Microsoft-Windows-FailoverClustering-ClusDisk-Diagnostic

Event	Title	Channel	Sample	Rule
1	Event ID 1	Operational	N	N
1	PhysicalDrive.	System	N	N

Event ID 1

Channel: Operational

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`Device` UInt32
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString

Event ID 1: PhysicalDrive.

Channel: System

Message #

PhysicalDrive%2 (Disk Vendor Id '%3' Product Id '%4' Serial Number '%5') has persistent registration keys that do not belong to current active cluster membership. This could be due to an issue in drive firmware or because node that has pool resource has no connectivity to the disk to preempt unexpected registration keys. This may prevent clustered virtual disks from coming online on this node. Status %1

Fields #

Name	Description
`Status` HexInt32	NTSTATUS reference
`Device` UInt32
`VendorId` AnsiString
`ProductId` AnsiString
`SerialNumber` AnsiString

Provenance

ETW provider GUID 7fef367f-e76c-4592-9912-e12b36a99780

Defined in ClusDisk.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0, captured 2026-06-02 — Manifest XML pack, 1.9 MB