Microsoft-Windows-IIS-FTP
16 events across 1 channel
Event ID 1074003979: Anonymous logon request received from Client at host Host.
#Event ID 1074003980: User logon request received from Client at host Host.
#Event ID 2147745802: User User at host Host has timed-out after InactivtyTime seconds of inactivity.
#Event ID 2147745805: User User failed to log on, could not access the home directory HomeDir.
#Event ID 2147745806: User User denied access to the current directory Dir due to a security change.
#Event ID 2147760193: The server failed to create a data channel connection to a client on local interface.
#Event ID 3221487617: FTP Server could not initialize its security.
#Event ID 3221487619: FTP Server could not initialize the socket library.
#Event ID 3221487620: FTP Server was unable to initialize because of a shortage of available memory.
#Event ID 3221487621: FTP Server could not locate the FTP/TCP service.
#Event ID 3221487622: FTP Server could not create the main connection socket.
#Event ID 3221487623: FTP Server could not create the main connection thread.
#Event ID 3221487624: FTP Server could not create a client worker thread for user at host param1.
#Event ID 3221487625: A call to a system service failed unexpectedly.
#Event ID 3221487631: Failed to read metabase property PassivePortRange under the FTP Service node FTPMetabasePath.
#Event ID 3221487632: The FTP Service configuration property PassivePortRange has invalid value.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID ab29f35c-8531-42ff-810d-b8552d23bc92
Defined in iisres.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02