IIS: FTP Server

Event	Title	Channel	Sample	Rule
1	FtpFileSystemAccess_StartCreateOrDelete	ETW Trace	N	N
2	FtpFileSystemAccess_EndCreateOrDelete	ETW Trace	N	N
3	FtpFileSystemAccess_FailedCreateOrDelete	ETW Trace	N	N
4	FtpSslSchannelCalls_SchannelCall	ETW Trace	N	N
5	FtpFileSystemAccess_EndCreateOrDelete	ETW Trace	N	N
6	FtpFileSystemAccess_FailedCreateOrDelete	ETW Trace	N	N
7	FtpFileSystemAccess_StartCreateOrDelete	ETW Trace	N	N
8	FtpFileSystemAccess_EndCreateOrDelete	ETW Trace	N	N
9	FtpFileSystemAccess_FailedCreateOrDelete	ETW Trace	N	N
10	FtpFileSystemAccess_StartCreateOrDelete	ETW Trace	N	N
11	FtpFileSystemAccess_EndCreateOrDelete	ETW Trace	N	N
12	FtpFileSystemAccess_FailedCreateOrDelete	ETW Trace	N	N
13	FtpFileSystemAccess_StartCreateOrDelete	ETW Trace	N	N
14	FtpFileSystemAccess_EndCreateOrDelete	ETW Trace	N	N
15	FtpFileSystemAccess_FailedCreateOrDelete	ETW Trace	N	N
16	FtpAuthentication_StartClientCertLogon	ETW Trace	N	N
17	FtpAuthentication_EndClientCertLogon	ETW Trace	N	N
18	FtpAuthentication_FailClientCertLogon	ETW Trace	N	N
100	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
101	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
102	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
103	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
104	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
105	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
106	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
107	FtpSslInfo_SslErrorEvents	ETW Trace	N	N
108	FtpSslInfo_SslErrorEvents	ETW Trace	N	N

Event ID 1: FtpFileSystemAccess_StartCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`PreliminarySiteName` mof:String
`ClientIPAddress` mof:String
`ClientPort` mof:UInt16
`ServerIPAddress` mof:String
`ServerPort` mof:UInt16

Event ID 2: FtpFileSystemAccess_EndCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`AuthType` mof:String
`RemoteUserName` mof:String
`AuthUserName` mof:String
`TokenImpersonationLevel` mof:UInt32

Event ID 3: FtpFileSystemAccess_FailedCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`Subject` mof:String
`Issuer` mof:String
`VerificationStatus` mof:UInt32
`MappedToken` mof:Boolean

Event ID 4: FtpSslSchannelCalls_SchannelCall

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`Subject` mof:String
`Issuer` mof:String
`PublicKeySize` mof:UInt32
`HardwareAcceleratorPresent` mof:Boolean

Event ID 5: FtpFileSystemAccess_EndCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ClientIPAddress` mof:String
`ClientPort` mof:UInt16
`ServerIPAddress` mof:String
`ServerPort` mof:UInt16

Event ID 6: FtpFileSystemAccess_FailedCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String
`ReturnValue` mof:UInt32

Event ID 7: FtpFileSystemAccess_StartCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ServerIPAddress` mof:String
`ServerPort` mof:UInt16

Event ID 8: FtpFileSystemAccess_EndCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32

Event ID 9: FtpFileSystemAccess_FailedCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String
`ReturnValue` mof:UInt32

Event ID 10: FtpFileSystemAccess_StartCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String

Event ID 11: FtpFileSystemAccess_EndCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`SubStatus` mof:UInt32	NTSTATUS reference

Event ID 12: FtpFileSystemAccess_FailedCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String
`ReturnValue` mof:UInt32

Event ID 13: FtpFileSystemAccess_StartCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String

Event ID 14: FtpFileSystemAccess_EndCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object

Event ID 15: FtpFileSystemAccess_FailedCreateOrDelete

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`FileName` mof:String
`ReturnValue` mof:UInt32

Event ID 16: FtpAuthentication_StartClientCertLogon

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object

Event ID 17: FtpAuthentication_EndClientCertLogon

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object

Event ID 18: FtpAuthentication_FailClientCertLogon

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32

Event ID 100: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 101: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 102: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 103: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 104: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 105: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 106: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 107: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Event ID 108: FtpSslInfo_SslErrorEvents

Channel: ETW Trace
Source: Trace

Fields #

Name	Description
`SessionId` mof:Object
`ErrorCode` mof:UInt32
`Param1` mof:String
`Param2` mof:String

Provenance

ETW provider GUID {08AB3B7F-DE13-445E-8331-745FD7183ECB}

WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: FtpServiceProvider