detection.wiki

Microsoft-Windows-ServicesForNFS-Client

EventTitleChannelSampleRule
5000Service Control Manager failed a request for Client for NFS to initialize …OperationalNN
5001Service Control Manager failed a request to update service status ErrorString.OperationalNN
5002Windows(R) Sockets failed a request to initialize ErrorString.OperationalNN
5003Windows(R) failed a request to initialize the Network File System (NFS) …OperationalNN
5004Windows(R) failed a request to open a communications port to the Network File …OperationalNN
5005Windows(R) failed a request to create a supporting process thread ErrorString.OperationalNN
5006The Windows(R) remote procedure call (RPC) subsystem failed a request to …OperationalNN
5007Windows(R) failed a request to create a security descriptor ErrorString.OperationalNN
5008Windows(R) failed a request to unload the Network File System (NFS) redirector …OperationalNN
5009Client for NFS started successfully.OperationalYN
5010Client for NFS stopped successfully.OperationalNN
5011The Windows(R) remote procedure call (RPC) subsystem failed a request to clean …OperationalNN
5012Windows(R) failed a request to clean up after completing tasks for client …OperationalNN
5013Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to …IdentityMappingYN
5013Event ID 5013OperationalYN
5014The Active Directory Domain Services(R) uidNumber attribute is not set for …IdentityMappingNN
5014Event ID 5014OperationalNN
5015The Active Directory Domain Services(R) gidNumber attribute is not set for …IdentityMappingNN
5015Event ID 5015OperationalNN
5100Windows(R) failed a request to access system resources associated with the …OperationalNN
5101Windows(R) failed a request to communicate with the Network File System (NFS) …OperationalNN
5102Client for NFS cannot communicate with the remote Network File System (NFS) …OperationalNN

Event ID 5000: Service Control Manager failed a request for Client for NFS to initialize ErrorString.

#
Channel
Operational

Message #

Service Control Manager failed a request for Client for NFS to initialize %1.

Client for NFS cannot start.

Windows(R) may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5001: Service Control Manager failed a request to update service status ErrorString.

#
Channel
Operational

Message #

Service Control Manager failed a request to update service status %1.

Client for NFS cannot properly reflect service status in administrative tools, such as Computer Management.

Windows(R) may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5002: Windows(R) Sockets failed a request to initialize ErrorString.

#
Channel
Operational

Message #

Windows(R) Sockets failed a request to initialize %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5003: Windows(R) failed a request to initialize the Network File System (NFS) redirector ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to initialize the Network File System (NFS) redirector %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5004: Windows(R) failed a request to open a communications port to the Network File System (NFS) redirector ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to open a communications port to the Network File System (NFS) redirector %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5005: Windows(R) failed a request to create a supporting process thread ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to create a supporting process thread %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5006: The Windows(R) remote procedure call (RPC) subsystem failed a request to register Client for NFS ErrorString.

#
Channel
Operational

Message #

The Windows(R) remote procedure call (RPC) subsystem failed a request to register Client for NFS %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5007: Windows(R) failed a request to create a security descriptor ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to create a security descriptor %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5008: Windows(R) failed a request to unload the Network File System (NFS) redirector while Client for NFS was stopping ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to unload the Network File System (NFS) redirector while Client for NFS was stopping %1.

Client for NFS stopped anyway and may not be able to restart.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5009: Client for NFS started successfully.

#
Channel
Operational
Level
4

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServicesForNFS-Client",
    "guid": "{746A1133-BC1E-47C7-8C95-3D52C39114F9}",
    "event_source_name": "",
    "event_id": 5009,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T03:56:45.7747055+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 10704,
      "thread_id": 8240
    },
    "channel": "Microsoft-Windows-ServicesForNFS-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": "Client for NFS started successfully."
}

Event ID 5010: Client for NFS stopped successfully.

#
Channel
Operational

Event ID 5011: The Windows(R) remote procedure call (RPC) subsystem failed a request to clean up after completing tasks for a client ErrorString.

#
Channel
Operational

Message #

The Windows(R) remote procedure call (RPC) subsystem failed a request to clean up after completing tasks for a client %1.

To ensure internal consistency, Client for NFS stopped.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5012: Windows(R) failed a request to clean up after completing tasks for client ErrorString.

#
Channel
Operational

Message #

Windows(R) failed a request to clean up after completing tasks for client %1.

To ensure internal consistency, Client for NFS stopped.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5013: Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user ErrorString.

#
Channel
IdentityMapping
Level
3

Message #

Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Windows user is in Active Directory Domain Services and has access permissions.

Fields #

NameDescription
ErrorString UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServicesForNFS-Client",
    "guid": "746A1133-BC1E-47C7-8C95-3D52C39114F9",
    "event_source_name": "",
    "event_id": 5013,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T04:07:20.660088+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 10704,
      "thread_id": 4160
    },
    "channel": "Microsoft-Windows-ServicesForNFS-Client/IdentityMapping",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ErrorString": "ludus\\domainadmin"
  },
  "message": ""
}

Event ID 5013

#
Channel
Operational
Level
3

Description

Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user .

Fields #

NameDescription
ErrorString UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServicesForNFS-Client",
    "guid": "{746A1133-BC1E-47C7-8C95-3D52C39114F9}",
    "event_source_name": "",
    "event_id": 5013,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T04:07:20.6600886+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 10704,
      "thread_id": 4160
    },
    "channel": "Microsoft-Windows-ServicesForNFS-Client/IdentityMapping",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ErrorString": "ludus\\domainadmin"
  },
  "message": "Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user ludus\\domainadmin.\r\n\r\nWithout the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.\r\n\r\nVerify that the Windows user is in Active Directory Domain Services and has access permissions."
}

Event ID 5014: The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user ErrorString.

#
Channel
IdentityMapping

Message #

The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Active Directory Domain Services schema includes UNIX identity data, and then set the uidNumber attribute.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5014

#
Channel
Operational

Description

The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user .

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5015: The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user ErrorString.

#
Channel
IdentityMapping

Message #

The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Active Directory Domain Services schema includes UNIX identity data, and then set the gidNumber attribute.

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5015

#
Channel
Operational

Description

The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user .

Fields #

NameDescription
ErrorString UnicodeString

Event ID 5100: Windows(R) failed a request to access system resources associated with the Network File System (NFS) network provider.

#
Channel
Operational

Message #

Windows(R) failed a request to access system resources associated with the Network File System (NFS) network provider.

 If this problem persists, users may not be able to access NFS shared resources.

 Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Event ID 5101: Windows(R) failed a request to communicate with the Network File System (NFS) redirector.

#
Channel
Operational

Message #

Windows(R) failed a request to communicate with the Network File System (NFS) redirector.

 If this problem persists, users may not be able to access NFS shared resources.

 Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Event ID 5102: Client for NFS cannot communicate with the remote Network File System (NFS) server ServerName.

#
Channel
Operational

Message #

Client for NFS cannot communicate with the remote Network File System (NFS) server %1.

 RPC Port Mapper (also known as Portmap and Rpcbind) may not be running on the remote NFS server.

 Try starting RPC Port Mapper on the remote NFS server.

Fields #

NameDescription
ServerName UnicodeString