Microsoft-Windows-FailoverClustering-Manager
Event ID 4625: Failover Cluster Manager could not load clusapi.
#Description
Failover Cluster Manager could not load clusapi.dll. This is required for any monitoring and management of local or remote clusters. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Event ID 4625
#Event ID 4627: Failover Cluster Manager could not open a handle to the cluster or a cluster item because the client does not support such a request in read-only m...
#Description
Failover Cluster Manager could not open a handle to the cluster or a cluster item because the client does not support such a request in read-only mode. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Event ID 4627
#Event ID 4628: Failover Cluster Manager could not find function 'Parameter1' in clusapi.
#Event ID 4629: Failover Cluster Manager has reconnected to cluster 'Parameter1'.
#Event ID 4629
#Description
Failover Cluster Manager has reconnected to cluster 'Parameter1'. The cluster information and state will be refreshed.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4630: Failover Cluster Manager was disconnected from cluster 'Parameter1'.
#Event ID 4630
#Description
Failover Cluster Manager was disconnected from cluster 'Parameter1'. Please make sure the cluster is up and accessible.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4631: Failover Cluster Manager detected a parameter that was not in the expected range: Parameter1.
#Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FailoverClustering-Manager",
"guid": "11B3C6B7-E06F-4191-BBB9-7099FFF55614",
"event_source_name": "",
"event_id": 4631,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-05-30T03:13:49.975742+00:00",
"event_record_id": 24,
"correlation": {
"ActivityID": "14429F51-EFE2-0006-0CB0-4214E2EFDC01"
},
"execution": {
"process_id": 1160,
"thread_id": 7532
},
"channel": "Microsoft-Windows-FailoverClustering-Manager/Admin",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {
"Parameter1": "Failed to access remote registry on 'JD-DC01-2022.ludus.domain'. Ensure that the remote registry service is running, and have remote administration enabled."
},
"message": ""
}
Event ID 4631
#Description
Failover Cluster Manager detected a parameter that was not in the expected range.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FailoverClustering-Manager",
"guid": "{11B3C6B7-E06F-4191-BBB9-7099FFF55614}",
"event_source_name": "",
"event_id": 4631,
"version": 0,
"level": 4,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T17:14:06.5969265+00:00",
"event_record_id": 16,
"correlation": {
"ActivityID": "{AA583517-FAF4-0006-29AE-58AAF4FADC01}"
},
"execution": {
"process_id": 7664,
"thread_id": 2980
},
"channel": "Microsoft-Windows-FailoverClustering-Manager/Admin",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {
"Parameter1": "You do not have administrative privileges on the server 'telemetry-MEM-c.cell-c.ludus.domain'."
},
"message": "Failover Cluster Manager detected a parameter that was not in the expected range: You do not have administrative privileges on the server 'telemetry-MEM-c.cell-c.ludus.domain'."
}
Event ID 4632: Failover Cluster Manager could not generate a report after performing one of the tasks requested by the user.
#Description
Failover Cluster Manager could not generate a report after performing one of the tasks requested by the user. The user request should not be interrupted by this problem, but no report will be created after the operation is complete. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Event ID 4632
#Event ID 4633: Failover Cluster Manager could not load the DFS management tools.
#Description
Failover Cluster Manager could not load the DFS management tools. This will prevent the Configure File Share Witness wizard from browsing and showing the file share to use as the file share witness. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Event ID 4633
#Event ID 4640: Failover Cluster Manager could not refresh 'Parameter1'.
#Event ID 4640
#Description
Failover Cluster Manager could not refresh 'Parameter1'. Connection to the cluster will be refreshed.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4641: Failover Cluster Manager could not retrieve properties for cluster resource type 'Parameter1'.
#Event ID 4641
#Description
Failover Cluster Manager could not retrieve properties for cluster resource type 'Parameter1'. Please make sure the resource type is properly registered.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4642: Failover Cluster Manager could not find the appropriate admin extensions property page.
#Event ID 4648: Failover Cluster Manager could not find the appropriate admin extensions property page for CLSID '{Parameter1}'.
#Event ID 4648
#Description
Failover Cluster Manager could not find the appropriate admin extensions property page for CLSID '{}'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4649: Failover Cluster Manager detected that virtual machine 'Parameter1' is configured to use one or more disk that are not yet added to the cluster.
#Description
Failover Cluster Manager detected that virtual machine 'Parameter1' is configured to use one or more disk that are not yet added to the cluster. Please add all required disks to the cluster before making this virtual machine highly available.
Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4656: Failover Cluster Manager detected that virtual machine 'Parameter1' is configured to use disk 'Parameter2' which is not a valid shared disk to be added to the clus...
#Description
Failover Cluster Manager detected that virtual machine 'Parameter1' is configured to use disk 'Parameter2' which is not a valid shared disk to be added to the cluster. Please add all required disks to the cluster before making this virtual machine highly available.
Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4657: Failover Cluster PowerShell cmdlet Parameter1: Parameter2.
#Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FailoverClustering-Manager",
"guid": "11B3C6B7-E06F-4191-BBB9-7099FFF55614",
"event_source_name": "",
"event_id": 4657,
"version": 0,
"level": 2,
"task": 2,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-05-30T03:15:33.517501+00:00",
"event_record_id": 27,
"correlation": {
"ActivityID": "14429F51-EFE2-0009-EBA9-4214E2EFDC01"
},
"execution": {
"process_id": 2824,
"thread_id": 4880
},
"channel": "Microsoft-Windows-FailoverClustering-Manager/Admin",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {
"Parameter1": "Get-Cluster",
"Parameter2": "The cluster service is not running. Make sure that the service is running on all nodes in the cluster."
},
"message": ""
}
Event ID 4657
#Description
Failover Cluster PowerShell cmdlet.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FailoverClustering-Manager",
"guid": "{11B3C6B7-E06F-4191-BBB9-7099FFF55614}",
"event_source_name": "",
"event_id": 4657,
"version": 0,
"level": 2,
"task": 2,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T15:14:30.4015994+00:00",
"event_record_id": 3,
"correlation": {
"ActivityID": "{AA583517-FAF4-0000-A4A9-58AAF4FADC01}"
},
"execution": {
"process_id": 380,
"thread_id": 1796
},
"channel": "Microsoft-Windows-FailoverClustering-Manager/Admin",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {
"Parameter1": "Get-ClusterGroup",
"Parameter2": "The pipeline has been stopped."
},
"message": "Failover Cluster PowerShell cmdlet Get-ClusterGroup: The pipeline has been stopped."
}
Event ID 4658: Failover Cluster Manager could not make virtual machine 'Parameter1' highly available.
#Event ID 4658
#Description
Failover Cluster Manager could not make virtual machine 'Parameter1' highly available. Please refer to the cluster reports in the cluster %windir%\cluster\reports folder.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4659: Failover Cluster Manager could not set the specified security descriptor for 'Parameter1'.
#Event ID 4659
#Description
Failover Cluster Manager could not set the specified security descriptor for 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4660: Failover Cluster Manager detected that the specified security descriptor for 'Parameter1' did not grant the required full access to the built in Administra...
#Event ID 4661: Failover Cluster Manager could not retrieve the data type for value '{Parameter1}' from the registry.
#Fields #
| Name | Description |
|---|---|
Parameter1 |
Event ID 4662: Failover Cluster Manager detected that the data type for value 'Parameter1' in the registry is not the expected type 'Parameter2'.
#Event ID 4662
#Description
Failover Cluster Manager detected that the data type for value 'Parameter1' in the registry is not the expected type 'Parameter2'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4663: Failover Cluster Manager could not impersonate user 'Parameter1'.
#Event ID 4663
#Description
Failover Cluster Manager could not impersonate user 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4664: Failover Cluster Manager could not impersonate user 'Parameter1' because it did not get the token required.
#Event ID 4664
#Description
Failover Cluster Manager could not impersonate user 'Parameter1' because it did not get the token required. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4665: Failover Cluster Manager could not refresh 'Parameter1'.
#Event ID 4665
#Description
Failover Cluster Manager could not refresh 'Parameter1'. Information and state can be out-of-date.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4672: Failover Cluster Manager could not refresh the connection to 'Parameter1'.
#Event ID 4672
#Description
Failover Cluster Manager could not refresh the connection to 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4673: Failover Cluster Manager could not retrieve event description.
#Event ID 4673
#Description
Failover Cluster Manager could not retrieve event description.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4674: Failover Cluster Manager could not expand the scope on 'Parameter1'.
#Event ID 4674
#Description
Failover Cluster Manager could not expand the scope on 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4675: Failover Cluster Manager could not update the pane actions for 'Parameter1'.
#Event ID 4675
#Description
Failover Cluster Manager could not update the pane actions for 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4676: Failover Cluster Manager could not update the image index for 'Parameter1'.
#Event ID 4676
#Description
Failover Cluster Manager could not update the image index for 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4677: Failover Cluster Manager could not update the display name for '{Parameter1}'.
#Event ID 4678: Failover Cluster Manager could not update the page 'Parameter1'.
#Event ID 4678
#Description
Failover Cluster Manager could not update the page 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4679: Failover Cluster Manager could not bring the shadow copy resource 'Parameter1' online.
#Event ID 4679
#Description
Failover Cluster Manager could not bring the shadow copy resource 'Parameter1' online.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4680: Failover Cluster Manager could not delete the shadow copy resource 'Parameter1'.
#Event ID 4680
#Description
Failover Cluster Manager could not delete the shadow copy resource 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4681: Failover Cluster Manager could not contact node 'Parameter1'.
#Event ID 4681
#Description
Failover Cluster Manager could not contact node 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4682: Failover Cluster Manager could not display the dependency report.
#Description
Failover Cluster Manager could not display the dependency report. This might happen if the dependency relationship between the cluster resources is too complex. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Event ID 4682
#Event ID 4683: Failover Cluster Manager failed while managing one or more cluster.
#Event ID 4683
#Description
Failover Cluster Manager failed while managing one or more cluster. The error was 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4684: Failover Cluster Manager could not contact the DNS servers to resolve name 'Parameter1'.
#Event ID 4685: Failover Cluster Manager could not shut down cluster 'Parameter1'.
#Event ID 4685
#Description
Failover Cluster Manager could not shut down cluster 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4686: Failover Cluster Manager could not create a physical disk.
#Event ID 4686
#Description
Failover Cluster Manager could not create a physical disk.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4687: Failover Cluster Manager could not create a generic script resource.
#Event ID 4687
#Description
Failover Cluster Manager could not create a generic script resource. The error was 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4688: Failover Cluster Manager could not enable the tools property page for 'Parameter1' because some information about the volumes could not be retrieved.
#Event ID 4689: Failover Cluster Manager has successfully completed disk error checking for volume 'Parameter1'.
#Event ID 4689
#Description
Failover Cluster Manager has successfully completed disk error checking for volume 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4690: Failover Cluster Manager could not complete disk error checking for volume 'Parameter1'.
#Event ID 4690
#Description
Failover Cluster Manager could not complete disk error checking for volume 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4691: Failover Cluster Manager has successfully completed disk defragmentation for volume 'Parameter1'.
#Event ID 4691
#Description
Failover Cluster Manager has successfully completed disk defragmentation for volume 'Parameter1'.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4692: Failover Cluster Manager could not complete disk defragmentation for volume 'Parameter1'.
#Event ID 4692
#Description
Failover Cluster Manager could not complete disk defragmentation for volume 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4693: Failover Cluster Manager could not get virtual machines on cluster node 'Parameter1'.
#Event ID 4693
#Description
Failover Cluster Manager could not get virtual machines on cluster node 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4694
#Description
Hyper-V management tools were not found on the system.
Event ID 4695: Failover Cluster Manager could not bring the group 'Parameter1' online.
#Event ID 4695
#Description
Failover Cluster Manager could not bring the group 'Parameter1' online. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4696: Failover Cluster Manager encountered an error while onlining the selected groups.
#Event ID 4696
#Description
Failover Cluster Manager encountered an error while onlining the selected groups. The error was 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4697: Failover Cluster Manager could not offline the group 'Parameter1'.
#Event ID 4697
#Description
Failover Cluster Manager could not offline the group 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4698: Failover Cluster Manager encountered an error while offlining the selected groups.
#Event ID 4698
#Description
Failover Cluster Manager encountered an error while offlining the selected groups. The error was 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4699: Failover Cluster Manager could not move the group 'Parameter1' to node 'Parameter2'.
#Description
Failover Cluster Manager could not move the group 'Parameter1' to node 'Parameter2'. The error was 'Parameter3'. For more information see the Failover Cluster Manager Diagnostic channel.
Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString | |
Parameter3 UnicodeString |
Event ID 4699
#Description
Failover Cluster Manager could not move the group 'Parameter1' to node 'Parameter2'. The error was 'Parameter3'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString | |
Parameter3 UnicodeString |
Event ID 4700: Failover Cluster Manager encountered an error while moving the selected groups.
#Event ID 4700
#Description
Failover Cluster Manager encountered an error while moving the selected groups. The error was 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4701: Failover Cluster Manager could not change the auto start settings for group 'Parameter1'.
#Event ID 4701
#Description
Failover Cluster Manager could not change the auto start settings for group 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4702: Failover Cluster Manager encountered an error while changing the auto start settings for the selected groups.
#Event ID 4703: Failover Cluster Manager could not delete the group 'Parameter1'.
#Event ID 4703
#Description
Failover Cluster Manager could not delete the group 'Parameter1'. The error was 'Parameter2'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4704: Failover Cluster Manager encountered an error while deleting the selected groups.
#Event ID 4704
#Description
Failover Cluster Manager encountered an error while deleting the selected groups. The error was 'Parameter1'. For more information see the Failover Cluster Manager Diagnostic channel.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4705: There was an error taking the dependent service or application 'Parameter1' of cluster shared volume 'Parameter2' offline.
#Description
There was an error taking the dependent service or application 'Parameter1' of cluster shared volume 'Parameter2' offline. This service or application will be skipped and an attempt to bring all other dependent services and applications offline will be made.
Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4706: There was an error taking the dependent services and applications of cluster shared volume 'Parameter1' offline.
#Event ID 4706
#Description
There was an error taking the dependent services and applications of cluster shared volume 'Parameter1' offline. An attempt to bring the cluster shared volume offline will be made.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4707: There was an error bringing the dependent service or application 'Parameter1' of cluster shared volume 'Parameter2' online.
#Description
There was an error bringing the dependent service or application 'Parameter1' of cluster shared volume 'Parameter2' online. This service or application will be skipped and an attempt to bring all other dependent services and applications online will be made.
Message #
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString | |
Parameter2 UnicodeString |
Event ID 4708: There was an error bringing the dependent services and applications of cluster shared volume 'Parameter1' online.
#Event ID 4708
#Description
There was an error bringing the dependent services and applications of cluster shared volume 'Parameter1' online. An attempt to bring the cluster shared volume online will be made.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4709: Failover Cluster Manager encountered a fatal error.
#Event ID 4710: There was and error processing a cluster notification.
#Event ID 4710
#Description
There was and error processing a cluster notification.
Fields #
| Name | Description |
|---|---|
Parameter1 UnicodeString |
Event ID 4727
#Description
Entering Wmi Query.
Fields #
| Name | Description |
|---|---|
Query UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4727: Entering Wmi Query : Query.
#Event ID 4728
#Description
Exiting Wmi Query : returning records in microseconds.
Fields #
| Name | Description |
|---|---|
Query UnicodeString | |
Resultset UInt32 | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4728: Exiting Wmi Query : Query returning Resultset records in Duration microseconds.
#Event ID 4729
#Description
Entering Wmi Association with relative path and association class.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
AssociationClass UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4729: Entering Wmi Association with relative path RelativePath and association class AssociationClass.
#Event ID 4730
#Description
Exiting Wmi Association with relative path and association class returning records in microseconds.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
AssociationClass UnicodeString | |
Resultset UInt32 | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4730: Exiting Wmi Association with relative path RelativePath and association class AssociationClass returning Resultset records in Duration microseconds.
#Event ID 4731
#Description
Entering Wmi Enumeration for Class.
Fields #
| Name | Description |
|---|---|
Class UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4731: Entering Wmi Enumeration for Class Class.
#Event ID 4732
#Description
Exiting Wmi Enumeration for Class returning records in microseconds.
Fields #
| Name | Description |
|---|---|
Class UnicodeString | |
Resultset UInt32 | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4732: Exiting Wmi Enumeration for Class Class returning Resultset records in Duration microseconds.
#Event ID 4733
#Description
Entering Wmi Get Class for Class Name.
Fields #
| Name | Description |
|---|---|
Class UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4733: Entering Wmi Get Class for Class Name Class.
#Event ID 4734
#Description
Exiting Wmi Get Class for Class Name in microseconds.
Fields #
| Name | Description |
|---|---|
Class UnicodeString | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4734: Exiting Wmi Get Class for Class Name Class in Duration microseconds.
#Event ID 4735
#Description
Entering Wmi Get Instance with Relative Path.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4735: Entering Wmi Get Instance with Relative Path RelativePath.
#Event ID 4736
#Description
Exiting Wmi Get Instance with Relative Path records in microseconds.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4736: Exiting Wmi Get Instance with Relative Path RelativePath records in Duration microseconds.
#Event ID 4737
#Description
Entering Wmi Invoke Method with Path.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
MethodName UnicodeString | |
Static Boolean | |
ParametersNames UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4737: Entering Wmi Invoke Method MethodName with Path RelativePath.
#Event ID 4738
#Description
Exiting Wmi Invoke Method with Path in microseconds.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
MethodName UnicodeString | |
Static Boolean | |
ParametersNames UnicodeString | |
Resultset UInt32 | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4738: Exiting Wmi Invoke Method MethodName with Path RelativePath in Duration microseconds.
#Event ID 4739
#Description
Entering Wmi Modify Instance for Relative Path Property Name.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
PropertyName UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4739: Entering Wmi Modify Instance for Relative Path RelativePath Property Name PropertyName.
#Event ID 4740
#Description
Exiting Wmi Modify Instance for Relative Path Property Name returning records in microseconds.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
PropertyName UnicodeString | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4740: Exiting Wmi Modify Instance for Relative Path RelativePath Property Name PropertyName returning Duration records in Sequence microseconds.
#Event ID 4741
#Description
Entering Wmi Reference with relative path and association class.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
AssociationClass UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4741: Entering Wmi Reference with relative path RelativePath and association class AssociationClass.
#Event ID 4742
#Description
Exiting Wmi Reference with relative path and association class returning records in microseconds.
Fields #
| Name | Description |
|---|---|
RelativePath UnicodeString | |
AssociationClass UnicodeString | |
Resultset UInt32 | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4742: Exiting Wmi Reference with relative path RelativePath and association class AssociationClass returning Resultset records in Duration microseconds.
#Event ID 4743
#Description
Entering Cmdlet 'Cmdlet'.
Fields #
| Name | Description |
|---|---|
Cmdlet UnicodeString | |
Invocation UnicodeString | |
Parameters UnicodeString | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4743: Entering Cmdlet 'Cmdlet'.
#Event ID 4744
#Description
Exiting Cmdlet 'Cmdlet' in Duration microseconds.
Fields #
| Name | Description |
|---|---|
Cmdlet UnicodeString | |
Invocation UnicodeString | |
Parameters UnicodeString | |
Duration UInt32 | |
Sequence UInt32 | |
Source UnicodeString | |
Tag UnicodeString |
Event ID 4744: Exiting Cmdlet 'Cmdlet' in Duration microseconds.
#Provenance
ETW provider GUID 11b3c6b7-e06f-4191-bbb9-7099fff55614
Defined in Microsoft.FailoverClusters.FrameworkSupport.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB