Microsoft-Windows-FileServices-ServerManager-EventProvider
47 events across 2 channels
Event ID 0: Exception: message.
#Event ID 2: Warning.
#Description
Warning: message
Message #
Fields #
| Name | Description |
|---|---|
message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
"guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
"event_source_name": "",
"event_id": 2,
"version": 0,
"level": 3,
"task": 1,
"opcode": 0,
"keywords": 2305843009213693953,
"time_created": "2022-04-07T17:21:56.967464+00:00",
"event_record_id": 36,
"correlation": {
"ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
},
"execution": {
"process_id": 4444,
"thread_id": 4100
},
"channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
}
},
"event_data": {
"message": "Warning: PostProcess time: 165 ms Type: Microsoft.FileServer.Management.Plugin.Model.Volume"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3: Information: message.
#Event ID 4: Verbose.
#Event ID 5: Entered function scope: message.
#Event ID 6: Exited function scope: message.
#Event ID 7: In finalizer: message.
#Event ID 101: Provider Enumeration Task Start Time.
#Description
Provider Enumeration Task Start Time. Provider: message.
Message #
Fields #
| Name | Description |
|---|---|
message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
"guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
"event_source_name": "",
"event_id": 101,
"version": 0,
"level": 5,
"task": 14,
"opcode": 0,
"keywords": 2305843009213693953,
"time_created": "2022-04-07T17:36:32.680478+00:00",
"event_record_id": 45,
"correlation": {
"ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
},
"execution": {
"process_id": 4444,
"thread_id": 4448
},
"channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
}
},
"event_data": {
"message": "Volumes : 17:36:32.6659384"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 102: Provider Enumeration Task Complete Time.
#Description
Provider Enumeration Task Complete Time. Provider: message.
Message #
Fields #
| Name | Description |
|---|---|
message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
"guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
"event_source_name": "",
"event_id": 102,
"version": 0,
"level": 5,
"task": 14,
"opcode": 0,
"keywords": 2305843009213693953,
"time_created": "2022-04-07T17:36:33.141306+00:00",
"event_record_id": 50,
"correlation": {
"ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
},
"execution": {
"process_id": 4444,
"thread_id": 4448
},
"channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
}
},
"event_data": {
"message": "Storage : 17:36:33.1339336"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 2001: Shares Canvas Share Tile load starting.
#Event ID 2002: Shares Canvas Share Tile load completed.
#Event ID 4001: Volumes Canvas Volume Tile load starting.
#Description
Volumes Canvas Volume Tile load starting. Time: message.
Message #
Fields #
| Name | Description |
|---|---|
message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
"guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
"event_source_name": "",
"event_id": 4001,
"version": 0,
"level": 5,
"task": 5,
"opcode": 0,
"keywords": 2305843009213693956,
"time_created": "2022-04-07T17:21:54.059080+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 4444,
"thread_id": 4448
},
"channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
}
},
"event_data": {
"message": "17:21:54.0446696"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 4002: Volumes Canvas Volume Tile load completed.
#Description
Volumes Canvas Volume Tile load completed. Time: message.
Message #
Fields #
| Name | Description |
|---|---|
message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
"guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
"event_source_name": "",
"event_id": 4002,
"version": 0,
"level": 5,
"task": 5,
"opcode": 0,
"keywords": 2305843009213693956,
"time_created": "2022-04-07T17:36:32.681353+00:00",
"event_record_id": 49,
"correlation": {
"ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
},
"execution": {
"process_id": 4444,
"thread_id": 4448
},
"channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
}
},
"event_data": {
"message": "17:36:32.6808435"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 4003: Pools Canvas Pool Tile load starting.
#Event ID 4004: Pools Canvas Pool Tile load completed.
#Event ID 6000: Applying iSCSI VHD property page settings started.
#Event ID 6001: iSCSI Canvas Vhds Tile load starting.
#Event ID 6002: iSCSI Canvas Vhds Tile load completed.
#Event ID 6003: Applying iSCSI VHD property page settings succeeded.
#Event ID 6004: Applying iSCSI VHD property page settings failed.
#Event ID 6005: Applying iSCSI Target property page settings started.
#Event ID 6006: Applying iSCSI Target property page settings succeeded.
#Event ID 6007: Applying iSCSI Target property page settings failed.
#Event ID 6008: iSCSI VHD provider enumeration started
#Description
iSCSI VHD provider enumeration started.
Message #
Event ID 6009: iSCSI VHD provider enumeration completed
#Description
iSCSI VHD provider enumeration completed.
Message #
Event ID 6010: iSCSI Target provider enumeration started
#Description
iSCSI Target provider enumeration started.
Message #
Event ID 6011: iSCSI Target provider enumeration completed
#Description
iSCSI Target provider enumeration completed.
Message #
Event ID 6012: iSCSI VHD provider update started.
#Event ID 6013: iSCSI VHD provider update completed.
#Event ID 6014: iSCSI VHD provider update failed.
#Event ID 6015: iSCSI Target provider update started.
#Event ID 6016: iSCSI Target provider update completed.
#Event ID 6017: iSCSI Target provider update failed.
#Event ID 6018: iSCSI VHD provider deletion started.
#Event ID 6019: iSCSI VHD provider deletion completed.
#Event ID 6020: iSCSI VHD provider deletion failed.
#Event ID 6021: iSCSI Target provider deletion started.
#Event ID 6022: iSCSI Target provider deletion completed.
#Event ID 6023: iSCSI Target provider deletion failed.
#Event ID 6024: Conversion to iSCSI VHD model object failed.
#Event ID 6025: Conversion to iSCSI VHD model object succeeded.
#Event ID 6026: Conversion to iSCSI Target model object failed.
#Event ID 6027: Conversion to iSCSI Target model object succeeded.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 78b0e04e-3f81-11e0-99f5-02cfded72085
Defined in FssmInst.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02