Microsoft-Windows-DFSN-Server

Event	Title	Channel	Sample	Rule
1	A referral request has been received	Analytic, Operational	N	N
2	A DC referral request has been processed	Analytic, Operational	N	N
3	A root referral request has been processed	Analytic, Operational	N	N
4	A normal referral request has been processed	Analytic, Operational	N	N
5	A referral response has been generated	Analytic, Operational	N	N
6	A referral response has been posted	Analytic, Operational	N	N
7	IP address IpAddress resolved to site SiteName.	Analytic	N	N
7	IP address IpAddress resolved to site	Operational	N	N
11	NetrDfsAdd arrived	Analytic, Operational	N	N
21	NetrDfsRemove arrived	Analytic, Operational	N	N
31	NetrDfsSetInfo arrived	Analytic, Operational	N	N
41	NetrDfsGetInfo arrived	Analytic, Operational	N	N
61	NetrDfsMove arrived	Analytic, Operational	N	N
71	NetrDfsAddFtRoot arrived	Analytic, Operational	N	N
81	NetrDfsRemoveFtRoot arrived	Analytic, Operational	N	N
91	NetrDfsAddStdRoot arrived	Analytic, Operational	N	N
101	NetrDfsRemoveStdRoot arrived	Analytic, Operational	N	N
112	LockAcquiredDomainInfo	Analytic, Operational	N	N
121	LookupRootFolderDone	Analytic, Operational	N	N
131	LookupLinkFolderDone	Analytic, Operational	N	N
191	NetrDfsEnum arrived	Analytic, Operational	N	N
501	Referral request received for dfspath DfsPath from client with IPAddress …	Operational	Y	N
502	DFS has resolved server ServerName to IPAddress ServerIpAddress and site …	Operational	Y	N
503	Failed to obtain IPAddress for server ServerName.	Operational	N	N
504	Failed to resolve IPAddress IpAddress to site name.	Operational	N	N
505	Referral generated for DFS path DfsPath and client whose site is ClientSite.	Operational	Y	N
506	Request for creating new folder or adding target to existing folder completed …	Operational	Y	N
507	Request for deleting a link or removing target of existing link completed with …	Operational	N	N
508	Request to modify properties of DfsPath completed with status Status.	Operational	N	N
509	Request to retrieve properties of DfsPath completed with status Status.	Analytic	N	N
509	Request to retrieve properties of DfsPath completed with status	Operational	N	N
510	Request to enumerate contents of \\DfsPath completed with status Status.	Analytic	N	N
510	Request to enumerate contents of \\DfsPath completed with status	Operational	N	N
511	Request to move dfs folders from DfsPath to NewDfsPath completed with status …	Operational	N	N
512	Request to create a new dfs namespace or add target to existing namespace …	Admin	N	N
512	Request to create a new dfs namespace or add target to existing namespace …	Operational	N	N
513	Request to remove a dfs namespace or remove target from existing namespace …	Admin	N	N
513	Request to remove a dfs namespace or remove target from existing namespace …	Operational	N	N
514	Request to create a new standalone or clustered dfs namespace completed with …	Admin	N	N
514	Request to create a new standalone or clustered dfs namespace completed with …	Operational	N	N
515	Request to remove standalone or clustered dfs namespace completed with status …	Admin	N	N
515	Request to remove standalone or clustered dfs namespace completed with status	Operational	N	N
516	DFSN service has started performing complete refresh of metadata for namespace …	Admin	N	N
516	DFSN service has started performing complete refresh of metadata for namespace	Operational	N	N
517	DFSN service completed performing refresh of metadata for namespace DfsNamespace …	Admin	N	N
517	DFSN service completed performing refresh of metadata for namespace DfsNamespace …	Operational	N	N
518	DFSN service has successfully deleted DFS reparse point DfsReparsepoint on …	Admin	N	N
518	DFSN service has successfully deleted DFS reparse point DfsReparsepoint on …	Operational	N	N
519	DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume …	Admin	N	N
519	DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume …	Operational	N	N
520	The DFS Namespace service could not obtain site costs for the following Active …	Operational	N	N
521	The DFS Namespace service is unable to contact Active Directory Domain Services	Admin, Operational	N	N
522	A DFS folder has incorrect metadata in the registry	Admin, Operational	N	N

