "NetworkIndex": 0,
    "InterfaceCount": 1,
    "AdapterName": "Ethernet",
    "LocalAddress": "10.2.10.21",
    "ClientPID": 3516,
    "QueryBlob": "0x1b11f6395c0"
  },
  "message": ""
}

Description

NETBIOS query is completed for name QueryName with status Status and results QueryResults.

Message #

NETBIOS query is completed for name %1 with status %2 and results %3

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3013,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:59.235292+00:00",
    "event_record_id": 29,
    "correlation": {
      "ActivityID": "EF3E8619-3C1A-466E-87D4-27258CCCF136"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 7952
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "85.65.42.20.in-addr.arpa.",
    "Status": 121,
    "QueryResults": "",
    "ClientPID": 3516,
    "QueryBlob": "0x1b11f6395c0"
  },
  "message": ""
}

Description

NETBIOS query for the name QueryName is pending.

Message #

NETBIOS query for the name %1 is pending

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3014,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:59.235275+00:00",
    "event_record_id": 28,
    "correlation": {
      "ActivityID": "EF3E8619-3C1A-466E-87D4-27258CCCF136"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "85.65.42.20.in-addr.arpa.",
    "ClientPID": 3516,
    "QueryBlob": "0x1b11f6395c0"
  },
  "message": ""
}

Description

DnsQueryEx is canceled for the name QueryName.

Message #

DnsQueryEx is canceled for the name %1

Fields #

Description

Cache lookup called for name QueryName, type QueryType, options QueryOptions and interface index InterfaceIndex.

Message #

Cache lookup called for name %1, type %2, options %3 and interface index %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3016,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.037130+00:00",
    "event_record_id": 7,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "QueryOptions": 722827741266862080,
    "InterfaceIndex": 0,
    "ClientPID": 3384,
    "QueryBlob": "0x1b11f66d1a0"
  },
  "message": ""
}

Description

Cache lookup for name QueryName, type QueryType and option QueryOptions returned Status with results QueryResults.

Message #

Cache lookup for name %1, type %2 and option %3 returned %4 with results %5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3018,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.037138+00:00",
    "event_record_id": 8,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "QueryOptions": 722827741266862080,
    "Status": 9701,
    "QueryResults": "",
    "ClientPID": 3384,
    "QueryBlob": "0x1b11f66d1a0"
  },
  "message": ""
}

Description

Query wire called for name QueryName, type QueryType, interface index InterfaceIndex and network index NetworkIndex.

Message #

Query wire called for name %1, type %2, interface index %3 and network index %4

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3019,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.037151+00:00",
    "event_record_id": 9,
    "correlation": {
      "ActivityID": "98BC0724-3B37-4F5C-B2FF-8A9EF612845C"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "InterfaceIndex": 0,
    "NetworkIndex": 0,
    "ClientPID": 3384,
    "QueryBlob": "0x1b11f66d1a0"
  },
  "message": ""
}

Description

Query response for name QueryName, type QueryType, interface index NetworkIndex and network index InterfaceIndex returned Status with results QueryResults.

Message #

Query response for name %1, type %2, interface index %3 and network index %4 returned %5 with results %6

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Client",
    "guid": "1C95126E-7EEA-49A9-A3FE-A378B03DDB4D",
    "event_source_name": "",
    "event_id": 3020,
    "version": 2,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T19:59:57.072612+00:00",
    "event_record_id": 14,
    "correlation": {
      "ActivityID": "7D9A141D-3061-4B6F-A6EE-D4CEE18DB90D"
    },
    "execution": {
      "process_id": 1732,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-DNS-Client/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "QueryName": "us-v20.events.endpoint.security.microsoft.com",
    "QueryType": 1,
    "NetworkIndex": 0,
    "InterfaceIndex": 0,
    "Status": 0,
    "QueryResults": "type: 5 us-v20.events.data.trafficmanager.net;type: 5 onedscolprdeus05.eastus.cloudapp.azure.com;20.42.65.85;",
    "ClientPID": 3384,
    "QueryBlob": "0x1b11f66d1a0"
  },
  "message": ""
}

Description

Initiating resolver operation OperationName, name Name, flag Flag, client PID ClientPID.

Message #

Initiating resolver operation %1, name %2, flag %3, client PID %4

Fields #

Description

Server ActualServer failed to validate DDR certificate for original address OriginalServer with status Status.

Message #

Server %1 failed to validate DDR certificate for original address %2 with status %3

Fields #

Message #

Unable to start DNS Client service. Could not start the Remote Procedure Call (RPC) interface for this service. To correct the problem, you may restart the RPC and DNS Client services. To do so, use the following commands at a command prompt: (1) type 'net start rpc' to start the RPC service, and (2) type 'net start dnscache' to start the DNS Client service. See event details for specific error code information.

Fields #

Message #

Unable to start DNS Client service because the system failed to allocate memory and may be out of available memory. Try closing any applications not in use or reboot the computer. See event details for specific error code information.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS Server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The cause of this DNS registration failure was because the DNS update request timed out after being sent to the specified DNS Server. This is probably because the authoritative DNS server for the name being updated is not running.

You can manually retry registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still  persist, contact your network systems administrator to verify network conditions.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The cause of this DNS registration failure was because of DNS server failure. This may be due to a zone transfer that has locked the DNS server for the applicable zone that your computer needs to register itself with.

(The applicable zone should typically correspond to the Adapter-specific Domain Suffix that was indicated above.) You can manually retry registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your network systems administrator to verify network conditions.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The reason it could not register was because either: (a) the DNS server does not support the DNS dynamic update protocol, or (b) the primary zone authoritative for the registering names does not currently accept dynamic updates.

To add or register a DNS host (A or AAAA) resource record using the specific DNS name for this adapter, contact your DNS server or network systems administrator.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The reason it could not register was because the DNS server refused the dynamic update request. This could happen for the following reasons: (a) current DNS update policies do not allow this computer to update the DNS domain name configured for this adapter, or (b) the authoritative DNS server for this DNS domain name does not support the DNS dynamic update protocol.

To register a DNS host (A or AAAA) resource record using the specific DNS domain name for this adapter, contact your DNS server or network systems administrator.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The system could not register the DNS update request because of a security related problem. This could happen for the following reasons: (a) the DNS domain name that your computer is trying to register could not be updated because your computer does not have the right permissions, or (b) there might have been a problem negotiating valid credentials with the DNS server to update.

You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

Fields #

Description

The system failed to register network adapter with settings.

Message #

The system failed to register network adapter with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address(es) :
             %6

The reason the DNS update request could not be completed was because of a system problem. You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

Fields #

Description

The system failed to register pointer (PTR) resource records (RRs) for network adapter.

Message #

The system failed to register pointer (PTR) resource records (RRs) for network adapter
with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address :
             %6

The reason that the system could not register these RRs was because the update request that was sent to the specified DNS server timed out. This is probably because the authoritative DNS server for the name being registered is not running.

You can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

Fields #

Description

The system failed to register pointer (PTR) resource records (RRs) for network adapter.

Message #

The system failed to register pointer (PTR) resource records (RRs) for network adapter
with settings:

           Adapter Name : %1
           Host Name : %2
           Adapter-specific Domain Suffix : %3
           DNS server list :
             %4
           Sent update to server : %5
           IP Address :
             %6

The cause was DNS server failure. This may be because the reverse lookup zone is busy or missing on the DNS server that your computer needs to update. In most cases, this is a minor problem because it does not affect normal (forward) name resolution.

If reverse (address-to-name) resolution is required for your computer, you can manually retry DNS registration of the network adapter and its settings by typing 'ipconfig /registerdns' at the command prompt. If problems still persist, contact your DNS server or network systems administrator. See event details for specific error code information.

Fields #