Microsoft-Windows-SMBWitnessService

72 events across 2 channels

Event	Title	Channel
1	Witness Service initialization failed with ErrorCode.	Admin
1	Event ID 1	Operational
2	Witness Service protocol security callback failure (Error = ErrorCode, …	Admin
2	Event ID 2	Operational
3	Witness Service received a registration request from Witness Client (ClientName) …	Admin
3	Event ID 3	Operational
4	Witness Service successfully registered request from Witness Client (ClientName) …	Admin
4	Event ID 4	Operational
5	Witness Service registration request from Witness Client (ClientName) for …	Admin
5	Event ID 5	Operational
6	Witness Service is queuing notifications for Clients clients.	Admin
6	Event ID 6	Operational
7	Witness Service completed queuing notifications for Clients clients.	Admin
7	Event ID 7	Operational
8	Witness Service resource notification to Witness Client (ClientName) failed with …	Admin
8	Event ID 8	Operational
9	Witness Service sent NumResources resource events to Witness Client …	Admin
9	Event ID 9	Operational
10	Witness Service received a move client request for client (ClientName).	Admin
10	Event ID 10	Operational
11	Witness Service successfully sent a move request to client (ClientName).	Admin
11	Event ID 11	Operational
12	Witness Service ignored the move client request for client (ClientName).	Admin
12	Event ID 12	Operational
13	Witness Service ignored the move client request for client (ClientName).	Admin
13	Event ID 13	Operational
14	Witness Service reported a failure (ErrorCode) to move client (ClientName).	Admin
14	Event ID 14	Operational
15	Witness Service received witness unregister request from Witness Client …	Admin
15	Event ID 15	Operational
16	Witness Service removed registration for Witness Client (ClientName).	Admin
16	Event ID 16	Operational
17	Witness Service shutdown failed with error (ErrorCode).	Admin
17	Event ID 17	Operational
18	Witness Service successfully sent the list of Witness Servers to Client …	Admin
18	Event ID 18	Operational
19	Witness Service is retrying to process the list of Witness Servers to Client …	Admin
19	Event ID 19	Operational
20	Witness Service failed to process the list of Witness Servers for Client …	Admin
20	Event ID 20	Operational
21	Witness Service failed to move client (ClientName).	Admin
21	Event ID 21	Operational
22	Witness Service failed to move client (ClientName).	Admin
22	Event ID 22	Operational
23	Witness Service failed to move client (ClientName) to destination node …	Admin
23	Event ID 23	Operational
24	Witness Service received a registration request from Witness Client (ClientName) …	Admin
24	Event ID 24	Operational
25	Witness Service successfully registered request from Witness Client (ClientName) …	Admin
25	Event ID 25	Operational
26	Witness Service registration request from Witness Client (ClientName) for …	Admin
26	Event ID 26	Operational
27	Witness Service received witness unregister request from Witness Client …	Admin
27	Event ID 27	Operational
28	Witness Service is queuing share move notifications for Clients clients.	Admin
28	Event ID 28	Operational
29	Witness Service completed queuing share move notifications for Clients clients.	Admin
29	Event ID 29	Operational
30	Witness Service share move notification to Witness Client (ClientName) failed …	Admin
30	Event ID 30	Operational
31	Witness Service sent NumResources share move events to Witness Client …	Admin
31	Event ID 31	Operational
32	Witness Service is queuing IP notifications for Clients clients.	Admin
32	Event ID 32	Operational
33	Witness Service completed queuing IP notifications for Clients clients.	Admin
33	Event ID 33	Operational
34	Witness Service IP notification to Witness Client (ClientName) failed with error …	Admin
34	Event ID 34	Operational
35	Witness Service sent NumResources IP events to Witness Client (ClientName).	Admin
35	Event ID 35	Operational
36	Witness Service is requesting to move an SMB client that is optimized to connect …	Admin
36	Event ID 36	Operational

Event ID 1: Witness Service initialization failed with ErrorCode.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service initialization failed with ErrorCode.

Message #

Witness Service initialization failed with %1

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 1:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service initialization failed with.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 2: Witness Service protocol security callback failure (Error = ErrorCode, Authentication Level = AuthenticationLevel, Authentication Service = AuthenticationService).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service protocol security callback failure (Error = ErrorCode, Authentication Level = AuthenticationLevel, Authentication Service = AuthenticationService).

Message #

Witness Service protocol security callback failure (Error = %3, Authentication Level = %1, Authentication Service = %2)

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 2:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service protocol security callback failure (Error = , Authentication Level = , Authentication Service = ).

Fields #

Name	Description
`AuthenticationLevel` UInt32
`AuthenticationService` UInt32
`ErrorCode` UInt32

Event ID 3: Witness Service received a registration request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a registration request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service received a registration request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 3:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a registration request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4: Witness Service successfully registered request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully registered request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service successfully registered request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 4:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 5: Witness Service registration request from Witness Client (ClientName) for NetName \\NetName failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service registration request from Witness Client (ClientName) for NetName \\NetName failed with error (ErrorCode).

Message #

Witness Service registration request from Witness Client (%1) for NetName \\%2 failed with error (%3)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 5:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service registration request from Witness Client () for NetName \\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ErrorCode` Int32

Event ID 6: Witness Service is queuing notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing notifications for Clients clients.

Message #

Witness Service is queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 6:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 7: Witness Service completed queuing notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing notifications for Clients clients.

Message #

Witness Service completed queuing notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 7:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 8: Witness Service resource notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service resource notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service resource notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 8:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service resource notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 9: Witness Service sent NumResources resource events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources resource events to Witness Client (ClientName).

Message #

Witness Service sent %1 resource events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 9:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent resource events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 10: Witness Service received a move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a move client request for client (ClientName).

Message #

Witness Service received a move client request for client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 10:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a move client request for client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11: Witness Service successfully sent a move request to client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully sent a move request to client (ClientName).

Message #

Witness Service successfully sent a move request to client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 11:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully sent a move request to client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12: Witness Service ignored the move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Client is not registered with current Witness Service.

Message #

Witness Service ignored the move client request for client (%1). Client is not registered with current Witness Service

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 12:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service ignored the move client request for client (). Client is not registered with current Witness Service.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 13: Witness Service ignored the move client request for client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service ignored the move client request for client (ClientName). Destination server (ServerName) is unavailable.

Message #

Witness Service ignored the move client request for client (%1). Destination server (%2) is unavailable

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 13:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service ignored the move client request for client (). Destination server () is unavailable.

Fields #

Name	Description
`ClientName` UnicodeString
`ServerName` UnicodeString

Event ID 14: Witness Service reported a failure (ErrorCode) to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service reported a failure (ErrorCode) to move client (ClientName).

Message #

Witness Service reported a failure (%1) to move client (%2)

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 14:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service reported a failure () to move client ().

Fields #

Name	Description
`ErrorCode` UInt32
`ClientName` UnicodeString

Event ID 15: Witness Service received witness unregister request from Witness Client (ClientName) for NetName \\NetName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received witness unregister request from Witness Client (ClientName) for NetName \\NetName.

Message #

Witness Service received witness unregister request from Witness Client (%1) for NetName \\%2

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 15:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for NetName \\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString

Event ID 16: Witness Service removed registration for Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service removed registration for Witness Client (ClientName).

Message #

Witness Service removed registration for Witness Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 16:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service removed registration for Witness Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 17: Witness Service shutdown failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service shutdown failed with error (ErrorCode).

Message #

Witness Service shutdown failed with error (%1)

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 17:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service shutdown failed with error ().

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 18: Witness Service successfully sent the list of Witness Servers to Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully sent the list of Witness Servers to Client (ClientName).

Message #

Witness Service successfully sent the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 18:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully sent the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19: Witness Service is retrying to process the list of Witness Servers to Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is retrying to process the list of Witness Servers to Client (ClientName).

Message #

Witness Service is retrying to process the list of Witness Servers to Client (%1)

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 19:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is retrying to process the list of Witness Servers to Client ().

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 20: Witness Service failed to process the list of Witness Servers for Client (ClientName) with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to process the list of Witness Servers for Client (ClientName) with error (ErrorCode).

Message #

Witness Service failed to process the list of Witness Servers for Client (%1) with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 20:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to process the list of Witness Servers for Client () with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 21: Witness Service failed to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName). Client name is invalid.

Message #

Witness Service failed to move client (%1). Client name is invalid

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 21:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client (). Client name is invalid.

Fields #

Name	Description
`ClientName` UnicodeString

Event ID 22: Witness Service failed to move client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName). Destination node (DestinationNode) is invalid.

Message #

Witness Service failed to move client (%1). Destination node (%2) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 22:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client (). Destination node () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString

Event ID 23: Witness Service failed to move client (ClientName) to destination node (DestinationNode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service failed to move client (ClientName) to destination node (DestinationNode). NetName (NetName) is invalid.

Message #

Witness Service failed to move client (%1) to destination node (%2). NetName (%3) is invalid

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 23:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service failed to move client () to destination node (). NetName () is invalid.

Fields #

Name	Description
`ClientName` UnicodeString
`DestinationNode` UnicodeString
`NetName` UnicodeString

Event ID 24: Witness Service received a registration request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received a registration request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service received a registration request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 24:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received a registration request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25: Witness Service successfully registered request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service successfully registered request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service successfully registered request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 25:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service successfully registered request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 26: Witness Service registration request from Witness Client (ClientName) for \\NetName\ShareName failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service registration request from Witness Client (ClientName) for \\NetName\ShareName failed with error (ErrorCode).

Message #

Witness Service registration request from Witness Client (%1) for \\%2\%3 failed with error (%4)

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 26:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service registration request from Witness Client () for \\\ failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString
`ErrorCode` Int32

Event ID 27: Witness Service received witness unregister request from Witness Client (ClientName) for \\NetName\ShareName.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service received witness unregister request from Witness Client (ClientName) for \\NetName\ShareName.

Message #

Witness Service received witness unregister request from Witness Client (%1) for \\%2\%3

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 27:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service received witness unregister request from Witness Client () for \\\.

Fields #

Name	Description
`ClientName` UnicodeString
`NetName` UnicodeString
`ShareName` UnicodeString

Event ID 28: Witness Service is queuing share move notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing share move notifications for Clients clients.

Message #

Witness Service is queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 28:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 29: Witness Service completed queuing share move notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing share move notifications for Clients clients.

Message #

Witness Service completed queuing share move notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 29:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing share move notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 30: Witness Service share move notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service share move notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service share move notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 30:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service share move notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 31: Witness Service sent NumResources share move events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources share move events to Witness Client (ClientName).

Message #

Witness Service sent %1 share move events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 31:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent share move events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 32: Witness Service is queuing IP notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service is queuing IP notifications for Clients clients.

Message #

Witness Service is queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 32:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service is queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 33: Witness Service completed queuing IP notifications for Clients clients.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service completed queuing IP notifications for Clients clients.

Message #

Witness Service completed queuing IP notifications for %1 clients

Fields #

Name	Description
`Clients` UInt64

Event ID 33:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service completed queuing IP notifications for clients.

Fields #

Name	Description
`Clients` UInt64

Event ID 34: Witness Service IP notification to Witness Client (ClientName) failed with error (ErrorCode).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service IP notification to Witness Client (ClientName) failed with error (ErrorCode).

Message #

Witness Service IP notification to Witness Client (%1) failed with error (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 34:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service IP notification to Witness Client () failed with error ().

Fields #

Name	Description
`ClientName` UnicodeString
`ErrorCode` UInt32

Event ID 35: Witness Service sent NumResources IP events to Witness Client (ClientName).

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Description

Witness Service sent NumResources IP events to Witness Client (ClientName).

Message #

Witness Service sent %1 IP events to Witness Client (%2)

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 35:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Description

Witness Service sent IP events to Witness Client ().

Fields #

Name	Description
`NumResources` Int32
`ClientName` UnicodeString

Event ID 36: Witness Service is requesting to move an SMB client that is optimized to connect to a specific SMB server for one or more file shares.

Provider: Microsoft-Windows-SMBWitnessService
Channel: Admin

Message #

Witness Service is requesting to move an SMB client (%1) that is optimized to connect to a specific SMB server for one or more file shares. After requested move completes, the SMB client will attempt to move to the optimal SMB server for (%2)

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Event ID 36:

Provider: Microsoft-Windows-SMBWitnessService
Channel: Operational

Fields #

Name	Description
`ClientName` UnicodeString
`ShareName` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID ce704b50-b105-4bc8-a24f-1792c0401c2a

Defined in Witness.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893 · schema read from the registered manifest · binary version 10.0.20348.1 · captured 2026-06-02

Downloads

Microsoft-Windows-SMBWitnessService registered manifest XML (WS2022-20348.4893) manifest-xml

Credits

Microsoft - authored the ETW manifests and PDBs the schema comes from
jdu2600 - the event-schema TSV format this catalog adopted
nasbench - the tool that dumps registered providers and manifests

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)