Event ID 1: A referral request has been received

Channel: Analytic, Operational
Task: Referral
Opcode: RequestReceived

Fields #

Name	Description
`RequestBuffer` Pointer
`RequestBufferLength` UInt16

Event ID 2: A DC referral request has been processed

Channel: Analytic, Operational
Task: Referral
Opcode: DcRequestProcessed

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: A root referral request has been processed

Channel: Analytic, Operational
Task: Referral
Opcode: RootRequestProcessed

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4: A normal referral request has been processed

Channel: Analytic, Operational
Task: Referral
Opcode: NormalRequestProcessed

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 5: A referral response has been generated

Channel: Analytic, Operational
Task: Referral
Opcode: ResponseGenerated

Fields #

Name	Description
`Request` Pointer
`Response` Pointer
`Status` UInt32	NTSTATUS reference
`ResponseLength` UInt16

Event ID 6: A referral response has been posted

Channel: Analytic, Operational
Task: Referral
Opcode: ResponsePosted

Fields #

Name	Description
`Response` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 7: IP address IpAddress resolved to site SiteName.

Channel: Analytic
Task: Referral
Opcode: ResponsePosted

Message #

IP address %1 resolved to site %2.

Fields #

Name	Description
`IpAddress` UnicodeString
`SiteName` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Event ID 7: IP address IpAddress resolved to site

Channel: Operational
Task: Referral
Opcode: ResponsePosted

Description

IP address resolved to site .

Fields #

Name	Description
`IpAddress` UnicodeString
`SiteName` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Event ID 11: NetrDfsAdd arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: AddArrived

Event ID 21: NetrDfsRemove arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: RemoveArrived

Event ID 31: NetrDfsSetInfo arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: SetInfoArrived

Event ID 41: NetrDfsGetInfo arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: GetInfoArrived

Event ID 61: NetrDfsMove arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: MoveArrived

Event ID 71: NetrDfsAddFtRoot arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: AddFtRootArrived

Event ID 81: NetrDfsRemoveFtRoot arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: RemoveFtRootArrived

Event ID 91: NetrDfsAddStdRoot arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: AddStdRootArrived

Event ID 101: NetrDfsRemoveStdRoot arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: RemoveStdRootArrived

Event ID 112: LockAcquiredDomainInfo

Channel: Analytic, Operational
Task: Lock
Opcode: LockAcquiredDomainInfo

Event ID 121: LookupRootFolderDone

Channel: Analytic, Operational
Task: Lookup
Opcode: LookupRootFolderDone

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 131: LookupLinkFolderDone

Channel: Analytic, Operational
Task: Lookup
Opcode: LookupLinkFolderDone

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 191: NetrDfsEnum arrived

Channel: Analytic, Operational
Task: NetrDfs
Opcode: EnumArrived

Event ID 501: Referral request received for dfspath DfsPath from client with IPAddress ClientIpAddress and site ClientSite.

Channel: Operational
Level: Informational
Task: Referral

Message #

Referral request received for dfspath %1 from client with IPAddress %2 and site %3.

Fields #

Name	Description
`DfsPath` UnicodeString
`ClientIpAddress` UnicodeString
`ClientSite` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 1152921504606846977,
    "time_created": "2026-03-13T20:05:06.467486+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-000B-87F7-838B21B3DC01"
    },
    "execution": {
      "process_id": 4148,
      "thread_id": 4796
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "",
    "ClientIpAddress": "10.2.10.21",
    "ClientSite": "Default-First-Site-Name"
  },
  "message": ""
}

Event ID 502: DFS has resolved server ServerName to IPAddress ServerIpAddress and site ServerSite.

Channel: Operational
Task: Referral

Message #

DFS has resolved server %1 to IPAddress %2 and site %3.

Fields #

Name	Description
`ServerName` UnicodeString
`ServerIpAddress` UnicodeString
`ServerSite` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "event_id": 502,
    "level": "Information",
    "task": "Referral",
    "opcode": "Info",
    "time_created": "2026-04-18T22:00:41.1486364+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-DFSN-Server/Operational"
  },
  "event_data": {
    "ServerIpAddress": "::1",
    "ServerName": "JD-DC01-2022.ludus.domain",
    "ServerSite": "Default-First-Site-Name",
    "TimeConsumedToResolveInMilliSeconds": "0"
  }
}

Event ID 503: Failed to obtain IPAddress for server ServerName.

Channel: Operational
Task: Referral

Description

Failed to obtain IPAddress for server ServerName. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to obtain IPAddress for server %1. This may cause the client to access high-cost or out-of-site targets.

Fields #

Name	Description
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 504: Failed to resolve IPAddress IpAddress to site name.

Channel: Operational
Task: Referral

Description

Failed to resolve IPAddress IpAddress to site name. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to resolve IPAddress %1 to site name. This may cause the client to access high-cost or out-of-site targets.

Fields #

Name	Description
`IpAddress` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 505: Referral generated for DFS path DfsPath and client whose site is ClientSite.

Channel: Operational
Task: Referral

Description

Referral generated for DFS path DfsPath and client whose site is ClientSite. Targets information can be found in the event payload.

Message #

Referral generated for DFS path %2 and client whose site is %3. Targets information can be found in the event payload.

Fields #

Name	Description
`DfsPathLength` UInt16
`DfsPath` UnicodeString
`ClientSite` UnicodeString
`TargetCount` UInt32
`DfsTarget` Int16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "event_id": 505,
    "level": "Information",
    "task": "Referral",
    "opcode": "Info",
    "time_created": "2026-04-18T22:00:41.1499001+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-DFSN-Server/Operational"
  },
  "event_data": {}
}

Event ID 506: Request for creating new folder or adding target to existing folder completed with status:Status.

Channel: Operational
Level: Informational
Task: NetrDfs
Opcode: AddCompleted

Description

Request for creating new folder or adding target to existing folder completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for creating new folder or adding target to existing folder completed with status:%6. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 506,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 41,
    "keywords": 1152921504606846978,
    "time_created": "2026-03-13T20:45:53.834051+00:00",
    "event_record_id": 296,
    "correlation": {},
    "execution": {
      "process_id": 4148,
      "thread_id": 3744
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "\\ludus.domain\\TestDFS\\Folder1",
    "ServerName": "LAB-DC01",
    "ShareName": "TestDFS\\Folder1",
    "Comment": "NULL",
    "Flags": 1,
    "Status": 1168,
    "TimeConsumedInMilliSeconds": 0
  },
  "message": ""
}

Event ID 507: Request for deleting a link or removing target of existing link completed with status:Status.

Channel: Operational
Task: NetrDfs
Opcode: RemoveCompleted

Description

Request for deleting a link or removing target of existing link completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for deleting a link or removing target of existing link completed with status:%4. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 508: Request to modify properties of DfsPath completed with status Status.

Channel: Operational
Task: NetrDfs
Opcode: SetInfoCompleted

Message #

Request to modify properties of %1 completed with status %5.

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 509: Request to retrieve properties of DfsPath completed with status Status.

Channel: Analytic
Task: NetrDfs
Opcode: GetInfoCompleted

Message #

Request to retrieve properties of %1 completed with status %5.

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 509: Request to retrieve properties of DfsPath completed with status

Channel: Operational
Task: NetrDfs
Opcode: GetInfoCompleted

Description

Request to retrieve properties of completed with status .

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 510: Request to enumerate contents of \\DfsPath completed with status Status.

Channel: Analytic
Task: NetrDfs
Opcode: EnumCompleted

Message #

Request to enumerate contents of \\%1 completed with status %4.

Fields #

Name	Description
`DfsPath` UnicodeString
`Level` UInt32
`PreferredMaxLength` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 510: Request to enumerate contents of \\DfsPath completed with status

Channel: Operational
Task: NetrDfs
Opcode: EnumCompleted

Description

Request to enumerate contents of \\ completed with status .

Fields #

Name	Description
`DfsPath` UnicodeString
`Level` UInt32
`PreferredMaxLength` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 511: Request to move dfs folders from DfsPath to NewDfsPath completed with status Status.

Channel: Operational
Task: NetrDfs
Opcode: MoveCompleted

Message #

Request to move dfs folders from %1 to %2 completed with status %4.

Fields #

Name	Description
`DfsPath` UnicodeString
`NewDfsPath` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 512: Request to create a new dfs namespace or add target to existing namespace completed with status Status.

