Microsoft-Windows-DFSN-Server

74 events across 3 channels

Event	Title	Channel	Sample
1	A referral request has been received.	Analytic	N
1	A referral request has been received	Operational	N
2	A DC referral request has been processed.	Analytic	N
2	A DC referral request has been processed	Operational	N
3	A root referral request has been processed.	Analytic	N
3	A root referral request has been processed	Operational	N
4	A normal referral request has been processed.	Analytic	N
4	A normal referral request has been processed	Operational	N
5	A referral response has been generated.	Analytic	N
5	A referral response has been generated	Operational	N
6	A referral response has been posted.	Analytic	N
6	A referral response has been posted	Operational	N
7	IP address IpAddress resolved to site SiteName.	Analytic	N
7	IP address IpAddress resolved to site	Operational	N
11	NetrDfsAdd arrived.	Analytic	N
11	NetrDfsAdd arrived	Operational	N
21	NetrDfsRemove arrived.	Analytic	N
21	NetrDfsRemove arrived	Operational	N
31	NetrDfsSetInfo arrived.	Analytic	N
31	NetrDfsSetInfo arrived	Operational	N
41	NetrDfsGetInfo arrived.	Analytic	N
41	NetrDfsGetInfo arrived	Operational	N
61	NetrDfsMove arrived.	Analytic	N
61	NetrDfsMove arrived	Operational	N
71	NetrDfsAddFtRoot arrived.	Analytic	N
71	NetrDfsAddFtRoot arrived	Operational	N
81	NetrDfsRemoveFtRoot arrived.	Analytic	N
81	NetrDfsRemoveFtRoot arrived	Operational	N
91	NetrDfsAddStdRoot arrived.	Analytic	N
91	NetrDfsAddStdRoot arrived	Operational	N
101	NetrDfsRemoveStdRoot arrived.	Analytic	N
101	NetrDfsRemoveStdRoot arrived	Operational	N
112	LockAcquiredDomainInfo.	Analytic	N
112	LockAcquiredDomainInfo	Operational	N
121	LookupRootFolderDone.	Analytic	N
121	LookupRootFolderDone	Operational	N
131	LookupLinkFolderDone.	Analytic	N
131	LookupLinkFolderDone	Operational	N
191	NetrDfsEnum arrived.	Analytic	N
191	NetrDfsEnum arrived	Operational	N
501	Referral request received for dfspath DfsPath from client with IPAddress …	Operational	Y
502	DFS has resolved server ServerName to IPAddress ServerIpAddress and site …	Operational	Y
503	Failed to obtain IPAddress for server ServerName.	Operational	N
504	Failed to resolve IPAddress IpAddress to site name.	Operational	N
505	Referral generated for DFS path DfsPath and client whose site is ClientSite.	Operational	Y
506	Request for creating new folder or adding target to existing folder completed …	Operational	Y
507	Request for deleting a link or removing target of existing link completed with …	Operational	N
508	Request to modify properties of DfsPath completed with status Status.	Operational	N
509	Request to retrieve properties of DfsPath completed with status Status.	Analytic	N
509	Request to retrieve properties of DfsPath completed with status	Operational	N
510	Request to enumerate contents of \\DfsPath completed with status Status.	Analytic	N
510	Request to enumerate contents of \\DfsPath completed with status	Operational	N
511	Request to move dfs folders from DfsPath to NewDfsPath completed with status …	Operational	N
512	Request to create a new dfs namespace or add target to existing namespace …	Admin	N
512	Request to create a new dfs namespace or add target to existing namespace …	Operational	N
513	Request to remove a dfs namespace or remove target from existing namespace …	Admin	N
513	Request to remove a dfs namespace or remove target from existing namespace …	Operational	N
514	Request to create a new standalone or clustered dfs namespace completed with …	Admin	N
514	Request to create a new standalone or clustered dfs namespace completed with …	Operational	N
515	Request to remove standalone or clustered dfs namespace completed with status …	Admin	N
515	Request to remove standalone or clustered dfs namespace completed with status	Operational	N
516	DFSN service has started performing complete refresh of metadata for namespace …	Admin	N
516	DFSN service has started performing complete refresh of metadata for namespace	Operational	N
517	DFSN service completed performing refresh of metadata for namespace DfsNamespace …	Admin	N
517	DFSN service completed performing refresh of metadata for namespace DfsNamespace …	Operational	N
518	DFSN service has successfully deleted DFS reparse point DfsReparsepoint on …	Admin	N
518	DFSN service has successfully deleted DFS reparse point DfsReparsepoint on …	Operational	N
519	DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume …	Admin	N
519	DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume …	Operational	N
520	The DFS Namespace service could not obtain site costs for the following Active …	Operational	N
521	The DFS Namespace service is unable to contact Active Directory Domain Services.	Admin	N
521	The DFS Namespace service is unable to contact Active Directory Domain Services	Operational	N
522	A DFS folder has incorrect metadata in the registry.	Admin	N
522	A DFS folder has incorrect metadata in the registry	Operational	N

Event ID 1: A referral request has been received.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: RequestReceived

Description

A referral request has been received.

Message #

A referral request has been received.

Fields #

Name	Description
`RequestBuffer` Pointer
`RequestBufferLength` UInt16

Event ID 1: A referral request has been received

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: RequestReceived

Description

A referral request has been received.

Fields #

Name	Description
`RequestBuffer` Pointer
`RequestBufferLength` UInt16

Event ID 2: A DC referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: DcRequestProcessed

Description

A DC referral request has been processed.

Message #

A DC referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 2: A DC referral request has been processed

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: DcRequestProcessed

Description

A DC referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: A root referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: RootRequestProcessed

Description

A root referral request has been processed.

Message #

A root referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 3: A root referral request has been processed

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: RootRequestProcessed

Description

A root referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4: A normal referral request has been processed.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: NormalRequestProcessed

Description

A normal referral request has been processed.

Message #

A normal referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 4: A normal referral request has been processed

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: NormalRequestProcessed

Description

A normal referral request has been processed.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 5: A referral response has been generated.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: ResponseGenerated

Description

A referral response has been generated.

Message #

A referral response has been generated.

Fields #

Name	Description
`Request` Pointer
`Response` Pointer
`Status` UInt32	NTSTATUS reference
`ResponseLength` UInt16

Event ID 5: A referral response has been generated

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: ResponseGenerated

Description

A referral response has been generated.

Fields #

Name	Description
`Request` Pointer
`Response` Pointer
`Status` UInt32	NTSTATUS reference
`ResponseLength` UInt16

Event ID 6: A referral response has been posted.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: ResponsePosted

Description

A referral response has been posted.

Message #

A referral response has been posted.

Fields #

Name	Description
`Response` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 6: A referral response has been posted

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: ResponsePosted

Description

A referral response has been posted.

Fields #

Name	Description
`Response` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 7: IP address IpAddress resolved to site SiteName.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Referral
Opcode: ResponsePosted

Description

IP address IpAddress resolved to site SiteName.

Message #

IP address %1 resolved to site %2.

Fields #

Name	Description
`IpAddress` UnicodeString
`SiteName` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Event ID 7: IP address IpAddress resolved to site

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral
Opcode: ResponsePosted

Description

IP address resolved to site .

Fields #

Name	Description
`IpAddress` UnicodeString
`SiteName` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Event ID 11: NetrDfsAdd arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: AddArrived

Description

NetrDfsAdd arrived.

Message #

NetrDfsAdd arrived.

Event ID 11: NetrDfsAdd arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: AddArrived

Description

NetrDfsAdd arrived.

Event ID 21: NetrDfsRemove arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: RemoveArrived

Description

NetrDfsRemove arrived.

Message #

NetrDfsRemove arrived.

Event ID 21: NetrDfsRemove arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveArrived

Description

NetrDfsRemove arrived.

Event ID 31: NetrDfsSetInfo arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: SetInfoArrived

Description

NetrDfsSetInfo arrived.

Message #

NetrDfsSetInfo arrived.

Event ID 31: NetrDfsSetInfo arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: SetInfoArrived

Description

NetrDfsSetInfo arrived.

Event ID 41: NetrDfsGetInfo arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: GetInfoArrived

Description

NetrDfsGetInfo arrived.

Message #

NetrDfsGetInfo arrived.

Event ID 41: NetrDfsGetInfo arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: GetInfoArrived

Description

NetrDfsGetInfo arrived.

Event ID 61: NetrDfsMove arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: MoveArrived

Description

NetrDfsMove arrived.

Message #

NetrDfsMove arrived.

Event ID 61: NetrDfsMove arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: MoveArrived

Description

NetrDfsMove arrived.

Event ID 71: NetrDfsAddFtRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: AddFtRootArrived

Description

NetrDfsAddFtRoot arrived.

Message #

NetrDfsAddFtRoot arrived.

Event ID 71: NetrDfsAddFtRoot arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: AddFtRootArrived

Description

NetrDfsAddFtRoot arrived.

Event ID 81: NetrDfsRemoveFtRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: RemoveFtRootArrived

Description

NetrDfsRemoveFtRoot arrived.

Message #

NetrDfsRemoveFtRoot arrived.

Event ID 81: NetrDfsRemoveFtRoot arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveFtRootArrived

Description

NetrDfsRemoveFtRoot arrived.

Event ID 91: NetrDfsAddStdRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: AddStdRootArrived

Description

NetrDfsAddStdRoot arrived.

Message #

NetrDfsAddStdRoot arrived.

Event ID 91: NetrDfsAddStdRoot arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: AddStdRootArrived

Description

NetrDfsAddStdRoot arrived.

Event ID 101: NetrDfsRemoveStdRoot arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: RemoveStdRootArrived

Description

NetrDfsRemoveStdRoot arrived.

Message #

NetrDfsRemoveStdRoot arrived.

Event ID 101: NetrDfsRemoveStdRoot arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveStdRootArrived

Description

NetrDfsRemoveStdRoot arrived.

Event ID 112: LockAcquiredDomainInfo.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Lock
Opcode: LockAcquiredDomainInfo

Description

LockAcquiredDomainInfo.

Message #

LockAcquiredDomainInfo.

Event ID 112: LockAcquiredDomainInfo

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Lock
Opcode: LockAcquiredDomainInfo

Description

LockAcquiredDomainInfo.

Event ID 121: LookupRootFolderDone.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Lookup
Opcode: LookupRootFolderDone

Description

LookupRootFolderDone.

Message #

LookupRootFolderDone.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 121: LookupRootFolderDone

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Lookup
Opcode: LookupRootFolderDone

Description

LookupRootFolderDone.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 131: LookupLinkFolderDone.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: Lookup
Opcode: LookupLinkFolderDone

Description

LookupLinkFolderDone.

Message #

LookupLinkFolderDone.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 131: LookupLinkFolderDone

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Lookup
Opcode: LookupLinkFolderDone

Description

LookupLinkFolderDone.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 191: NetrDfsEnum arrived.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: EnumArrived

Description

NetrDfsEnum arrived.

Message #

NetrDfsEnum arrived.

Event ID 191: NetrDfsEnum arrived

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: EnumArrived

Description

NetrDfsEnum arrived.

Event ID 501: Referral request received for dfspath DfsPath from client with IPAddress ClientIpAddress and site ClientSite.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Level: Informational
Task: Referral

Description

Referral request received for dfspath DfsPath from client with IPAddress ClientIpAddress and site ClientSite.

Message #

Referral request received for dfspath %1 from client with IPAddress %2 and site %3.

Fields #

Name	Description
`DfsPath` UnicodeString
`ClientIpAddress` UnicodeString
`ClientSite` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 501,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 1152921504606846977,
    "time_created": "2026-03-13T20:05:06.467486+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "8B83AF9E-B321-000B-87F7-838B21B3DC01"
    },
    "execution": {
      "process_id": 4148,
      "thread_id": 4796
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "",
    "ClientIpAddress": "10.2.10.21",
    "ClientSite": "Default-First-Site-Name"
  },
  "message": ""
}

Event ID 502: DFS has resolved server ServerName to IPAddress ServerIpAddress and site ServerSite.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral

Description

DFS has resolved server ServerName to IPAddress ServerIpAddress and site ServerSite.

Message #

DFS has resolved server %1 to IPAddress %2 and site %3.

Fields #

Name	Description
`ServerName` UnicodeString
`ServerIpAddress` UnicodeString
`ServerSite` UnicodeString
`TimeConsumedToResolveInMilliSeconds` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "event_id": 502,
    "level": "Information",
    "task": "Referral",
    "opcode": "Info",
    "time_created": "2026-04-18T22:00:41.1486364+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-DFSN-Server/Operational"
  },
  "event_data": {
    "ServerIpAddress": "::1",
    "ServerName": "JD-DC01-2022.ludus.domain",
    "ServerSite": "Default-First-Site-Name",
    "TimeConsumedToResolveInMilliSeconds": "0"
  }
}

Event ID 503: Failed to obtain IPAddress for server ServerName.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral

Description

Failed to obtain IPAddress for server ServerName. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to obtain IPAddress for server %1. This may cause the client to access high-cost or out-of-site targets.

Fields #

Name	Description
`ServerName` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 504: Failed to resolve IPAddress IpAddress to site name.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral

Description

Failed to resolve IPAddress IpAddress to site name. This may cause the client to access high-cost or out-of-site targets.

Message #

Failed to resolve IPAddress %1 to site name. This may cause the client to access high-cost or out-of-site targets.

Fields #

Name	Description
`IpAddress` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 505: Referral generated for DFS path DfsPath and client whose site is ClientSite.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral

Description

Referral generated for DFS path DfsPath and client whose site is ClientSite. Targets information can be found in the event payload.

Message #

Referral generated for DFS path %2 and client whose site is %3. Targets information can be found in the event payload.

Fields #

Name	Description
`DfsPathLength` UInt16
`DfsPath` UnicodeString
`ClientSite` UnicodeString
`TargetCount` UInt32
`DfsTarget` Int16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "event_id": 505,
    "level": "Information",
    "task": "Referral",
    "opcode": "Info",
    "time_created": "2026-04-18T22:00:41.1499001+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-DFSN-Server/Operational"
  },
  "event_data": {}
}

Event ID 506: Request for creating new folder or adding target to existing folder completed with status:Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Level: Informational
Task: NetrDfs
Opcode: AddCompleted

Description

Request for creating new folder or adding target to existing folder completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for creating new folder or adding target to existing folder completed with status:%6. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DFSN-Server",
    "guid": "B6C4E17A-2CAC-4273-A390-6F6B8C8C9F01",
    "event_source_name": "",
    "event_id": 506,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 41,
    "keywords": 1152921504606846978,
    "time_created": "2026-03-13T20:45:53.834051+00:00",
    "event_record_id": 296,
    "correlation": {},
    "execution": {
      "process_id": 4148,
      "thread_id": 3744
    },
    "channel": "Microsoft-Windows-DFSN-Server/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DfsPath": "\\ludus.domain\\TestDFS\\Folder1",
    "ServerName": "LAB-DC01",
    "ShareName": "TestDFS\\Folder1",
    "Comment": "NULL",
    "Flags": 1,
    "Status": 1168,
    "TimeConsumedInMilliSeconds": 0
  },
  "message": ""
}

Event ID 507: Request for deleting a link or removing target of existing link completed with status:Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveCompleted

Description

Request for deleting a link or removing target of existing link completed with status:Status. DfsFolder:DfsPath TargetServer:ServerName TargetShare:ShareName.

Message #

Request for deleting a link or removing target of existing link completed with status:%4. DfsFolder:%1 TargetServer:%2 TargetShare:%3

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 508: Request to modify properties of DfsPath completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: SetInfoCompleted

Description

Request to modify properties of DfsPath completed with status Status.

Message #

Request to modify properties of %1 completed with status %5.

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 509: Request to retrieve properties of DfsPath completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: GetInfoCompleted

Description

Request to retrieve properties of DfsPath completed with status Status.

Message #

Request to retrieve properties of %1 completed with status %5.

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 509: Request to retrieve properties of DfsPath completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: GetInfoCompleted

Description

Request to retrieve properties of completed with status .

Fields #

Name	Description
`DfsPath` UnicodeString
`ServerName` UnicodeString
`ShareName` UnicodeString
`Level` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 510: Request to enumerate contents of \\DfsPath completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Analytic
Task: NetrDfs
Opcode: EnumCompleted

Description

Request to enumerate contents of \\DfsPath completed with status Status.

Message #

Request to enumerate contents of \\%1 completed with status %4.

Fields #

Name	Description
`DfsPath` UnicodeString
`Level` UInt32
`PreferredMaxLength` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 510: Request to enumerate contents of \\DfsPath completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: EnumCompleted

Description

Request to enumerate contents of \\ completed with status .

Fields #

Name	Description
`DfsPath` UnicodeString
`Level` UInt32
`PreferredMaxLength` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 511: Request to move dfs folders from DfsPath to NewDfsPath completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: MoveCompleted

Description

Request to move dfs folders from DfsPath to NewDfsPath completed with status Status.

Message #

Request to move dfs folders from %1 to %2 completed with status %4.

Fields #

Name	Description
`DfsPath` UnicodeString
`NewDfsPath` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 512: Request to create a new dfs namespace or add target to existing namespace completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin
Task: NetrDfs
Opcode: AddFtRootCompleted

Description

Request to create a new dfs namespace or add target to existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new dfs namespace or add target to existing namespace completed with status %6. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 512: Request to create a new dfs namespace or add target to existing namespace completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: AddFtRootCompleted

Description

Request to create a new dfs namespace or add target to existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 513: Request to remove a dfs namespace or remove target from existing namespace completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin
Task: NetrDfs
Opcode: RemoveFtRootCompleted

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove a dfs namespace or remove target from existing namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 513: Request to remove a dfs namespace or remove target from existing namespace completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveFtRootCompleted

Description

Request to remove a dfs namespace or remove target from existing namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`FtDfsName` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 514: Request to create a new standalone or clustered dfs namespace completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin
Task: NetrDfs
Opcode: AddStdRootCompleted

Description

Request to create a new standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to create a new standalone or clustered dfs namespace completed with status %5. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 514: Request to create a new standalone or clustered dfs namespace completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: AddStdRootCompleted

Description

Request to create a new standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Comment` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 515: Request to remove standalone or clustered dfs namespace completed with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin
Task: NetrDfs
Opcode: RemoveStdRootCompleted

Description

Request to remove standalone or clustered dfs namespace completed with status Status. The namespace server and share name are DfsServer:ServerName Share:RootShare.

Message #

Request to remove standalone or clustered dfs namespace completed with status %4. The namespace server and share name are DfsServer:%1 Share:%2.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 515: Request to remove standalone or clustered dfs namespace completed with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs
Opcode: RemoveStdRootCompleted

Description

Request to remove standalone or clustered dfs namespace completed with status . The namespace server and share name are DfsServer: Share:.

Fields #

Name	Description
`ServerName` UnicodeString
`RootShare` UnicodeString
`Flags` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 516: DFSN service has started performing complete refresh of metadata for namespace DfsNamespace.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Description

DFSN service has started performing complete refresh of metadata for namespace . This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Message #

DFSN service has started performing complete refresh of metadata for namespace %1. This task can take time if the namespace has large number of folders and may delay namespace administration operations.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32

Event ID 516: DFSN service has started performing complete refresh of metadata for namespace

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Description

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32

Event ID 517: DFSN service completed performing refresh of metadata for namespace DfsNamespace with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Description

DFSN service completed performing refresh of metadata for namespace DfsNamespace with status Status. Time taken to perform this operation TimeConsumedInMilliSeconds milliseconds.

Message #

DFSN service completed performing refresh of metadata for namespace %1 with status %4. Time taken to perform this operation %5 milliseconds.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 517: DFSN service completed performing refresh of metadata for namespace DfsNamespace with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Description

DFSN service completed performing refresh of metadata for namespace with status . Time taken to perform this operation milliseconds.

Fields #

Name	Description
`DfsNamespace` UnicodeString
`SyncFromPDC` Boolean
`SyncType` UInt32
`Status` UInt32	NTSTATUS reference
`TimeConsumedInMilliSeconds` UInt64

Event ID 518: DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume VolumeName.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Description

DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume VolumeName. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Message #

DFSN service has successfully deleted DFS reparse point %1 on volume %3. The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 518: DFSN service has successfully deleted DFS reparse point DfsReparsepoint on volume

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Description

DFSN service has successfully deleted DFS reparse point on volume . The reparse point was deleted because it was not belonging to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 519: DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status Status.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Description

DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status Status. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Message #

DFSN service has failed to deleted DFS reparse point %1 on volume %3 with status %4. The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 519: DFSN service has failed to deleted DFS reparse point DfsReparsepoint on volume VolumeName with status

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Description

DFSN service has failed to deleted DFS reparse point on volume with status . The service attempted to delete this reparse point as it does not belong to any of the namespaces on this server.

Fields #

Name	Description
`DfsReparsepoint` UnicodeString
`VolumeNameLength` UInt16
`VolumeName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 520: The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: ADSite.

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: Referral

Description

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: ADSite. This might cause clients to access folder targets in other sites. Error code: Status.

Message #

The DFS Namespace service could not obtain site costs for the following Active Directory Domain Services site: %1. This might cause clients to access folder targets in other sites. Error code: %2.

Fields #

Name	Description
`ADSite` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 521: The DFS Namespace service is unable to contact Active Directory Domain Services.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin
Task: NetrDfs

Description

The DFS Namespace service is unable to contact Active Directory Domain Services.

Message #

The DFS Namespace service is unable to contact Active Directory Domain Services. 

Domain: %1 
Domain Controller: %2 
LDAP Error: %3

Fields #

Name	Description
`DomainName` UnicodeString
`DomainControllerName` UnicodeString
`LdapError` UInt32

Event ID 521: The DFS Namespace service is unable to contact Active Directory Domain Services

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational
Task: NetrDfs

Description

The DFS Namespace service is unable to contact Active Directory Domain Services.

Fields #

Name	Description
`DomainName` UnicodeString
`DomainControllerName` UnicodeString
`LdapError` UInt32

Event ID 522: A DFS folder has incorrect metadata in the registry.

Provider: Microsoft-Windows-DFSN-Server
Channel: Admin

Description

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.

Message #

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.
To bring the namespace back online, delete the following registry entry and then restart the DFS Namespace service. After the namespace is online, recreate the missing DFS folder or restore the DFS folder from a backup of the DFS namespace.

Registry Path: %1 
Status: %2

Fields #

Name	Description
`DfsFolderMetadataRegistryPath` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 522: A DFS folder has incorrect metadata in the registry

Provider: Microsoft-Windows-DFSN-Server
Channel: Operational

Description

A DFS folder has incorrect metadata in the registry. The standalone namespace that contains this DFS folder is offline.

Fields #

Name	Description
`DfsFolderMetadataRegistryPath` UnicodeString
`Status` UInt32	NTSTATUS reference

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b6c4e17a-2cac-4273-a390-6f6b8c8c9f01

Defined in dfssvc.exe, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-DFSN-Server registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)