Microsoft-Windows-iSCSITarget-Service

198 events across 2 channels

Event	Title	Channel	Sample
1	The Microsoft iSCSI Target Server service.	Admin	N
1	Event ID 1	Operational	Y
2	The Microsoft iSCSI Target Server service could not register its handler.	Admin	N
2	Event ID 2	Operational	N
3	The Microsoft iSCSI Target Server service received an invalid service request …	Admin	N
3	Event ID 3	Operational	N
4	The Microsoft iSCSI Target Server service stopped.	Admin	N
4	Event ID 4	Operational	Y
9	The Microsoft iSCSI Target Server service could not retrieve volume information …	Admin	N
9	Event ID 9	Operational	N
10	The Microsoft iSCSI Target Server service could not bind to network address …	Admin	N
10	Event ID 10	Operational	N
11	The iSCSI target received an invalid header digest from initiator …	Admin	N
11	Event ID 11	Operational	N
12	The iSCSI target received an invalid data digest from initiator szInitiatorName.	Admin	N
12	Event ID 12	Operational	N
13	The Microsoft iSCSI Target Server service could not create the virtual disk …	Admin	N
13	Event ID 13	Operational	N
14	The Microsoft iSCSI Target Server service successfully initialized virtual disk …	Admin	N
14	Event ID 14	Operational	Y
15	The Microsoft iSCSI Target Server service could not load virtual disk …	Admin	N
15	Event ID 15	Operational	N
16	The iSCSI target is configured to use CHAP authentication but the iSCSI …	Admin	N
16	Event ID 16	Operational	N
17	The iSCSI target only supports MD5 CHAP authentication, but the iSCSI initiator …	Admin	N
17	Event ID 17	Operational	N
18	The Microsoft iSCSI Target Server service could not authenticate iSCSI initiator …	Admin	N
18	Event ID 18	Operational	N
19	The iSCSI target is not configured to use authentication but iSCSI initiator …	Admin	N
19	Event ID 19	Operational	N
20	iSCSI initiator szInitiatorName successfully logged on to the iSCSI target.	Admin	N
20	Event ID 20	Operational	N
21	iSCSI initiator szInitiatorName logged off of the iSCSI target.	Admin	N
21	Event ID 21	Operational	N
22	iSCSI initiator szInitiatorName requested an invalid iSCSI target: szTargetName.	Admin	N
22	Event ID 22	Operational	N
23	iSCSI initiator szInitiatorName sent a PDU with a payload size (ActualSize …	Admin	N
23	Event ID 23	Operational	N
24	The Microsoft iSCSI Target Server service encountered an error indicating that …	Admin	N
24	Event ID 24	Operational	N
25	Starting virtual disk VirtualDiskIndex roll back to the snapshot taken on …	Admin	N
25	Event ID 25	Operational	N
26	Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime …	Admin	N
26	Event ID 26	Operational	N
27	Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime was …	Admin	N
27	Event ID 27	Operational	N
28	The Microsoft iSCSI Target Server service could not roll back virtual disk …	Admin	N
28	Event ID 28	Operational	N
32	The Microsoft iSCSI Target Server service could not open the local mount driver.	Admin	N
32	Event ID 32	Operational	Y
33	SCSI command CDBCommand directed at virtual disk LUN failed.	Admin	N
33	Event ID 33	Operational	N
34	The Microsoft iSCSI Target Server service could not delete snapshot of virtual …	Admin	N
34	Event ID 34	Operational	N
36	Failed to load iSCSI target szTargetName settings from the registry.	Admin	N
36	Event ID 36	Operational	N
37	Failed to load virtual disk VirtualDiskIndex settings from the registry.	Admin	N
37	Event ID 37	Operational	N
38	The iSCSI initiator szInitiatorName does not have access to this iSCSI target …	Admin	N
38	Event ID 38	Operational	N
39	Storage services for iSCSI target szTargetName is disabled.	Admin	N
39	Event ID 39	Operational	N
40	Incoming connection request was rejected.	Admin	N
40	Event ID 40	Operational	N
41	The iSCSI target rejected a connection request from the local computer.	Admin	N
41	Event ID 41	Operational	N
44	The Microsoft iSCSI Target Server service could not create a snapshot of virtual …	Admin	N
44	Event ID 44	Operational	N
45	The Microsoft iSCSI Target Server service could not create or open registry key …	Admin	N
45	Event ID 45	Operational	N
46	The Microsoft iSCSI Target Server service could not locate missing registry key …	Admin	N
46	Event ID 46	Operational	N
48	Virtual Disk VirtualDiskIndex has been disabled.	Admin	N
48	Event ID 48	Operational	N
49	The Microsoft iSCSI Target Server service could not create a clustered virtual …	Admin	N
49	Event ID 49	Operational	N
50	The Microsoft iSCSI Target Server service could not delete virtual disk …	Admin	N
50	Event ID 50	Operational	N
51	The Microsoft iSCSI Target Server service could not open virtual disk …	Admin	N
51	Event ID 51	Operational	N
52	The Microsoft iSCSI Target Server service could not assign virtual disk …	Admin	N
52	Event ID 52	Operational	N
53	The Microsoft iSCSI Target Server service detected conflicting virtual disk …	Admin	N
53	Event ID 53	Operational	N
64	The Microsoft iSCSI Target Server service could not create target szTargetName.	Admin	N
64	Event ID 64	Operational	Y
65	The Microsoft iSCSI Target Server service could not create iSCSI target …	Admin	N
65	Event ID 65	Operational	N
66	The Microsoft iSCSI Target Server service could not open iSCSI target …	Admin	N
66	Event ID 66	Operational	N
67	The Microsoft iSCSI Target Server service could not delete iSCSI target …	Admin	N
67	Event ID 67	Operational	N
68	The Microsoft iSCSI Target Server service successfully initialized iSCSI target …	Admin	N
68	Event ID 68	Operational	Y
71	The Microsoft iSCSI Target Server service failed to complete service …	Admin	N
71	Event ID 71	Operational	N
73	The Microsoft iSCSI Target Server service could not online iSCSI target …	Admin	N
73	Event ID 73	Operational	N
74	The Wintarget service has detected the creation of a failover cluster.	Admin	N
74	Event ID 74	Operational	N
117	iSCSI initiator szInitiatorName has committed a protocol error.	Admin	N
117	Event ID 117	Operational	N
118	The Cluster Service that the Microsoft iSCSI Target Server service depends on is …	Admin	N
118	Event ID 118	Operational	N
120	A target could not be initialized from its configuration settings.	Admin	N
120	Event ID 120	Operational	N
121	The CHAP of the target szTargetName could not be decrypted, the initiator will …	Admin	N
121	Event ID 121	Operational	N
256	SNAPSHOT_STATE_MACHINE	Operational	N
257	DISKMGR_CREATEDISKStart	Operational	N
258	DISKMGR_CREATEDISKStop	Operational	N
259	DISKMGR_CREATEDISKStart259	Operational	N
260	DISKMGR_CREATEDISKStop260	Operational	N
261	ISCSITARGETRESOURCE_LIFETIMEStart	Operational	N
262	ISCSITARGETRESOURCE_LIFETIMEStop	Operational	N
263	ISCSIRESOURCECOLLECTION_LIFETIME	Operational	N
264	ISCSIRESOURCECOLLECTION_LIFETIME264	Operational	N
265	ISCSIRESOURCECOLLECTION_LIFETIME265	Operational	N
266	ISCSITGT_ERROR_TRACE	Operational	N
267	TARGETMGR_CREATETARGETStart	Operational	N
268	TARGETMGR_CREATETARGETStop	Operational	N
269	TARGETMGR_CLOSETARGETStart	Operational	N
270	TARGETMGR_CLOSETARGETStop	Operational	N
271	DISKMGR_GETDISKStart	Operational	N
272	DISKMGR_GETDISKStop	Operational	N
273	DISKMGR_CREATEDISKStart273	Operational	N
274	DISKMGR_CREATEDISKStop274	Operational	N
275	DISKMGR_GETDISKStart275	Operational	N
276	DISKMGR_GETDISKStop276	Operational	N
277	SNAPSHOTMGR_NOTIFYStart	Operational	N
278	SNAPSHOTMGR_NOTIFYStop	Operational	N
279	DISKMGR_CREATEDISKStart279	Operational	N
280	DISKMGR_CREATEDISKStop280	Operational	N
281	DISKMGR_DELETEDISKStart	Operational	N
282	DISKMGR_DELETEDISKStop	Operational	N
283	TARGETMGR_CREATETARGETStart283	Operational	N
284	TARGETMGR_CREATETARGETStop284	Operational	N
285	ISCSI_PROTOCOL_LIFETIMEStart	Operational	N
286	ISCSI_PROTOCOL_LIFETIMEStop	Operational	N
287	ISCSI_PROTOCOL_LIFETIMEStop287	Operational	N
288	SNAPSHOTMGR_NOTIFYStart288	Operational	N
289	SNAPSHOTMGR_NOTIFYStop289	Operational	N
290	ISCSITARGETRESOURCE_LIFETIME	Operational	N
291	ISCSITARGETRESOURCE_LIFETIME291	Operational	N
292	ISCSITARGETRESOURCE_LIFETIME292	Operational	N
293	SNAPSHOT_OPERATIONStart	Operational	N
294	SNAPSHOT_OPERATIONStop	Operational	N
295	SNAPSHOTMGR_OPERATIONStart	Operational	N
296	SNAPSHOTMGR_OPERATIONStop	Operational	N
297	SNAPSHOTMGR_OPERATIONStart297	Operational	N
298	SNAPSHOTMGR_OPERATIONStop298	Operational	N
299	SNAPSHOTMGR_OPERATIONStart299	Operational	N
300	SNAPSHOTMGR_OPERATIONStop300	Operational	N
301	SNAPSHOTMGR_OPERATIONStart301	Operational	N
302	SNAPSHOTMGR_OPERATIONStop302	Operational	N
303	SNAPSHOTMGR_OPERATIONStart303	Operational	N
304	SNAPSHOTMGR_OPERATIONStop304	Operational	N
305	SNAPSHOTMGR_OPERATIONStart305	Operational	N
306	SNAPSHOTMGR_OPERATIONStop306	Operational	N
307	SNAPSHOTMGR_OPERATIONStart307	Operational	N
308	SNAPSHOTMGR_OPERATIONStop308	Operational	N
309	SNAPSHOTMGR_OPERATIONStart309	Operational	N
310	SNAPSHOTMGR_OPERATIONStop310	Operational	N
311	SNAPSHOTMGR_OPERATIONStart311	Operational	N
312	SNAPSHOTMGR_OPERATIONStop312	Operational	N
313	ISCSI_PROTOCOL_LIFETIME	Operational	N
314	ISCSI_PROTOCOL_LIFETIME314	Operational	N
315	ISCSI_PROTOCOL_LIFETIMEStart315	Operational	N
316	ISCSI_PROTOCOL_LIFETIMEStop316	Operational	N
318	TARGETMGR_OPERATIONStart	Operational	N
319	TARGETMGR_OPERATIONStop	Operational	N
320	DISKMGR_OPERATIONStart	Operational	N
321	DISKMGR_OPERATIONStop	Operational	N
322	TARGETMGR_OPERATIONStart322	Operational	N
323	TARGETMGR_OPERATIONStop323	Operational	N
324	SNAPSHOT_OPERATIONStart324	Operational	N
325	SNAPSHOT_OPERATIONStop325	Operational	N
326	DEVMGR_OPERATIONStart	Operational	N
327	DEVMGR_OPERATIONStop	Operational	N
330	DEVMGR_OPERATIONStart330	Operational	N
331	DEVMGR_OPERATIONStop331	Operational	N
332	SNAPSHOT_OPERATIONStart332	Operational	N
333	SNAPSHOT_OPERATIONStop333	Operational	N
334	SNAPSHOT_OPERATIONStart334	Operational	N
335	SNAPSHOT_OPERATIONStop335	Operational	N
336	SNAPSHOT_OPERATIONStart336	Operational	N
337	SNAPSHOT_OPERATIONStop337	Operational	N
338	PDU_PROCESSING	Operational	N
339	PDU_PROCESSING339	Operational	N
340	CDB_DISPATCH	Operational	N
341	PDU_PROCESSING341	Operational	N
342	PDU_PROCESSING342	Operational	N
343	DISKMGR_OPERATIONStart343	Operational	N
344	DISKMGR_OPERATIONStop344	Operational	N
345	DISKMGR_OPERATIONStart345	Operational	N
346	DISKMGR_OPERATIONStop346	Operational	N
347	VIRTUALDISK_OPERATION	Operational	N
4096	UNIFIED_TRACING	Operational	N

Event ID 1: The Microsoft iSCSI Target Server service.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service (vVersionHigh.VersionLow) started successfully.

Message #

The Microsoft iSCSI Target Server service (v%1.%2) started successfully.

Fields #

Name	Description
`VersionHigh` UInt16
`VersionLow` UInt16

Event ID 1

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 4

Description

The Microsoft iSCSI Target Server service (v.) started successfully.

Fields #

Name	Description
`VersionHigh` UInt16
`VersionLow` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T02:17:57.4938059+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 4604,
      "thread_id": 9684
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VersionHigh": "10",
    "VersionLow": "0"
  },
  "message": "The Microsoft iSCSI Target Server service (v10.0) started successfully."
}

Event ID 2: The Microsoft iSCSI Target Server service could not register its handler.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not register its handler. The operation failed with error code ErrorCode.

Message #

The Microsoft iSCSI Target Server service could not register its handler. The operation failed with error code %1.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 2

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not register its handler. The operation failed with error code .

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 3: The Microsoft iSCSI Target Server service received an invalid service request dwControl.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service received an invalid service request dwControl.

Message #

The Microsoft iSCSI Target Server service received an invalid service request %1.

Fields #

Name	Description
`dwControl` UInt32

Event ID 3

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service received an invalid service request .

Fields #

Name	Description
`dwControl` UInt32

Event ID 4: The Microsoft iSCSI Target Server service stopped.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service stopped.

Message #

The Microsoft iSCSI Target Server service stopped.

Event ID 4

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 4

Description

The Microsoft iSCSI Target Server service stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T03:11:47.6361855+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 4604,
      "thread_id": 9684
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Microsoft iSCSI Target Server service stopped."
}

Event ID 9: The Microsoft iSCSI Target Server service could not retrieve volume information from the system.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not retrieve volume information from the system. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not retrieve volume information from the system. The operation failed with error code %1.

Fields #

Name	Description
`hrError` UInt32

Event ID 9

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not retrieve volume information from the system. The operation failed with error code .

Fields #

Name	Description
`hrError` UInt32

Event ID 10: The Microsoft iSCSI Target Server service could not bind to network address IpAddress, port dwPort.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not bind to network address IpAddress, port dwPort. The operation failed with error code Error. Ensure that no other application is using this port.

Message #

The Microsoft iSCSI Target Server service could not bind to network address %1, port %2. The operation failed with error code %3. Ensure that no other application is using this port.

Fields #

Name	Description
`IpAddress` UnicodeString
`dwPort` UInt32
`Error` UInt32

Event ID 10

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not bind to network address , port . The operation failed with error code . Ensure that no other application is using this port.

Fields #

Name	Description
`IpAddress` UnicodeString
`dwPort` UInt32
`Error` UInt32

Event ID 11: The iSCSI target received an invalid header digest from initiator szInitiatorName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI target received an invalid header digest from initiator szInitiatorName.

Message #

The iSCSI target received an invalid header digest from initiator %1.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 11

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI target received an invalid header digest from initiator .

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 12: The iSCSI target received an invalid data digest from initiator szInitiatorName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI target received an invalid data digest from initiator szInitiatorName.

Message #

The iSCSI target received an invalid data digest from initiator %1.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 12

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI target received an invalid data digest from initiator .

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 13: The Microsoft iSCSI Target Server service could not create the virtual disk using device DevicePath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create the virtual disk using device DevicePath. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not create the virtual disk using device %1. The operation failed with error code %2.

Fields #

Name	Description
`DevicePath` UnicodeString
`hrError` UInt32

Event ID 13

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not create the virtual disk using device . The operation failed with error code .

Fields #

Name	Description
`DevicePath` UnicodeString
`hrError` UInt32

Event ID 14: The Microsoft iSCSI Target Server service successfully initialized virtual disk VirtualDiskIndex located at DevicePath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service successfully initialized virtual disk VirtualDiskIndex located at DevicePath.

Message #

The Microsoft iSCSI Target Server service successfully initialized virtual disk %1 located at %2.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`DevicePath` UnicodeString

Event ID 14

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 4

Description

The Microsoft iSCSI Target Server service successfully initialized virtual disk located at .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`DevicePath` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 14,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T03:12:20.0101326+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 2920,
      "thread_id": 3148
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "VirtualDiskIndex": "1322854675",
    "DevicePath": "C:\\iscsivd\\lun0.vhdx"
  },
  "message": "The Microsoft iSCSI Target Server service successfully initialized virtual disk 1322854675 located at C:\\iscsivd\\lun0.vhdx."
}

Event ID 15: The Microsoft iSCSI Target Server service could not load virtual disk VirtualDiskIndex located at DevicePath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not load virtual disk VirtualDiskIndex located at DevicePath. hrErrorString.

Message #

The Microsoft iSCSI Target Server service could not load virtual disk %1 located at %2. %3

Fields #

Name	Description
`VirtualDiskIndex` Int32
`DevicePath` UnicodeString
`hrErrorString` UnicodeString

Event ID 15

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not load virtual disk located at .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`DevicePath` UnicodeString
`hrErrorString` UnicodeString

Event ID 16: The iSCSI target is configured to use CHAP authentication but the iSCSI initiator szInitiatorName does not support it.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI target is configured to use CHAP authentication but the iSCSI initiator szInitiatorName does not support it.

Message #

The iSCSI target is configured to use CHAP authentication but the iSCSI initiator %1 does not support it.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 16

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI target is configured to use CHAP authentication but the iSCSI initiator does not support it.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 17: The iSCSI target only supports MD5 CHAP authentication, but the iSCSI initiator szInitiatorName does not support it.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI target only supports MD5 CHAP authentication, but the iSCSI initiator szInitiatorName does not support it.

Message #

The iSCSI target only supports MD5 CHAP authentication, but the iSCSI initiator %1 does not support it.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 17

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI target only supports MD5 CHAP authentication, but the iSCSI initiator does not support it.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 18: The Microsoft iSCSI Target Server service could not authenticate iSCSI initiator szInitiatorName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not authenticate iSCSI initiator szInitiatorName. The challenge was incorrect.

Message #

The Microsoft iSCSI Target Server service could not authenticate iSCSI initiator %1. The challenge was incorrect.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 18

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not authenticate iSCSI initiator . The challenge was incorrect.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 19: The iSCSI target is not configured to use authentication but iSCSI initiator szInitiatorName requested it.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI target is not configured to use authentication but iSCSI initiator szInitiatorName requested it.The target and the initiator are not configured to use the same authentication protocol.

Message #

The iSCSI target is not configured to use authentication but iSCSI initiator %1 requested it.The target and the initiator are not configured to use the same authentication protocol.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 19

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI target is not configured to use authentication but iSCSI initiator requested it.The target and the initiator are not configured to use the same authentication protocol.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 20: iSCSI initiator szInitiatorName successfully logged on to the iSCSI target.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

iSCSI initiator szInitiatorName successfully logged on to the iSCSI target.

Message #

iSCSI initiator %1 successfully logged on to the iSCSI target.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 20

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

iSCSI initiator successfully logged on to the iSCSI target.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 21: iSCSI initiator szInitiatorName logged off of the iSCSI target.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

iSCSI initiator szInitiatorName logged off of the iSCSI target.

Message #

iSCSI initiator %1 logged off of the iSCSI target.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 21

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

iSCSI initiator logged off of the iSCSI target.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 22: iSCSI initiator szInitiatorName requested an invalid iSCSI target: szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

iSCSI initiator szInitiatorName requested an invalid iSCSI target: szTargetName. The login request was rejected.

Message #

iSCSI initiator %1 requested an invalid iSCSI target: %2. The login request was rejected.

Fields #

Name	Description
`szInitiatorName` UnicodeString
`szTargetName` UnicodeString

Event ID 22

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

iSCSI initiator requested an invalid iSCSI target: . The login request was rejected.

Fields #

Name	Description
`szInitiatorName` UnicodeString
`szTargetName` UnicodeString

Event ID 23: iSCSI initiator szInitiatorName sent a PDU with a payload size (ActualSize bytes) larger than the maximum receive data segment length (MaximumAllowedSize bytes).

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

iSCSI initiator szInitiatorName sent a PDU with a payload size (ActualSize bytes) larger than the maximum receive data segment length (MaximumAllowedSize bytes).

Message #

iSCSI initiator %1 sent a PDU with a payload size (%2 bytes) larger than the maximum receive data segment length (%3 bytes).

Fields #

Name	Description
`szInitiatorName` UnicodeString
`ActualSize` UInt32
`MaximumAllowedSize` UInt32

Event ID 23

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

iSCSI initiator sent a PDU with a payload size ( bytes) larger than the maximum receive data segment length ( bytes).

Fields #

Name	Description
`szInitiatorName` UnicodeString
`ActualSize` UInt32
`MaximumAllowedSize` UInt32

Event ID 24: The Microsoft iSCSI Target Server service encountered an error indicating that too many sessions are sharing device DevicePath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service encountered an error indicating that too many sessions are sharing device DevicePath.

Message #

The Microsoft iSCSI Target Server service encountered an error indicating that too many sessions are sharing device %1.

Fields #

Name	Description
`DevicePath` UnicodeString

Event ID 24

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service encountered an error indicating that too many sessions are sharing device .

Fields #

Name	Description
`DevicePath` UnicodeString

Event ID 25: Starting virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Starting virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime.

Message #

Starting virtual disk %1 roll back to the snapshot taken on %2.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 25

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Starting virtual disk roll back to the snapshot taken on .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 26: Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime completed successfully.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime completed successfully.

Message #

Virtual disk %1 roll back to the snapshot taken on %2 completed successfully.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 26

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Virtual disk roll back to the snapshot taken on completed successfully.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 27: Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime was stopped by the user.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Virtual disk VirtualDiskIndex roll back to the snapshot taken on StartTime was stopped by the user.

Message #

Virtual disk %1 roll back to the snapshot taken on %2 was stopped by the user.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 27

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Virtual disk roll back to the snapshot taken on was stopped by the user.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME

Event ID 28: The Microsoft iSCSI Target Server service could not roll back virtual disk VirtualDiskIndex to the snapshot taken on StartTime.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not roll back virtual disk VirtualDiskIndex to the snapshot taken on StartTime. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not roll back virtual disk %1 to the snapshot taken on %2. The operation failed with error code %3.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME
`hrError` UInt32

Event ID 28

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not roll back virtual disk to the snapshot taken on . The operation failed with error code .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME
`hrError` UInt32

Event ID 32: The Microsoft iSCSI Target Server service could not open the local mount driver.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not open the local mount driver (WTLMDrv.sys). Error.

Message #

The Microsoft iSCSI Target Server service could not open the local mount driver (WTLMDrv.sys). %1

Fields #

Name	Description
`Error` Int32

Event ID 32

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 3

Description

The Microsoft iSCSI Target Server service could not open the local mount driver (WTLMDrv.sys).

Fields #

Name	Description
`Error` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 32,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T02:17:57.4953800+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 4604,
      "thread_id": 9684
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Error": "3"
  },
  "message": "The Microsoft iSCSI Target Server service could not open the local mount driver (WTLMDrv.sys). 3"
}

Event ID 33: SCSI command CDBCommand directed at virtual disk LUN failed.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

SCSI command CDBCommand directed at virtual disk LUN failed. Error.

Message #

SCSI command %1 directed at virtual disk %2 failed. %3

Fields #

Name	Description
`CDBCommand` UInt8
`LUN` UInt64
`Error` Int32

Event ID 33

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

SCSI command directed at virtual disk failed.

Fields #

Name	Description
`CDBCommand` UInt8
`LUN` UInt64
`Error` Int32

Event ID 34: The Microsoft iSCSI Target Server service could not delete snapshot of virtual disk VirtualDiskIndex taken at StartTime.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not delete snapshot of virtual disk VirtualDiskIndex taken at StartTime. hrError.

Message #

The Microsoft iSCSI Target Server service could not delete snapshot of virtual disk %1 taken at %2. %3

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME
`hrError` UInt32

Event ID 34

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not delete snapshot of virtual disk taken at .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`StartTime` FILETIME
`hrError` UInt32

Event ID 36: Failed to load iSCSI target szTargetName settings from the registry.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Failed to load iSCSI target szTargetName settings from the registry. The operation failed with error code hrError.

Message #

Failed to load iSCSI target %1 settings from the registry. The operation failed with error code %2.

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 36

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Failed to load iSCSI target settings from the registry. The operation failed with error code .

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 37: Failed to load virtual disk VirtualDiskIndex settings from the registry.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Failed to load virtual disk VirtualDiskIndex settings from the registry. The operation failed with error code hrError.

Message #

Failed to load virtual disk %1 settings from the registry. The operation failed with error code %2.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 37

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Failed to load virtual disk settings from the registry. The operation failed with error code .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 38: The iSCSI initiator szInitiatorName does not have access to this iSCSI target server.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The iSCSI initiator szInitiatorName does not have access to this iSCSI target server. To access storage services, you must create an iSCSI target for the initiator.

Message #

The iSCSI initiator %1 does not have access to this iSCSI target server. To access storage services, you must create an iSCSI target for the initiator.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 38

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The iSCSI initiator does not have access to this iSCSI target server. To access storage services, you must create an iSCSI target for the initiator.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 39: Storage services for iSCSI target szTargetName is disabled.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Storage services for iSCSI target szTargetName is disabled. The log on request from iSCSI initiator szInitiatorName was rejected.

Message #

Storage services for iSCSI target %1 is disabled. The log on request from iSCSI initiator %2 was rejected.

Fields #

Name	Description
`szTargetName` UnicodeString
`szInitiatorName` UnicodeString

Event ID 39

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Storage services for iSCSI target is disabled. The log on request from iSCSI initiator was rejected.

Fields #

Name	Description
`szTargetName` UnicodeString
`szInitiatorName` UnicodeString

Event ID 40: Incoming connection request was rejected.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Incoming connection request was rejected. The operation failed with error code Status. StatusString.

Message #

Incoming connection request was rejected. The operation failed with error code %1. %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`StatusString` UnicodeString

Event ID 40

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Incoming connection request was rejected. The operation failed with error code .

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`StatusString` UnicodeString

Event ID 41: The iSCSI target rejected a connection request from the local computer.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

The iSCSI target rejected a connection request from the local computer. To access the virtual disk from the local computer, use the Disk Access feature in the management console to mount the disk locally.

Event ID 41

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Event ID 44: The Microsoft iSCSI Target Server service could not create a snapshot of virtual disk VirtualDiskIndex.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create a snapshot of virtual disk VirtualDiskIndex. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not create a snapshot of virtual disk %1. The operation failed with error code %2.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 44

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not create a snapshot of virtual disk . The operation failed with error code .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 45: The Microsoft iSCSI Target Server service could not create or open registry key KeyPath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create or open registry key KeyPath. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not create or open registry key %1. The operation failed with error code %2.

Fields #

Name	Description
`KeyPath` UnicodeString
`hrError` UInt32

Event ID 45

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not create or open registry key . The operation failed with error code .

Fields #

Name	Description
`KeyPath` UnicodeString
`hrError` UInt32

Event ID 46: The Microsoft iSCSI Target Server service could not locate missing registry key KeyPath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not locate missing registry key KeyPath. The key was created.

Message #

The Microsoft iSCSI Target Server service could not locate missing registry key %1. The key was created.

Fields #

Name	Description
`KeyPath` UnicodeString

Event ID 46

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not locate missing registry key . The key was created.

Fields #

Name	Description
`KeyPath` UnicodeString

Event ID 48: Virtual Disk VirtualDiskIndex has been disabled.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

Virtual Disk VirtualDiskIndex has been disabled.

Message #

Virtual Disk %1 has been disabled.

Fields #

Name	Description
`VirtualDiskIndex` Int32

Event ID 48

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

Virtual Disk has been disabled.

Fields #

Name	Description
`VirtualDiskIndex` Int32

Event ID 49: The Microsoft iSCSI Target Server service could not create a clustered virtual disk using DevicePath.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create a clustered virtual disk using DevicePath. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not create a clustered virtual disk using %1. The operation failed with error code %2.

Fields #

Name	Description
`DevicePath` UnicodeString
`hrError` UInt32

Event ID 49

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not create a clustered virtual disk using . The operation failed with error code .

Fields #

Name	Description
`DevicePath` UnicodeString
`hrError` UInt32

Event ID 50: The Microsoft iSCSI Target Server service could not delete virtual disk VirtualDiskIndex.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not delete virtual disk VirtualDiskIndex. hrErrorString.

Message #

The Microsoft iSCSI Target Server service could not delete virtual disk %1. %2

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrErrorString` UnicodeString

Event ID 50

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not delete virtual disk .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrErrorString` UnicodeString

Event ID 51: The Microsoft iSCSI Target Server service could not open virtual disk VirtualDiskIndex.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not open virtual disk VirtualDiskIndex. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not open virtual disk %1. The operation failed with error code %2.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 51

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not open virtual disk . The operation failed with error code .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`hrError` UInt32

Event ID 52: The Microsoft iSCSI Target Server service could not assign virtual disk VirtualDiskIndex to iSCSI target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not assign virtual disk VirtualDiskIndex to iSCSI target szTargetName. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not assign virtual disk %1 to iSCSI target %2. The operation failed with error code %3.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 52

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not assign virtual disk to iSCSI target . The operation failed with error code .

Fields #

Name	Description
`VirtualDiskIndex` Int32
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 53: The Microsoft iSCSI Target Server service detected conflicting virtual disk index VirtualDiskIndex assigned to FirstVirtualDisk and SecondVirtualDisk.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

The Microsoft iSCSI Target Server service detected conflicting virtual disk index %1 assigned to %2 and %3. The service automatically updated the virtual disk index of %3 to %4. If this is a snapshot LUN made for a transportable snapshot, it cannot be imported on a different initiator machine automatically. However, it can be manually assigned to a target the initiator connects to.

Fields #

Name	Description
`VirtualDiskIndex` Int32
`FirstVirtualDisk` UnicodeString
`SecondVirtualDisk` UnicodeString
`SecondVirtualDiskIndex` UInt32

Event ID 53

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Fields #

Name	Description
`VirtualDiskIndex` Int32
`FirstVirtualDisk` UnicodeString
`SecondVirtualDisk` UnicodeString
`SecondVirtualDiskIndex` UInt32

Event ID 64: The Microsoft iSCSI Target Server service could not create target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create target szTargetName. hrError.

Message #

The Microsoft iSCSI Target Server service could not create target %1. %2

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 64

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 2

Description

The Microsoft iSCSI Target Server service could not create target .

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 64,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T02:22:29.7735399+00:00",
    "event_record_id": 5,
    "correlation": {
      "ActivityID": "{1AB7EF36-8292-4507-9136-D92922030D87}"
    },
    "execution": {
      "process_id": 4604,
      "thread_id": 12304
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "szTargetName": "labtarget-conflict",
    "hrError": "2147942480"
  },
  "message": "The Microsoft iSCSI Target Server service could not create target labtarget-conflict. 2147942480"
}

Event ID 65: The Microsoft iSCSI Target Server service could not create iSCSI target szTargetName for the cluster resource group.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not create iSCSI target szTargetName for the cluster resource group. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not create iSCSI target %1 for the cluster resource group. The operation failed with error code %2.

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 65

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not create iSCSI target for the cluster resource group. The operation failed with error code .

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 66: The Microsoft iSCSI Target Server service could not open iSCSI target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not open iSCSI target szTargetName. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not open iSCSI target %1. The operation failed with error code %2.

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 66

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not open iSCSI target . The operation failed with error code .

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 67: The Microsoft iSCSI Target Server service could not delete iSCSI target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service could not delete iSCSI target szTargetName. The operation failed with error code hrError.

Message #

The Microsoft iSCSI Target Server service could not delete iSCSI target %1. The operation failed with error code %2.

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 67

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service could not delete iSCSI target . The operation failed with error code .

Fields #

Name	Description
`szTargetName` UnicodeString
`hrError` UInt32

Event ID 68: The Microsoft iSCSI Target Server service successfully initialized iSCSI target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service successfully initialized iSCSI target szTargetName.

Message #

The Microsoft iSCSI Target Server service successfully initialized iSCSI target %1.

Fields #

Name	Description
`szTargetName` UnicodeString

Event ID 68

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Level: 4

Description

The Microsoft iSCSI Target Server service successfully initialized iSCSI target .

Fields #

Name	Description
`szTargetName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-iSCSITarget-Service",
    "guid": "{13953C6E-C594-414E-8BA7-DEB4BA1878E3}",
    "event_source_name": "",
    "event_id": 68,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T02:22:29.6909406+00:00",
    "event_record_id": 4,
    "correlation": {
      "ActivityID": "{530B66BC-533D-491C-ACA0-2190528D4150}"
    },
    "execution": {
      "process_id": 4604,
      "thread_id": 12304
    },
    "channel": "Microsoft-Windows-iSCSITarget-Service/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "szTargetName": "labtarget-conflict"
  },
  "message": "The Microsoft iSCSI Target Server service successfully initialized iSCSI target labtarget-conflict."
}

Event ID 71: The Microsoft iSCSI Target Server service failed to complete service initialization due to reason LineNumber.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Microsoft iSCSI Target Server service failed to complete service initialization due to reason LineNumber. The operation failed with error code Error. ErrorString.

Message #

The Microsoft iSCSI Target Server service failed to complete service initialization due to reason %1. The operation failed with error code %2. %3

Fields #

Name	Description
`LineNumber` UInt32
`Error` Int32
`ErrorString` UnicodeString

Event ID 71

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Microsoft iSCSI Target Server service failed to complete service initialization due to reason . The operation failed with error code .

Fields #

Name	Description
`LineNumber` UInt32
`Error` Int32
`ErrorString` UnicodeString

Event ID 73: The Microsoft iSCSI Target Server service could not online iSCSI target szTargetName.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

The Microsoft iSCSI Target Server service could not online iSCSI target %1. Another target with the same name is already online on this cluster node. This can happen when the two targets are created on two different nodes at the same time. To resolve name conflict, move the target's resource group to another node and delete the target. Create a new target with a different name.

Fields #

Name	Description
`szTargetName` UnicodeString

Event ID 73

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Fields #

Name	Description
`szTargetName` UnicodeString

Event ID 74: The Wintarget service has detected the creation of a failover cluster.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

The Wintarget service has detected the creation of a failover cluster. Any existing iSCSI Target and Virtual Disk objects that were created in standalone mode are no longer accessible. Restart the Wintarget service on any cluster nodes that were running iSCSI Target Server in standalone mode.

Event ID 74

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Event ID 117: iSCSI initiator szInitiatorName has committed a protocol error.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

iSCSI initiator szInitiatorName has committed a protocol error.

Message #

iSCSI initiator %1 has committed a protocol error.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 117

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

iSCSI initiator has committed a protocol error.

Fields #

Name	Description
`szInitiatorName` UnicodeString

Event ID 118: The Cluster Service that the Microsoft iSCSI Target Server service depends on is either disabled or not running.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Description

The Cluster Service that the Microsoft iSCSI Target Server service depends on is either disabled or not running. Use the Services snap-in to start the Cluster Service.

Message #

The Cluster Service that the Microsoft iSCSI Target Server service depends on is either disabled or not running. Use the Services snap-in to start the Cluster Service.

Event ID 118

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Description

The Cluster Service that the Microsoft iSCSI Target Server service depends on is either disabled or not running. Use the Services snap-in to start the Cluster Service.

Event ID 120: A target could not be initialized from its configuration settings.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

A target could not be initialized from its configuration settings. The operation failed with error code %1. This can be caused by corruption in its configuration settings. The target needs to be recreated.

Fields #

Name	Description
`hrError` UInt32

Event ID 120

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Fields #

Name	Description
`hrError` UInt32

Event ID 121: The CHAP of the target szTargetName could not be decrypted, the initiator will not be able to connect to the target.

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Admin

Message #

The CHAP of the target %1 could not be decrypted, the initiator will not be able to connect to the target. To ensure the security of the access, the target has been disabled. You will need to enable the target and reconfigure the CHAP information.

Fields #

Name	Description
`szTargetName` UnicodeString

Event ID 121

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational

Fields #

Name	Description
`szTargetName` UnicodeString

Event ID 256: SNAPSHOT_STATE_MACHINE

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_STATE_MACHINE

Fields #

Name	Description
`SnapshotId` GUID
`OriginalDiskId` UInt32
`State` UInt32

Event ID 257: DISKMGR_CREATEDISKStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32
`DevicePath` UnicodeString

Event ID 258: DISKMGR_CREATEDISKStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`VirtualDiskIndex` UInt32

Event ID 259: DISKMGR_CREATEDISKStart259

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Start

Fields #

Name	Description
`ResourceGuid` GUID

Event ID 260: DISKMGR_CREATEDISKStop260

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`VirtualDiskIndex` UInt32

Event ID 261: ISCSITARGETRESOURCE_LIFETIMEStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITARGETRESOURCE_LIFETIME
Opcode: Start

Fields #

Name	Description
`pResource` Pointer
`Type` UInt32

Event ID 262: ISCSITARGETRESOURCE_LIFETIMEStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITARGETRESOURCE_LIFETIME
Opcode: Stop

Fields #

Name	Description
`pResource` Pointer
`Type` UInt32

Event ID 263: ISCSIRESOURCECOLLECTION_LIFETIME

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSIRESOURCECOLLECTION_LIFETIME

Fields #

Name	Description
`pResource` Pointer
`AddOrRemove` Boolean

Event ID 264: ISCSIRESOURCECOLLECTION_LIFETIME264

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSIRESOURCECOLLECTION_LIFETIME

Fields #

Name	Description
`pResource` Pointer
`AddOrRemove` Boolean

Event ID 265: ISCSIRESOURCECOLLECTION_LIFETIME265

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSIRESOURCECOLLECTION_LIFETIME

Fields #

Name	Description
`pResource` Pointer
`AddOrRemove` Boolean

Event ID 266: ISCSITGT_ERROR_TRACE

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITGT_ERROR_TRACE

Fields #

Name	Description
`Line` UInt32
`Error` UInt32
`NumTraces` UInt32
`ReturnAddresses` Int16
`FileAndFunction` AnsiString

Event ID 267: TARGETMGR_CREATETARGETStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CREATETARGET
Opcode: Start

Fields #

Name	Description
`TargetName` UnicodeString
`ResourceGroup` UnicodeString

Event ID 268: TARGETMGR_CREATETARGETStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CREATETARGET
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`pThis` Pointer

Event ID 269: TARGETMGR_CLOSETARGETStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CLOSETARGET
Opcode: Start

Fields #

Name	Description
`TargetName` UnicodeString

Event ID 270: TARGETMGR_CLOSETARGETStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CLOSETARGET
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 271: DISKMGR_GETDISKStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_GETDISK
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32

Event ID 272: DISKMGR_GETDISKStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_GETDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`pThis` Pointer

Event ID 273: DISKMGR_CREATEDISKStart273

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32
`DevicePath` UnicodeString

Event ID 274: DISKMGR_CREATEDISKStop274

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`VirtualDiskIndex` UInt32

Event ID 275: DISKMGR_GETDISKStart275

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_GETDISK
Opcode: Start

Fields #

Name	Description
`DevicePath` UnicodeString

Event ID 276: DISKMGR_GETDISKStop276

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_GETDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`pThis` Pointer

Event ID 277: SNAPSHOTMGR_NOTIFYStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_NOTIFY
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32
`ResourceGuid` GUID

Event ID 278: SNAPSHOTMGR_NOTIFYStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_NOTIFY
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 279: DISKMGR_CREATEDISKStart279

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Start

Event ID 280: DISKMGR_CREATEDISKStop280

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_CREATEDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`VirtualDiskIndex` UInt32

Event ID 281: DISKMGR_DELETEDISKStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_DELETEDISK
Opcode: Start

Event ID 282: DISKMGR_DELETEDISKStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_DELETEDISK
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`VirtualDiskIndex` UInt32

Event ID 283: TARGETMGR_CREATETARGETStart283

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CREATETARGET
Opcode: Start

Fields #

Name	Description
`TargetName` UnicodeString

Event ID 284: TARGETMGR_CREATETARGETStop284

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_CREATETARGET
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`pThis` Pointer

Event ID 285: ISCSI_PROTOCOL_LIFETIMEStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer
`Type` UInt32

Event ID 286: ISCSI_PROTOCOL_LIFETIMEStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME
Opcode: Stop

Fields #

Name	Description
`Connection` Pointer
`OldState` UInt32
`NewState` UInt32

Event ID 287: ISCSI_PROTOCOL_LIFETIMEStop287

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`Type` UInt32

Event ID 288: SNAPSHOTMGR_NOTIFYStart288

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_NOTIFY
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32

Event ID 289: SNAPSHOTMGR_NOTIFYStop289

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_NOTIFY
Opcode: Stop

Event ID 290: ISCSITARGETRESOURCE_LIFETIME

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITARGETRESOURCE_LIFETIME

Fields #

Name	Description
`pEntity` Pointer
`EntityId` GUID
`VirtualDiskIndex` UInt32
`DevicePath` UnicodeString

Event ID 291: ISCSITARGETRESOURCE_LIFETIME291

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITARGETRESOURCE_LIFETIME

Fields #

Name	Description
`pEntity` Pointer
`EntityId` GUID
`OriginalVirtualDiskIndex` UInt32

Event ID 292: ISCSITARGETRESOURCE_LIFETIME292

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSITARGETRESOURCE_LIFETIME

Fields #

Name	Description
`pEntity` Pointer
`EntityId` GUID
`TargetName` UnicodeString

Event ID 293: SNAPSHOT_OPERATIONStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer

Event ID 294: SNAPSHOT_OPERATIONStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`hResult` UInt32
`ExportedVirtualDiskIndex` UInt32

Event ID 295: SNAPSHOTMGR_OPERATIONStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotId` GUID

Event ID 296: SNAPSHOTMGR_OPERATIONStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 297: SNAPSHOTMGR_OPERATIONStart297

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`VirtualDiskIndex` UInt32

Event ID 298: SNAPSHOTMGR_OPERATIONStop298

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`SnapshotId` GUID

Event ID 299: SNAPSHOTMGR_OPERATIONStart299

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 300: SNAPSHOTMGR_OPERATIONStop300

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 301: SNAPSHOTMGR_OPERATIONStart301

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 302: SNAPSHOTMGR_OPERATIONStop302

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 303: SNAPSHOTMGR_OPERATIONStart303

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 304: SNAPSHOTMGR_OPERATIONStop304

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 305: SNAPSHOTMGR_OPERATIONStart305

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 306: SNAPSHOTMGR_OPERATIONStop306

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 307: SNAPSHOTMGR_OPERATIONStart307

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 308: SNAPSHOTMGR_OPERATIONStop308

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 309: SNAPSHOTMGR_OPERATIONStart309

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotSetId` GUID

Event ID 310: SNAPSHOTMGR_OPERATIONStop310

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 311: SNAPSHOTMGR_OPERATIONStart311

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`SnapshotId` GUID

Event ID 312: SNAPSHOTMGR_OPERATIONStop312

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOTMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32
`pSnapshot` Pointer

Event ID 313: ISCSI_PROTOCOL_LIFETIME

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME

Fields #

Name	Description
`LocalAddressLength` UInt32
`LocalAddress` Binary
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 314: ISCSI_PROTOCOL_LIFETIME314

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME

Fields #

Name	Description
`TSIH` UInt16
`ISID` UInt16
`CID` UInt16
`InitiatorTaskTag` UInt32
`InitiatorIQN` UnicodeString
`TargetIQN` UnicodeString

Event ID 315: ISCSI_PROTOCOL_LIFETIMEStart315

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME
Opcode: Start

Fields #

Name	Description
`Session` Pointer
`Connection` Pointer
`RemoteAddressLength` UInt32
`RemoteAddress` Binary

Event ID 316: ISCSI_PROTOCOL_LIFETIMEStop316

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: ISCSI_PROTOCOL_LIFETIME
Opcode: Stop

Fields #

Name	Description
`Session` Pointer
`Connection` Pointer

Event ID 318: TARGETMGR_OPERATIONStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`ResourceGuid` GUID
`ControlCode` UInt32

Event ID 319: TARGETMGR_OPERATIONStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 320: DISKMGR_OPERATIONStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`ResourceGuid` GUID
`ControlCode` UInt32

Event ID 321: DISKMGR_OPERATIONStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 322: TARGETMGR_OPERATIONStart322

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`ResourceGuid` GUID

Event ID 323: TARGETMGR_OPERATIONStop323

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: TARGETMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 324: SNAPSHOT_OPERATIONStart324

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer

Event ID 325: SNAPSHOT_OPERATIONStop325

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`hResult` UInt32

Event ID 326: DEVMGR_OPERATIONStart

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DEVMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString

Event ID 327: DEVMGR_OPERATIONStop

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DEVMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 330: DEVMGR_OPERATIONStart330

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DEVMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`Path` UnicodeString
`ParentPath` UnicodeString

Event ID 331: DEVMGR_OPERATIONStop331

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DEVMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 332: SNAPSHOT_OPERATIONStart332

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer

Event ID 333: SNAPSHOT_OPERATIONStop333

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`hResult` UInt32

Event ID 334: SNAPSHOT_OPERATIONStart334

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer

Event ID 335: SNAPSHOT_OPERATIONStop335

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`hResult` UInt32

Event ID 336: SNAPSHOT_OPERATIONStart336

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Start

Fields #

Name	Description
`pEntity` Pointer

Event ID 337: SNAPSHOT_OPERATIONStop337

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: SNAPSHOT_OPERATION
Opcode: Stop

Fields #

Name	Description
`pEntity` Pointer
`hResult` UInt32

Event ID 338: PDU_PROCESSING

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: PDU_PROCESSING

Fields #

Name	Description
`Connection` Pointer
`Pdu` AnsiString

Event ID 339: PDU_PROCESSING339

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: PDU_PROCESSING

Fields #

Name	Description
`Connection` Pointer
`PayloadSize` UInt32
`PduPayload` Int8

Event ID 340: CDB_DISPATCH

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: CDB_DISPATCH

Fields #

Name	Description
`Target` Pointer
`Cdb` AnsiString

Event ID 341: PDU_PROCESSING341

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: PDU_PROCESSING

Fields #

Name	Description
`Connection` Pointer
`Pdu` AnsiString

Event ID 342: PDU_PROCESSING342

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: PDU_PROCESSING

Fields #

Name	Description
`Connection` Pointer
`PayloadSize` UInt32
`PduPayload` Int8

Event ID 343: DISKMGR_OPERATIONStart343

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`PhysicalDiskResGuid` GUID

Event ID 344: DISKMGR_OPERATIONStop344

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 345: DISKMGR_OPERATIONStart345

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Start

Fields #

Name	Description
`PhysicalDiskResGuid` GUID

Event ID 346: DISKMGR_OPERATIONStop346

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: DISKMGR_OPERATION
Opcode: Stop

Fields #

Name	Description
`hResult` UInt32

Event ID 347: VIRTUALDISK_OPERATION

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: VIRTUALDISK_OPERATION

Fields #

Name	Description
`pResource` Pointer
`hResult` UInt32
`Enabled` Boolean

Event ID 4096: UNIFIED_TRACING

Provider: Microsoft-Windows-iSCSITarget-Service
Channel: Operational
Task: UNIFIED_TRACING

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 13953c6e-c594-414e-8ba7-deb4ba1878e3

Defined in iscsitgt.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-iSCSITarget-Service registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)