Microsoft-Windows-DiskDiagnostic

7 events across 2 channels

Event	Title	Channel	Sample
1	Windows Disk Diagnostic detected a S.	System	N
2	Windows Disk Diagnostic was invoked for a S.	Operational	N
3	Windows Disk Diagnostic successfully scheduled interactive resolution for a S.	Operational	N
4	Windows Disk Diagnostic attempted to schedule interactive recovery for a S.	Operational	N
5	Windows Disk Diagnostic detected a S.	Operational	N
6	Windows Disk Diagnostic Resolver was disabled successfully.	Operational	N
7	Windows Disk Diagnostic Resolver could not be disabled.	Operational	N

Event ID 1: Windows Disk Diagnostic detected a S.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: System

Description

Windows Disk Diagnostic detected a S.M.A.R.T. fault on disk DiskFriendlyName (volumes VolumeNames). This disk might fail; back up your computer now. All data on the hard disk, including files, documents, pictures, programs, and settings might be lost if your hard disk fails. To determine if the hard disk needs to be repaired or replaced, contact the manufacturer of your computer. If you can't back up (for example, you have no CDs or other backup media), you should shut down your computer and restart when you have backup media available. In the meantime, do not save any critical files to this disk.

Message #

Windows Disk Diagnostic detected a S.M.A.R.T. fault on disk %1 (volumes %2).  This disk might fail; back up your computer now. All data on the hard disk, including files, documents, pictures, programs, and settings might be lost if your hard disk fails.  To determine if the hard disk needs to be repaired or replaced, contact the manufacturer of your computer.  If you can't back up (for example, you have no CDs or other backup media), you should shut down your computer and restart when you have backup media available.  In the meantime, do not save any critical files to this disk.

Fields #

Name	Description
`DiskFriendlyName` UnicodeString
`VolumeNames` UnicodeString
`HardwareID` UnicodeString

Event ID 2: Windows Disk Diagnostic was invoked for a S.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic was invoked for a S.M.A.R.T. fault, but no new faults were detected. The diagnostic will exit without performing any corrective action.

Message #

Windows Disk Diagnostic was invoked for a S.M.A.R.T. fault, but no new faults were detected.  The diagnostic will exit without performing any corrective action.

Event ID 3: Windows Disk Diagnostic successfully scheduled interactive resolution for a S.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic successfully scheduled interactive resolution for a S.M.A.R.T. fault.

Message #

Windows Disk Diagnostic successfully scheduled interactive resolution for a S.M.A.R.T. fault.

Event ID 4: Windows Disk Diagnostic attempted to schedule interactive recovery for a S.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic attempted to schedule interactive recovery for a S.M.A.R.T. fault but encountered an error. The error code was ErrorCode.

Message #

Windows Disk Diagnostic attempted to schedule interactive recovery for a S.M.A.R.T. fault but encountered an error.  The error code was %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 5: Windows Disk Diagnostic detected a S.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic detected a S.M.A.R.T. fault on disk DiskFriendlyName (volumes VolumeNames; hardware id HardwareID). However, as this disk is known to report false errors, Windows Disk Diagnostic ignored this event and exited silently.

Message #

Windows Disk Diagnostic detected a S.M.A.R.T. fault on disk %1 (volumes %2; hardware id %3). However, as this disk is known to report false errors, Windows Disk Diagnostic ignored this event and exited silently.

Fields #

Name	Description
`DiskFriendlyName` UnicodeString
`VolumeNames` UnicodeString
`HardwareID` UnicodeString

Event ID 6: Windows Disk Diagnostic Resolver was disabled successfully.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic Resolver was disabled successfully.

Message #

Windows Disk Diagnostic Resolver was disabled successfully.

Event ID 7: Windows Disk Diagnostic Resolver could not be disabled.

Provider: Microsoft-Windows-DiskDiagnostic
Channel: Operational

Description

Windows Disk Diagnostic Resolver could not be disabled. The error code was ErrorCode.

Message #

Windows Disk Diagnostic Resolver could not be disabled.  The error code was %1.

Fields #

Name	Description
`ErrorCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e670a5a2-ce74-4ab4-9347-61b815319f4c

Defined in dfdts.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-DiskDiagnostic

Event ID 1: Windows Disk Diagnostic detected a S.

Description

Message #

Fields #

Event ID 2: Windows Disk Diagnostic was invoked for a S.

Description

Message #

Event ID 3: Windows Disk Diagnostic successfully scheduled interactive resolution for a S.

Description

Message #

Event ID 4: Windows Disk Diagnostic attempted to schedule interactive recovery for a S.

Description

Message #

Fields #

Event ID 5: Windows Disk Diagnostic detected a S.

Description

Message #

Fields #

Event ID 6: Windows Disk Diagnostic Resolver was disabled successfully.

Description

Message #

Event ID 7: Windows Disk Diagnostic Resolver could not be disabled.

Description

Message #

Fields #

Provenance

Downloads

Keyboard shortcuts

Search operators