detection.wiki

Microsoft-Windows-FileShareShadowCopyProvider

EventTitleChannelSampleRule
0Microsoft File Share Shadow Copy Provider is loadedOperationalYN
1Microsoft File Share Shadow Copy Provider is unloaded.OperationalYN
2Microsoft File Share Shadow Copy Provider primary metadata store is created.OperationalYN
3Microsoft File Share Shadow Copy Provider: Delete Shadow Copy: ShadowCopyId.OperationalNN
1000Microsoft File Share Shadow Copy Provider Error: Fail to load the persistent …OperationalNN
1001Microsoft File Share Shadow Copy Provider Error: Fail to save the persistent …OperationalNN
1002Fail to open Microsoft File Share Shadow Copy Provider primary metadata store …OperationalNN
1003Fail to open Microsoft File Share Shadow Copy Provider alternate metadata store …OperationalNN
1004Microsoft File Share Shadow Copy Provider Error: Contents of the file share …OperationalNN
1005Microsoft File Share Shadow Copy Provider Error: Fail to negotiate with file …OperationalNN
1006Microsoft File Share Shadow Copy Provider Error: Fail to finish preparing shadow …OperationalNN
1007Microsoft File Share Shadow Copy Provider Error: Fail to commit all file servers …OperationalNN
1008Microsoft File Share Shadow Copy Provider Error: Fail to expose the file share …OperationalNN
1009Microsoft File Share Shadow Copy Provider Error: Failed to connect to …OperationalNN
1010Microsoft File Share Shadow Copy Provider Error: Create worker thread for shadow …OperationalNN
1011Microsoft File Share Shadow Copy Provider Error: The worker thread to create …OperationalNN

Event ID 0: Microsoft File Share Shadow Copy Provider is loaded

#
Channel
Operational
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileShareShadowCopyProvider",
    "guid": "89300202-3CEC-4981-9171-19F59559E0F2",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T18:21:04.651230+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 2648,
      "thread_id": 6840
    },
    "channel": "Microsoft-Windows-FileShareShadowCopyProvider/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1: Microsoft File Share Shadow Copy Provider is unloaded.

#
Channel
Operational
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileShareShadowCopyProvider",
    "guid": "89300202-3CEC-4981-9171-19F59559E0F2",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T18:30:17.625152+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 2648,
      "thread_id": 9916
    },
    "channel": "Microsoft-Windows-FileShareShadowCopyProvider/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 2: Microsoft File Share Shadow Copy Provider primary metadata store is created.

#
Channel
Operational
Level
Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-FileShareShadowCopyProvider",
    "guid": "89300202-3CEC-4981-9171-19F59559E0F2",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T18:21:04.649421+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2648,
      "thread_id": 6840
    },
    "channel": "Microsoft-Windows-FileShareShadowCopyProvider/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 3: Microsoft File Share Shadow Copy Provider: Delete Shadow Copy: ShadowCopyId.

#
Channel
Operational

Message #

Microsoft File Share Shadow Copy Provider: Delete Shadow Copy: %1.

Fields #

NameDescription
ShadowCopyId GUID

Event ID 1000: Microsoft File Share Shadow Copy Provider Error: Fail to load the persistent metadata store.

#
Channel
Operational

Event ID 1001: Microsoft File Share Shadow Copy Provider Error: Fail to save the persistent metadata store.

#
Channel
Operational

Event ID 1002: Fail to open Microsoft File Share Shadow Copy Provider primary metadata store failed with error code: ErrorCode.

#
Channel
Operational

Message #

Fail to open Microsoft File Share Shadow Copy Provider primary metadata store failed with error code: %2.

Fields #

NameDescription
Name UnicodeString
ErrorCode UInt32

Event ID 1003: Fail to open Microsoft File Share Shadow Copy Provider alternate metadata store failed with error code: ErrorCode.

#
Channel
Operational

Message #

Fail to open Microsoft File Share Shadow Copy Provider alternate metadata store failed with error code: %2.

Fields #

NameDescription
Name UnicodeString
ErrorCode UInt32

Event ID 1004: Microsoft File Share Shadow Copy Provider Error: Contents of the file share shadow copy set database are invalid.

#
Channel
Operational

Event ID 1005: Microsoft File Share Shadow Copy Provider Error: Fail to negotiate with file server supported version.

#
Channel
Operational

Fields #

NameDescription
FileServerName UnicodeString
MinClientVersion UInt32
MaxClientVersion UInt32
MinServerVersion UInt32
MaxServerVersion UInt32

Event ID 1006: Microsoft File Share Shadow Copy Provider Error: Fail to finish preparing shadow copy creation within 30 minutes.

#
Channel
Operational

Event ID 1007: Microsoft File Share Shadow Copy Provider Error: Fail to commit all file servers within 60 seconds.

#
Channel
Operational

Event ID 1008: Microsoft File Share Shadow Copy Provider Error: Fail to expose the file share shadow copies within 30 minutes.

#
Channel
Operational

Event ID 1009: Microsoft File Share Shadow Copy Provider Error: Failed to connect to FssAgentRPC server: FileServerName with error code: ErrorCode.

#
Channel
Operational

Message #

Microsoft File Share Shadow Copy Provider Error: Failed to connect to FssAgentRPC server: %1 with error code: %2.

Fields #

NameDescription
FileServerName UnicodeString
ErrorCode UInt32

Event ID 1010: Microsoft File Share Shadow Copy Provider Error: Create worker thread for shadow copy creation on file server failed.

#
Channel
Operational

Event ID 1011: Microsoft File Share Shadow Copy Provider Error: The worker thread to create shadow copy on file server terminated unexpected.

#
Channel
Operational

Provenance

ETW provider GUID {89300202-3CEC-4981-9171-19F59559E0F2}

Defined in fssProv.dll, which carries the event manifest.

  • WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB