detection.wiki

Microsoft-Windows-FileServices-ServerManager-EventProvider

EventTitleChannelSampleRule
0Exception: message.OperationalYN
1Error.OperationalNN
2Warning.OperationalYN
3Information: message.DebugNN
4Verbose.DebugNN
5Entered function scope: message.DebugNN
6Exited function scope: message.DebugNN
7In finalizer: message.DebugNN
10Forced refresh startedOperationalNN
101Provider Enumeration Task Start Time.OperationalYN
102Provider Enumeration Task Complete Time.OperationalYN
2001Shares Canvas Share Tile load starting.OperationalNN
2002Shares Canvas Share Tile load completed.OperationalNN
4001Volumes Canvas Volume Tile load starting.OperationalYN
4002Volumes Canvas Volume Tile load completed.OperationalYN
4003Pools Canvas Pool Tile load starting.OperationalNN
4004Pools Canvas Pool Tile load completed.OperationalNN
6000Applying iSCSI VHD property page settings started.OperationalNN
6001iSCSI Canvas Vhds Tile load starting.OperationalNN
6002iSCSI Canvas Vhds Tile load completed.OperationalNN
6003Applying iSCSI VHD property page settings succeeded.OperationalNN
6004Applying iSCSI VHD property page settings failed.OperationalNN
6005Applying iSCSI Target property page settings started.OperationalNN
6006Applying iSCSI Target property page settings succeeded.OperationalNN
6007Applying iSCSI Target property page settings failed.OperationalNN
6008iSCSI VHD provider enumeration startedDebugNN
6009iSCSI VHD provider enumeration completedDebugNN
6010iSCSI Target provider enumeration startedDebugNN
6011iSCSI Target provider enumeration completedDebugNN
6012iSCSI VHD provider update started.DebugNN
6013iSCSI VHD provider update completed.DebugNN
6014iSCSI VHD provider update failed.DebugNN
6015iSCSI Target provider update started.DebugNN
6016iSCSI Target provider update completed.DebugNN
6017iSCSI Target provider update failed.DebugNN
6018iSCSI VHD provider deletion started.DebugNN
6019iSCSI VHD provider deletion completed.DebugNN
6020iSCSI VHD provider deletion failed.DebugNN
6021iSCSI Target provider deletion started.DebugNN
6022iSCSI Target provider deletion completed.DebugNN
6023iSCSI Target provider deletion failed.OperationalNN
6024Conversion to iSCSI VHD model object failed.OperationalNN
6025Conversion to iSCSI VHD model object succeeded.DebugNN
6026Conversion to iSCSI Target model object failed.OperationalNN
6027Conversion to iSCSI Target model object succeeded.DebugNN
6028Entered iSCSI pageOperationalNN
6029Exited iSCSI pageOperationalNN

Event ID 0: Exception: message.

#
Channel
Operational
Level
Error
Task
Trace

Message #

Exception: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78b0e04e-3f81-11e0-99f5-02cfded72085",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-07-19T18:57:36.6287709+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "877f78a1-f053-000b-c64f-878753f0dc01",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 21972,
      "thread_id": 14612
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "message": "Caught exception System.ComponentModel.Win32Exception: The system cannot find the file specified\n   at Microsoft.FileServer.Management.Plugin.Services.RemoteRegistryAccessService.InternalGetValue[ResultType](RegistryHive hive, String path, String name)\n   at Microsoft.FileServer.Management.Plugin.Services.RemoteRegistryAccessService.InternalTryGetValue[ResultType](RegistryHive hive, String path, String name, ResultType& value)"
  },
  "message": "Exception: Caught exception System.ComponentModel.Win32Exception: The system cannot find the file specified\r\n   at Microsoft.FileServer.Management.Plugin.Services.RemoteRegistryAccessService.InternalGetValue[ResultType](RegistryHive hive, String path, String name)\r\n   at Microsoft.FileServer.Management.Plugin.Services.RemoteRegistryAccessService.InternalTryGetValue[ResultType](RegistryHive hive, String path, String name, ResultType& value)"
}

Event ID 1: Error.

#
Channel
Operational
Task
Trace

Description

Error: message

Message #

Error: %1

Fields #

NameDescription
message UnicodeString

Event ID 2: Warning.

#
Channel
Operational
Level
Warning
Task
Trace

Description

Warning: message

Message #

Warning: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 3,
    "task": 1,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2022-04-07T17:21:56.967464+00:00",
    "event_record_id": 36,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4100
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "message": "Warning: PostProcess time: 165 ms Type: Microsoft.FileServer.Management.Plugin.Model.Volume"
  },
  "message": ""
}

References #

Event ID 3: Information: message.

#
Channel
Debug
Task
Trace

Message #

Information: %1

Fields #

NameDescription
message UnicodeString

Event ID 4: Verbose.

#
Channel
Debug
Task
Trace

Description

Verbose: message

Message #

Verbose: %1

Fields #

NameDescription
message UnicodeString

Event ID 5: Entered function scope: message.

