Microsoft-Windows-ReFsDedupSvc
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | ReFs Dedup Service Started | Operational | N | N |
| 2 | ReFs Dedup Service Stopped. | Operational | N | N |
| 3 | ReFs Dedup/Compression job Started. | Operational | N | N |
| 4 | ReFs Dedup/Compression job Stopped. | Operational | N | N |
| 5 | ReFs Dedup/Compression schedule updated. | Operational | N | N |
| 6 | ReFs Dedup Service started monitoring a volume. | Operational | N | N |
| 7 | ReFs Dedup Service stopped monitoring a volume. | Operational | N | N |
| 8 | ReFs Dedup/Compression job exceeded maximum run time. | Operational | N | N |
| 9 | ReFs Dedup service detected corrupt schedule data in volume. | Operational | N | N |
| 10 | ReFs Dedup service detected corrupt results data in volume. | Operational | N | N |
| 11 | ReFs Dedup service detected corrupt state. | Operational | N | N |
| 12 | ReFs Dedup/Compression settings updated for volume. | Operational | N | N |
| 13 | ReFs Dedup/Compression job Failed. | Operational | N | N |
| 14 | ReFs Dedup scrub schedule updated. | Operational | N | N |
| 15 | ReFs Dedup service detected corrupt scrub schedule data in volume. | Operational | N | N |
Event ID 1: ReFs Dedup Service Started
#Event ID 5: ReFs Dedup/Compression schedule updated.
#Event ID 6: ReFs Dedup Service started monitoring a volume.
#Event ID 7: ReFs Dedup Service stopped monitoring a volume.
#Event ID 8: ReFs Dedup/Compression job exceeded maximum run time.
#Event ID 9: ReFs Dedup service detected corrupt schedule data in volume.
#Event ID 10: ReFs Dedup service detected corrupt results data in volume.
#Event ID 11: ReFs Dedup service detected corrupt state.
#Event ID 12: ReFs Dedup/Compression settings updated for volume.
#Provenance
ETW provider GUID 596cb176-fb71-587a-8ffb-f5cf15ee1e36
Defined in ReFsDedupSvc.Exe, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB