Microsoft-Windows-ServicesForNFS-Client

22 events across 2 channels

Event	Title	Channel	Sample
5000	Service Control Manager failed a request for Client for NFS to initialize …	Operational	N
5001	Service Control Manager failed a request to update service status ErrorString.	Operational	N
5002	Windows(R) Sockets failed a request to initialize ErrorString.	Operational	N
5003	Windows(R) failed a request to initialize the Network File System (NFS) …	Operational	N
5004	Windows(R) failed a request to open a communications port to the Network File …	Operational	N
5005	Windows(R) failed a request to create a supporting process thread ErrorString.	Operational	N
5006	The Windows(R) remote procedure call (RPC) subsystem failed a request to …	Operational	N
5007	Windows(R) failed a request to create a security descriptor ErrorString.	Operational	N
5008	Windows(R) failed a request to unload the Network File System (NFS) redirector …	Operational	N
5009	Client for NFS started successfully.	Operational	Y
5010	Client for NFS stopped successfully.	Operational	N
5011	The Windows(R) remote procedure call (RPC) subsystem failed a request to clean …	Operational	N
5012	Windows(R) failed a request to clean up after completing tasks for client …	Operational	N
5013	Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to …	IdentityMapping	N
5013	Event ID 5013	Operational	Y
5014	The Active Directory Domain Services(R) uidNumber attribute is not set for …	IdentityMapping	N
5014	Event ID 5014	Operational	N
5015	The Active Directory Domain Services(R) gidNumber attribute is not set for …	IdentityMapping	N
5015	Event ID 5015	Operational	N
5100	Windows(R) failed a request to access system resources associated with the …	Operational	N
5101	Windows(R) failed a request to communicate with the Network File System (NFS) …	Operational	N
5102	Client for NFS cannot communicate with the remote Network File System (NFS) …	Operational	N

Event ID 5000: Service Control Manager failed a request for Client for NFS to initialize ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Service Control Manager failed a request for Client for NFS to initialize ErrorString.

Message #

Service Control Manager failed a request for Client for NFS to initialize %1.

Client for NFS cannot start.

Windows(R) may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5001: Service Control Manager failed a request to update service status ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Service Control Manager failed a request to update service status ErrorString.

Message #

Service Control Manager failed a request to update service status %1.

Client for NFS cannot properly reflect service status in administrative tools, such as Computer Management.

Windows(R) may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5002: Windows(R) Sockets failed a request to initialize ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) Sockets failed a request to initialize ErrorString.

Message #

Windows(R) Sockets failed a request to initialize %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5003: Windows(R) failed a request to initialize the Network File System (NFS) redirector ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to initialize the Network File System (NFS) redirector ErrorString.

Message #

Windows(R) failed a request to initialize the Network File System (NFS) redirector %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5004: Windows(R) failed a request to open a communications port to the Network File System (NFS) redirector ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to open a communications port to the Network File System (NFS) redirector ErrorString.

Message #

Windows(R) failed a request to open a communications port to the Network File System (NFS) redirector %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5005: Windows(R) failed a request to create a supporting process thread ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to create a supporting process thread ErrorString.

Message #

Windows(R) failed a request to create a supporting process thread %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5006: The Windows(R) remote procedure call (RPC) subsystem failed a request to register Client for NFS ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

The Windows(R) remote procedure call (RPC) subsystem failed a request to register Client for NFS ErrorString.

Message #

The Windows(R) remote procedure call (RPC) subsystem failed a request to register Client for NFS %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5007: Windows(R) failed a request to create a security descriptor ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to create a security descriptor ErrorString.

Message #

Windows(R) failed a request to create a security descriptor %1.

Client for NFS cannot start.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5008: Windows(R) failed a request to unload the Network File System (NFS) redirector while Client for NFS was stopping ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to unload the Network File System (NFS) redirector while Client for NFS was stopping ErrorString.

Message #

Windows(R) failed a request to unload the Network File System (NFS) redirector while Client for NFS was stopping %1.

Client for NFS stopped anyway and may not be able to restart.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5009: Client for NFS started successfully.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational
Level: 4

Description

Client for NFS started successfully.

Message #

Client for NFS started successfully.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServicesForNFS-Client",
    "guid": "{746A1133-BC1E-47C7-8C95-3D52C39114F9}",
    "event_source_name": "",
    "event_id": 5009,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T03:56:45.7747055+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 10704,
      "thread_id": 8240
    },
    "channel": "Microsoft-Windows-ServicesForNFS-Client/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": "Client for NFS started successfully."
}

Event ID 5010: Client for NFS stopped successfully.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Client for NFS stopped successfully.

Message #

Client for NFS stopped successfully.

Event ID 5011: The Windows(R) remote procedure call (RPC) subsystem failed a request to clean up after completing tasks for a client ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

The Windows(R) remote procedure call (RPC) subsystem failed a request to clean up after completing tasks for a client ErrorString.

Message #

The Windows(R) remote procedure call (RPC) subsystem failed a request to clean up after completing tasks for a client %1.

To ensure internal consistency, Client for NFS stopped.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5012: Windows(R) failed a request to clean up after completing tasks for client ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to clean up after completing tasks for client ErrorString.

Message #

Windows(R) failed a request to clean up after completing tasks for client %1.

To ensure internal consistency, Client for NFS stopped.

Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5013: Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: IdentityMapping

Description

Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user ErrorString.

Message #

Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Windows user is in Active Directory Domain Services and has access permissions.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5013

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational
Level: 3

Description

Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user .

Fields #

Name	Description
`ErrorString` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServicesForNFS-Client",
    "guid": "{746A1133-BC1E-47C7-8C95-3D52C39114F9}",
    "event_source_name": "",
    "event_id": 5013,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T04:07:20.6600886+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 10704,
      "thread_id": 4160
    },
    "channel": "Microsoft-Windows-ServicesForNFS-Client/IdentityMapping",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ErrorString": "ludus\\domainadmin"
  },
  "message": "Windows(R) Lightweight Directory Access Protocol (LDAP) failed a request to connect to Active Directory Domain Services(R) for Windows user ludus\\domainadmin.\r\n\r\nWithout the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.\r\n\r\nVerify that the Windows user is in Active Directory Domain Services and has access permissions."
}

Event ID 5014: The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: IdentityMapping

Description

The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user ErrorString.

Message #

The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Active Directory Domain Services schema includes UNIX identity data, and then set the uidNumber attribute.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5014

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

The Active Directory Domain Services(R) uidNumber attribute is not set for Windows(R) user .

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5015: The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user ErrorString.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: IdentityMapping

Description

The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user ErrorString.

Message #

The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user %1.

Without the corresponding UNIX identity of the Windows user, the user cannot access Network File System (NFS) shared resources.

Verify that the Active Directory Domain Services schema includes UNIX identity data, and then set the gidNumber attribute.

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5015

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

The Active Directory Domain Services(R) gidNumber attribute is not set for Windows(R) user .

Fields #

Name	Description
`ErrorString` UnicodeString

Event ID 5100: Windows(R) failed a request to access system resources associated with the Network File System (NFS) network provider.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to access system resources associated with the Network File System (NFS) network provider.

Message #

Windows(R) failed a request to access system resources associated with the Network File System (NFS) network provider.

 If this problem persists, users may not be able to access NFS shared resources.

 Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Event ID 5101: Windows(R) failed a request to communicate with the Network File System (NFS) redirector.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Windows(R) failed a request to communicate with the Network File System (NFS) redirector.

Message #

Windows(R) failed a request to communicate with the Network File System (NFS) redirector.

 If this problem persists, users may not be able to access NFS shared resources.

 Windows may be low on system resources.  Try increasing available system resources by closing programs, then start Client for NFS manually.

Event ID 5102: Client for NFS cannot communicate with the remote Network File System (NFS) server ServerName.

Provider: Microsoft-Windows-ServicesForNFS-Client
Channel: Operational

Description

Client for NFS cannot communicate with the remote Network File System (NFS) server ServerName.

Message #

Client for NFS cannot communicate with the remote Network File System (NFS) server %1.

 RPC Port Mapper (also known as Portmap and Rpcbind) may not be running on the remote NFS server.

 Try starting RPC Port Mapper on the remote NFS server.

Fields #

Name	Description
`ServerName` UnicodeString

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)