detection.wiki

Microsoft-Windows-CCFFilter

EventTitleChannelSampleRule
2000Reopen for Clustered Client Failover registered application has failed for …OperationalNN

Event ID 2000: Reopen for Clustered Client Failover registered application has failed for FileObject FileObject to ObjectName with status Status.

#
Channel
Operational

Message #

Reopen for Clustered Client Failover registered application has failed for FileObject %2 to %4 with status %1

Fields #

NameDescription
Status UInt32NTSTATUS reference
FileObject Pointer
ObjectNameLength UInt16
ObjectName UnicodeString

Provenance

ETW provider GUID 587d333f-e0ed-4597-9927-2bffce7b1f4e

Defined in CCFFilter.sys, the binary that emits these events.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB