| 1 | A referral request has been received. | Analytic | N | N |
| 2 | A DC referral request has been processed. | Analytic | N | N |
| 3 | A root referral request has been processed. | Analytic | N | N |
| 4 | A normal referral request has been processed. | Analytic | N | N |
| 5 | A referral response has been generated. | Analytic | N | N |
| 6 | A referral response has been posted. | Analytic | N | N |
| 11 | NetrDfsAdd arrived. | Analytic | N | N |
| 12 | NetrDfsAdd entered CriticalSection. | Analytic | N | N |
| 21 | NetrDfsRemove arrived. | Analytic | N | N |
| 22 | NetrDfsRemove entered CriticalSection. | Analytic | N | N |
| 31 | NetrDfsSetInfo arrived. | Analytic | N | N |
| 32 | NetrDfsSetInfo entered CriticalSection. | Analytic | N | N |
| 41 | NetrDfsGetInfo arrived. | Analytic | N | N |
| 42 | NetrDfsGetInfo entered CriticalSection. | Analytic | N | N |
| 51 | NetrDfsEnum arrived. | Analytic | N | N |
| 52 | NetrDfsEnum entered CriticalSection. | Analytic | N | N |
| 61 | NetrDfsMove arrived. | Analytic | N | N |
| 62 | NetrDfsMove entered CriticalSection. | Analytic | N | N |
| 71 | NetrDfsAddFtRoot arrived. | Analytic | N | N |
| 72 | NetrDfsAddFtRoot entered CriticalSection. | Analytic | N | N |
| 81 | NetrDfsRemoveFtRoot arrived. | Analytic | N | N |
| 82 | NetrRemoveFtRoot entered CriticalSection. | Analytic | N | N |
| 91 | NetrDfsAddStdRoot arrived. | Analytic | N | N |
| 92 | NetrAddStdRoot entered CriticalSection. | Analytic | N | N |
| 101 | NetrDfsRemoveStdRoot arrived. | Analytic | N | N |
| 102 | NetrRemoveStdRoot entered CriticalSection. | Analytic | N | N |
| 111 | NetrDfsApi left CriticalSection. | Analytic | N | N |
| 112 | LockAcquiredDomainInfo. | Analytic | N | N |
| 121 | LookupRootFolderDone. | Analytic | N | N |
| 131 | LookupLinkFolderDone. | Analytic | N | N |