Microsoft-Windows-ServicesForNFS-Cluster

32 events across 2 channels

Event	Title	Channel
14200	Event ID 14200	Operational
14200	Server for Network File System is not installed.	System
14201	Event ID 14201	Operational
14201	Failed to remove share ShareName from Network File System server.	System
14202	Event ID 14202	Operational
14202	Failed to bring the share ShareName online.	System
14203	Event ID 14203	Operational
14203	Unable to create or modify share.	System
14204	Event ID 14204	Operational
14204	Unable to create share with path SharePath.	System
14205	Event ID 14205	Operational
14205	Unable to create share with path SharePath.	System
14206	Event ID 14206	Operational
14206	Unable to modify share SharePath as it does not exist.	System
14207	Event ID 14207	Operational
14207	Unable to create share as the path SharePath has already been shared.	System
14208	Event ID 14208	Operational
14208	Cannot share directory SharePath with the given encoding option since a required …	System
14209	Event ID 14209	Operational
14209	Unable to create share with path SharePath.	System
14210	Event ID 14210	Operational
14210	Unable to create share with path SharePath.	System
14211	Event ID 14211	Operational
14211	Failed to bring the share ShareName online.	System
14212	Event ID 14212	Operational
14212	Network File System resource failed to open service control manager to register …	System
14213	Event ID 14213	Operational
14213	Network File System resource failed to register for service status change …	System
14214	Event ID 14214	Operational
14214	Unable to create share as the share name ShareName is already in use.	System
14215	Event ID 14215	Operational
14215	Server for NFS is not running.	System

Event ID 14200:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Server for Network File System is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString

Event ID 14200: Server for Network File System is not installed.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Server for Network File System is not installed.

Message #

Server for Network File System is not installed.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString

Event ID 14201:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Failed to remove share from Network File System server.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14201: Failed to remove share ShareName from Network File System server.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Failed to remove share ShareName from Network File System server.

Message #

Failed to remove share %3 from Network File System server.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14202:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Failed to bring the share online. Network File System resource may not be dependent on disk resource that contains this share path .

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`SharePath` UnicodeString

Event ID 14202: Failed to bring the share ShareName online.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Failed to bring the share ShareName online. Network File System resource ResourceName may not be dependent on disk resource that contains this share path SharePath.

Message #

Failed to bring the share %3 online. Network File System resource %1 may not be dependent on disk resource that contains this share path %4.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`SharePath` UnicodeString

Event ID 14203:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create or modify share. Share path does not exist.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14203: Unable to create or modify share.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create or modify share. Share path SharePath does not exist.

Message #

Unable to create or modify share. Share path %3 does not exist.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14204:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share with path . A parent directory of the path has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14204: Unable to create share with path SharePath.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share with path SharePath. A parent directory of the path has already been shared.

Message #

Unable to create share with path %3. A parent directory of the path has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14205:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share with path . A subdirectory of the path has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14205: Unable to create share with path SharePath.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share with path SharePath. A subdirectory of the path has already been shared.

Message #

Unable to create share with path %3. A subdirectory of the path has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14206:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to modify share as it does not exist.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14206: Unable to modify share SharePath as it does not exist.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to modify share SharePath as it does not exist.

Message #

Unable to modify share %3 as it does not exist.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14207:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share as the path has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14207: Unable to create share as the path SharePath has already been shared.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share as the path SharePath has already been shared.

Message #

Unable to create share as the path %3 has already been shared.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14208:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Cannot share directory with the given encoding option since a required code page is not installed on this machine. Install the appropriate language support and retry.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14208: Cannot share directory SharePath with the given encoding option since a required code page is not installed on this machine.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Cannot share directory SharePath with the given encoding option since a required code page is not installed on this machine. Install the appropriate language support and retry.

Message #

Cannot share directory %3 with the given encoding option since a required code page is not installed on this machine. Install the appropriate language support and retry.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14209:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share with path . The file system in the target volume is not supported by Network File System.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14209: Unable to create share with path SharePath.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share with path SharePath. The file system in the target volume is not supported by Network File System.

Message #

Unable to create share with path %3. The file system in the target volume is not supported by Network File System.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14210:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share with path . Verify if server for Network File System is in running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14210: Unable to create share with path SharePath.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share with path SharePath. Verify if server for Network File System is in running state.

Message #

Unable to create share with path %3. Verify if server for Network File System is in running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`SharePath` UnicodeString

Event ID 14211:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Failed to bring the share online. The failure error code is .

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14211: Failed to bring the share ShareName online.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Failed to bring the share ShareName online. The failure error code is Status.

Message #

Failed to bring the share %3 online. The failure error code is %4.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14212:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Network File System resource failed to open service control manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14212: Network File System resource failed to open service control manager to register for status change notifications.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Network File System resource failed to open service control manager to register for status change notifications.

Message #

Network File System resource failed to open service control manager to register for status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14213:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Network File System resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14213: Network File System resource failed to register for service status change notifications.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Network File System resource failed to register for service status change notifications.

Message #

Network File System resource failed to register for service status change notifications.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 14214:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Unable to create share as the share name is already in use.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString

Event ID 14214: Unable to create share as the share name ShareName is already in use.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Unable to create share as the share name ShareName is already in use.

Message #

Unable to create share as the share name %3 is already in use.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString
`ShareName` UnicodeString

Event ID 14215:

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: Operational

Description

Server for NFS is not running. The Network File System resource can be online only when server for NFS is in running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString

Event ID 14215: Server for NFS is not running.

Provider: Microsoft-Windows-ServicesForNFS-Cluster
Channel: System

Description

Server for NFS is not running. The Network File System resource can be online only when server for NFS is in running state.

Message #

Server for NFS is not running. The Network File System resource can be online only when server for NFS is in running state.

Fields #

Name	Description
`ResourceName` UnicodeString
`ResourceGroup` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID a0cc474a-06ca-427c-bdff-84733163e262

Defined in nfsres.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-ServicesForNFS-Cluster registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)