#
Channel
Debug
Task
Trace

Message #

Entered function scope: %1

Fields #

NameDescription
message UnicodeString

Event ID 6: Exited function scope: message.

#
Channel
Debug
Task
Trace

Message #

Exited function scope: %1

Fields #

NameDescription
message UnicodeString

Event ID 7: In finalizer: message.

#
Channel
Debug
Task
Trace

Message #

In finalizer: %1

Fields #

NameDescription
message UnicodeString

Event ID 10: Forced refresh started

#
Channel
Operational
Task
Refresh

Event ID 101: Provider Enumeration Task Start Time.

#
Channel
Operational
Level
Verbose
Task
Providerenumeratingobjects

Description

Provider Enumeration Task Start Time. Provider: message.

Message #

Provider Enumeration Task Start Time. Provider: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 5,
    "task": 14,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2022-04-07T17:36:32.680478+00:00",
    "event_record_id": 45,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "message": "Volumes : 17:36:32.6659384"
  },
  "message": ""
}

References #

Event ID 102: Provider Enumeration Task Complete Time.

#
Channel
Operational
Level
Verbose
Task
Providerenumeratingobjects

Description

Provider Enumeration Task Complete Time. Provider: message.

Message #

Provider Enumeration Task Complete Time. Provider: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 5,
    "task": 14,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2022-04-07T17:36:33.141306+00:00",
    "event_record_id": 50,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "message": "Storage : 17:36:33.1339336"
  },
  "message": ""
}

References #

Event ID 2001: Shares Canvas Share Tile load starting.

#
Channel
Operational
Task
Refresh

Description

Shares Canvas Share Tile load starting. Time: message.

Message #

Shares Canvas Share Tile load starting. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 2002: Shares Canvas Share Tile load completed.

#
Channel
Operational
Task
Refresh

Description

Shares Canvas Share Tile load completed. Time: message.

Message #

Shares Canvas Share Tile load completed. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 4001: Volumes Canvas Volume Tile load starting.

#
Channel
Operational
Level
Verbose
Task
Refresh

Description

Volumes Canvas Volume Tile load starting. Time: message.

Message #

Volumes Canvas Volume Tile load starting. Time: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
    "event_source_name": "",
    "event_id": 4001,
    "version": 0,
    "level": 5,
    "task": 5,
    "opcode": 0,
    "keywords": 2305843009213693956,
    "time_created": "2022-04-07T17:21:54.059080+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "message": "17:21:54.0446696"
  },
  "message": ""
}

References #

Event ID 4002: Volumes Canvas Volume Tile load completed.

#
Channel
Operational
Level
Verbose
Task
Refresh

Description

Volumes Canvas Volume Tile load completed. Time: message.

Message #

Volumes Canvas Volume Tile load completed. Time: %1

Fields #

NameDescription
message UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileServices-ServerManager-EventProvider",
    "guid": "78B0E04E-3F81-11E0-99F5-02CFDED72085",
    "event_source_name": "",
    "event_id": 4002,
    "version": 0,
    "level": 5,
    "task": 5,
    "opcode": 0,
    "keywords": 2305843009213693956,
    "time_created": "2022-04-07T17:36:32.681353+00:00",
    "event_record_id": 49,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-5A0E-ABE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-FileServices-ServerManager-EventProvider/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "message": "17:36:32.6808435"
  },
  "message": ""
}

References #

Event ID 4003: Pools Canvas Pool Tile load starting.

#
Channel
Operational
Task
Refresh

Description

Pools Canvas Pool Tile load starting. Time: message.

Message #

Pools Canvas Pool Tile load starting. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 4004: Pools Canvas Pool Tile load completed.

#
Channel
Operational
Task
Refresh

Description

Pools Canvas Pool Tile load completed. Time: message.

Message #

Pools Canvas Pool Tile load completed. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 6000: Applying iSCSI VHD property page settings started.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI VHD property page settings started. Object ID: objectId.

Message #

Applying iSCSI VHD property page settings started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6001: iSCSI Canvas Vhds Tile load starting.

#
Channel
Operational
Task
Refresh

Description

iSCSI Canvas Vhds Tile load starting. Time: message.

Message #

iSCSI Canvas Vhds Tile load starting. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 6002: iSCSI Canvas Vhds Tile load completed.

#
Channel
Operational
Task
Refresh

Description

iSCSI Canvas Vhds Tile load completed. Time: message.

Message #

iSCSI Canvas Vhds Tile load completed. Time: %1

Fields #

NameDescription
message UnicodeString

Event ID 6003: Applying iSCSI VHD property page settings succeeded.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI VHD property page settings succeeded. Object ID: objectId.

Message #

Applying iSCSI VHD property page settings succeeded. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6004: Applying iSCSI VHD property page settings failed.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI VHD property page settings failed. Object ID: objectId. Error message: message.

Message #

Applying iSCSI VHD property page settings failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6005: Applying iSCSI Target property page settings started.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI Target property page settings started. Object ID: objectId.

Message #

Applying iSCSI Target property page settings started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6006: Applying iSCSI Target property page settings succeeded.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI Target property page settings succeeded. Object ID: objectId.

Message #

Applying iSCSI Target property page settings succeeded. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6007: Applying iSCSI Target property page settings failed.

#
Channel
Operational
Task
Propertypageapplyingsettings

Description

Applying iSCSI Target property page settings failed. Object ID: objectId. Error message: message.

Message #

Applying iSCSI Target property page settings failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6008: iSCSI VHD provider enumeration started

#
Channel
Debug
Task
Providerenumeratingobjects

Event ID 6009: iSCSI VHD provider enumeration completed

#
Channel
Debug
Task
Providerenumeratingobjects

Event ID 6010: iSCSI Target provider enumeration started

#
Channel
Debug
Task
Providerenumeratingobjects

Event ID 6011: iSCSI Target provider enumeration completed

#
Channel
Debug
Task
Providerenumeratingobjects

Event ID 6012: iSCSI VHD provider update started.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI VHD provider update started. Object ID: objectId.

Message #

iSCSI VHD provider update started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6013: iSCSI VHD provider update completed.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI VHD provider update completed. Object ID: objectId.

Message #

iSCSI VHD provider update completed. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6014: iSCSI VHD provider update failed.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI VHD provider update failed. Object ID: objectId. Error message: message.

Message #

iSCSI VHD provider update failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6015: iSCSI Target provider update started.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI Target provider update started. Object ID: objectId.

Message #

iSCSI Target provider update started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6016: iSCSI Target provider update completed.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI Target provider update completed. Object ID: objectId.

Message #

iSCSI Target provider update completed. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6017: iSCSI Target provider update failed.

#
Channel
Debug
Task
Providerupdatingobject

Description

iSCSI Target provider update failed. Object ID: objectId. Error message: message.

Message #

iSCSI Target provider update failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6018: iSCSI VHD provider deletion started.

#
Channel
Debug
Task
Providerdeletingobject

Description

iSCSI VHD provider deletion started. Object ID: objectId.

Message #

iSCSI VHD provider deletion started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6019: iSCSI VHD provider deletion completed.

#
Channel
Debug
Task
Providerdeletingobject

Description

iSCSI VHD provider deletion completed. Object ID: objectId.

Message #

iSCSI VHD provider deletion completed. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6020: iSCSI VHD provider deletion failed.

#
Channel
Debug
Task
Providerdeletingobject

Description

iSCSI VHD provider deletion failed. Object ID: objectId. Error message: message.

Message #

iSCSI VHD provider deletion failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6021: iSCSI Target provider deletion started.

#
Channel
Debug
Task
Providerdeletingobject

Description

iSCSI Target provider deletion started. Object ID: objectId.

Message #

iSCSI Target provider deletion started. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6022: iSCSI Target provider deletion completed.

#
Channel
Debug
Task
Providerdeletingobject

Description

iSCSI Target provider deletion completed. Object ID: objectId.

Message #

iSCSI Target provider deletion completed. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6023: iSCSI Target provider deletion failed.

#
Channel
Operational
Task
Providerdeletingobject

Description

iSCSI Target provider deletion failed. Object ID: objectId. Error message: message.

Message #

iSCSI Target provider deletion failed. Object ID: %1. Error message: %2

Fields #

NameDescription
objectId UnicodeString
message UnicodeString

Event ID 6024: Conversion to iSCSI VHD model object failed.

#
Channel
Operational
Task
PSObjectconversion

Description

Conversion to iSCSI VHD model object failed. Error message: message.

Message #

Conversion to iSCSI VHD model object failed. Error message: %1

Fields #

NameDescription
message UnicodeString

Event ID 6025: Conversion to iSCSI VHD model object succeeded.

#
Channel
Debug
Task
PSObjectconversion

Description

Conversion to iSCSI VHD model object succeeded. Object ID: objectId.

Message #

Conversion to iSCSI VHD model object succeeded. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6026: Conversion to iSCSI Target model object failed.

#
Channel
Operational
Task
PSObjectconversion

Description

Conversion to iSCSI Target model object failed. Error message: message.

Message #

Conversion to iSCSI Target model object failed. Error message: %1

Fields #

NameDescription
message UnicodeString

Event ID 6027: Conversion to iSCSI Target model object succeeded.

#
Channel
Debug
Task
PSObjectconversion

Description

Conversion to iSCSI Target model object succeeded. Object ID: objectId.

Message #

Conversion to iSCSI Target model object succeeded. Object ID: %1

Fields #

NameDescription
objectId UnicodeString

Event ID 6028: Entered iSCSI page

#
Channel
Operational
Task
Pagenavigation

Event ID 6029: Exited iSCSI page

#
Channel
Operational
Task
Pagenavigation

Provenance

ETW provider GUID 78b0e04e-3f81-11e0-99f5-02cfded72085

Defined in FssmInst.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB