Microsoft-Windows-TerminalServices-TSFairShare-Events

30 events across 4 channels

Event	Title	Channel
2	Event ID 2	Operational
2	Event ID 2	Debug
3	Event ID 3	Operational
3	Event ID 3	Debug
4	Event ID 4	Operational
4	Event ID 4	Analytic
5	Event ID 5	Operational
5	Event ID 5	Analytic
6	Event ID 6	Operational
6	Event ID 6	Debug
7	Event ID 7	Operational
7	Event ID 7	Debug
8	Event ID 8	Operational
8	Event ID 8	Analytic
9	Event ID 9	Operational
9	Event ID 9	Analytic
10	Event ID 10	Operational
10	Event ID 10	Analytic
256	Event ID 256	Operational
256	Remote Desktop Services Fair Share started.	System
257	Event ID 257	Operational
257	Remote Desktop Services Fair Share stopped.	System
258	Event ID 258	Operational
258	Remote Desktop Services Disk Fair Share started.	System
259	Event ID 259	Operational
259	Remote Desktop Services Disk Fair Share stopped.	System
272	Event ID 272	Operational
272	Remote Desktop Services Disk Fair Share has detected excessive disk activity for …	System
273	Event ID 273	Operational
273	Remote Desktop Services Disk Fair Share detected that disk activity for session …	System

Event ID 2:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 2:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 3:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 3:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 4:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 4:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 5:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 5:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 6:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 6:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 7:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 7:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 8:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 8:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 9:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 9:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 10:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 10:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 256:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Fair Share started.

Event ID 256: Remote Desktop Services Fair Share started.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Fair Share started.

Message #

Remote Desktop Services Fair Share started.

Event ID 257:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Fair Share stopped.

Event ID 257: Remote Desktop Services Fair Share stopped.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Fair Share stopped.

Message #

Remote Desktop Services Fair Share stopped.

Event ID 258:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Disk Fair Share started.

Event ID 258: Remote Desktop Services Disk Fair Share started.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Disk Fair Share started.

Message #

Remote Desktop Services Disk Fair Share started.

Event ID 259:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Disk Fair Share stopped.

Event ID 259: Remote Desktop Services Disk Fair Share stopped.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Disk Fair Share stopped.

Message #

Remote Desktop Services Disk Fair Share stopped.

Event ID 272:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session . The session is in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 272: Remote Desktop Services Disk Fair Share has detected excessive disk activity for session Param1.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session Param1. The session is in restrain mode.

Message #

Remote Desktop Services Disk Fair Share has detected excessive disk activity for session %1. The session is in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 273:

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: Operational

Description

Remote Desktop Services Disk Fair Share detected that disk activity for session is back to normal. The session is no longer in restrain mode.

Fields #

Name	Description
`Param1` Int32

Event ID 273: Remote Desktop Services Disk Fair Share detected that disk activity for session Param1 is back to normal.

Provider: Microsoft-Windows-TerminalServices-TSFairShare-Events
Channel: System

Description

Remote Desktop Services Disk Fair Share detected that disk activity for session Param1 is back to normal. The session is no longer in restrain mode.

Message #

Remote Desktop Services Disk Fair Share detected that disk activity for session %1 is back to normal. The session is no longer in restrain mode.

Fields #

Name	Description
`Param1` Int32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)