Channel: Admin
Task: NetrDfs
Opcode: AddFtRootCompleted

Description

Request to create a new dfs namespace or add target to existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new dfs namespace or add target to existing namespace completed with status %6. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 512: Request to create a new dfs namespace or add target to existing namespace completed with status

Channel: Operational
Task: NetrDfs
Opcode: AddFtRootCompleted

Description

Request to create a new dfs namespace or add target to existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 513: Request to remove a dfs namespace or remove target from existing namespace completed with status Status.

Channel: Admin
Task: NetrDfs
Opcode: RemoveFtRootCompleted

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove a dfs namespace or remove target from existing namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 513: Request to remove a dfs namespace or remove target from existing namespace completed with status

Channel: Operational
Task: NetrDfs
Opcode: RemoveFtRootCompleted

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 514: Request to create a new standalone or clustered dfs namespace completed with status Status.

Channel: Admin
Task: NetrDfs
Opcode: AddStdRootCompleted

Description

Request to create a new standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new standalone or clustered dfs namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 514: Request to create a new standalone or clustered dfs namespace completed with status

Channel: Operational
Task: NetrDfs
Opcode: AddStdRootCompleted

Description

Request to create a new standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 515: Request to remove standalone or clustered dfs namespace completed with status Status.

Channel: Admin
Task: NetrDfs
Opcode: RemoveStdRootCompleted

Description

Request to remove standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove standalone or clustered dfs namespace completed with status %4. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 515: Request to remove standalone or clustered dfs namespace completed with status

Channel: Operational
Task: NetrDfs
Opcode: RemoveStdRootCompleted

Description

Request to remove standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 516: DFSN service has started performing complete refresh of metadata for namespace DfsNamespace.

Channel: Admin

Description

DFSN service has started performing complete refresh of metadata for namespace . This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Message #

DFSN service has started performing complete refresh of metadata for namespace %1. This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32

Event ID 516: DFSN service has started performing complete refresh of metadata for namespace

Channel: Operational

Description

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32

Event ID 517: DFSN service completed performing refresh of metadata for namespace DfsNamespace with status Status.

Channel: Admin

Description

DFSN service completed performing refresh of metadata for namespace DfsNamespace with status Status. Time taken to perform this operation TimeConsumedInMilliSeconds milliseconds.

Message #

DFSN service completed performing refresh of metadata for namespace %1 with status %4. Time taken to perform this operation %5 milliseconds.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 517: DFSN service completed performing refresh of metadata for namespace DfsNamespace with status

Channel: Operational

Description

DFSN service completed performing refresh of metadata for namespace with status . Time taken to perform this operation milliseconds.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 518: DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume VolumeName.

Channel: Admin

Description

DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume VolumeName. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Message #

DFSN service has successfully deleted DFS reparse point %1 on volume %3. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 518: DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume

Channel: Operational

Description

DFSN service has successfully deleted DFS reparse point on volume . The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 519: DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status Status.

Channel: Admin

Description

DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status Status. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Message #

DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status %4. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 519: DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status

Channel: Operational

Description

DFSN service has failed to deleted DFS reparse point on volume with status . The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 520: The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: ADSite.

Channel: Operational
Task: Referral

Description

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: ADSite. This might cause clients to access folder targets in other sites. Error code: Status.

Message #

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: %1. This might cause clients to access folder targets in other sites. Error code: %2.

Fields #

Name	Description
`ADSite` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 521: The DFS Namespace service is unable to contact Active Directory Domain Services

Channel: Admin, Operational
Task: NetrDfs

Message #

The DFS Namespace service is unable to contact Active Directory Domain Services. 

Domain: %1 
Domain Controller: %2 
LDAP Error: %3

Fields #

Name	Description
`DomainName` UnicodeString
`DomainControllerName` UnicodeString
`LdapError` UInt32

Event ID 522: A DFS folder has incorrect metadata in the registry

Channel: Admin, Operational

Description

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.

Message #

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.
To bring the namespace back online, delete the following registry entry and then restart the DFS Namespace service. After the namespace is online, recreate the missing DFS folder or restore the DFS folder from a backup of the DFS namespace.

Registry Path: %1 
Status: %2

Fields #

Name	Description
`DfsFolderMetadataRegistryPath` UnicodeString
`Status` UInt32	NTSTATUS reference

Provenance

ETW provider GUID b6c4e17a-2cac-4273-a390-6f6b8c8c9f01

Defined in dfssvc.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB